AI Governance & Compliance
Enterprise AI You Can
Actually Audit.
Every Ripplemesh AI agent operates within documented boundaries, logs every interaction, and routes sensitive queries through a PII-protected architecture — designed for enterprise compliance, not bolted on after the fact.
Framework Coverage
NIST AI Risk Management Framework
The NIST AI RMF defines four core functions for responsible AI deployment. Ripplemesh satisfies each — not as a compliance exercise, but as an architectural reality.
Agent registry with documented roles, tool permissions, and scope boundaries. Every agent's behavior is defined in configuration, not emergent.
Organizational context mapped to agent capabilities at deployment. Risk classification per agent, per data domain, per user role.
Every query logs execution time, confidence scores, entities accessed, and data classification. Full audit trail per interaction.
Gap Console tracks unanswered queries. PII access attempts are blocked and logged. Human-in-the-loop escalation paths defined per agent.
EU AI Act Alignment
Article-by-Article Coverage
Ripplemesh's architecture was designed with EU AI Act requirements in mind — auditability, transparency, human oversight, and data governance are structural, not configured.
Risk Management System
Ripplemesh agents operate within documented risk classifications. Tool permissions are bounded. No agent can access data outside its defined scope.
Data Governance
PII is architecturally separated from the intelligence ledger. The UID Lookup Table holds non-sensitive identifiers; deep PII is RLS-protected and HR-only.
Record-Keeping
Every agent interaction is logged: user, role, timestamp, query intent, entities accessed, execution time, and response confidence.
Transparency
Agents communicate their data sources and reasoning. Users are informed when a query is routed to deterministic data vs. LLM narration.
Human Oversight
Gap Console flags unresolvable queries for human review. No agent takes autonomous action on high-risk operations without explicit authorization.
Accuracy & Robustness
Deterministic triage layer ensures quantitative answers are computed from verified data, not model memory. Factual accuracy is structural, not probabilistic.
Audit Trail
What's Logged — Everything.
Ripplemesh logs every meaningful event in the AI interaction lifecycle. Your compliance team gets a complete, queryable audit trail — not a summary.
PII Architecture
Privacy by Architecture
Ripplemesh separates non-sensitive identifiers from personal data at the database layer — not the application layer — ensuring the intelligence ledger can never leak PII even if queried directly.
UID Lookup Table
Managed Database · Non-Sensitive
- Non-PII Universal Actor IDs (uid: user_abc123)
- Used in all experience statements and analytics
- Analyzable, exportable, and shareable with zero PII exposure
- GDPR structurally safe — no personal data in the ledger
Deep PII Store
ManagedUser Entity · Row-Level Security · HR-Only Access
- Full name, email, HR flags, performance records
- RLS enforcement — HR Director role required for access
- Resolved only via audited resolveActorPII function
- Every resolution attempt is logged for compliance review