AI agents your examiners can sign off on
Banks, insurers and fintechs are rolling out coding agents and MCP-connected assistants faster than model risk and information security can review them. Prismor puts one enforceable policy at the tool call and keeps the evidence.
Where agent rollouts stall at financial institutions
Engineering teams get agents working in a week. Getting them past model risk management, InfoSec and internal audit takes a quarter, because nobody can answer what the agent is allowed to touch.
Shadow AI with client data in reach
Developers install agents, MCP servers and skills on machines that already hold customer records, trading code and production credentials. Nothing inventories them, and nothing stops them.
No audit trail at the action level
Prompt logs show what was asked. Examiners want to know what the agent actually did: which files it read, which commands ran, where the data went, and who approved it.
Secrets and account data in every context window
API keys, database strings and account identifiers sit in .env files and repos. Once an agent reads them they are in the prompt, the transcript and whatever the model provider retains.
Controls that meet the supervisory bar
One signed policy, enforced on every enrolled agent, with evidence that it was followed.
Signed, versioned policy
Policies are authored centrally, cryptographically signed and pulled by every device. Agents cannot loosen hardened rules, and every change is attributable.
Tamper-evident audit trail
Every tool call is recorded with the decision and the rule behind it, hash-chained so gaps and edits show. Export a Proof Pack when audit asks.
SSO, SCIM and role hierarchy
Provision admins and members from your identity provider. Policy applies per organisation, team, device and agent, so a trading desk and a marketing team do not share rules.
Human-in-the-loop approvals
Route high-risk actions such as production deploys or payment-system changes to a named approver, with the request and outcome kept in the trail.
What we see in the field
Three observations from teams in this sector, before the product pitch.
DORA turned agent risk into ICT risk
Since January 2025, EU financial entities must show they manage ICT third-party and operational risk. A coding agent with production access is exactly that, and supervisors are starting to ask for its controls in the same register as any other system.
Model risk teams now review agents, not just models
SR 11-7 reviews used to end at the model. An agent adds tools, credentials and side effects the model documentation never covered. The review question has moved from "is the output right" to "what could it have done".
The audit unit is the tool call
Prompt logs and chat transcripts do not satisfy an examiner asking which file was read or which host received data. Institutions that log at the action level answer in minutes; the rest reconstruct from shell history.
How Prismor fits
Prismor sits between the agents your developers already use and the systems your controls already protect. Nothing in the existing stack is replaced.
Beside the agent
Installs as a hook or gateway for Claude Code, Codex, Cursor and MCP servers on each developer machine or agent host. Developers keep their tools.
Under your identity provider
Admins and members come from Okta or Entra through SSO and SCIM. Policy follows the org, team and device hierarchy you already maintain.
Into your SIEM and GRC
Every decision streams to Splunk or Sentinel over OCSF, and Proof Pack exports drop into the evidence folder your audit team already keeps.
What platform and security engineering actually need
Tool-call interception
Prismor hooks the agent at the point it acts: shell, file, network and MCP calls are checked against policy before they run, not flagged afterwards.
Secret cloaking
Credentials are swapped for placeholders before the agent sees them and restored only at execution. Keys never enter the prompt or the transcript.
Egress allowlist
Agents reach only the hosts you name. An assistant that tries to post a customer file to an unknown endpoint is stopped at the call.
MCP gateway
One governed endpoint in front of every MCP server, with pre-call policy and injection scanning on results coming back from core-banking or CRM connectors.
Shadow AI discovery
Inventory every agent, MCP server and API key across the fleet, including the ones nobody enrolled, and push them under policy.
SIEM export over OCSF
Stream agent activity into Splunk, Sentinel or any OCSF-capable SIEM alongside the rest of your detections.
Agent workflows in financial institutions, governed by Prismor
- Core-banking modernisation
Coding agents refactoring COBOL and Java estates without touching production connection strings.
- Regulatory reporting automation
Agents assembling filings from internal data, with every source read logged.
- Fraud and AML tooling
Assistants querying case-management systems through a governed MCP connector.
- Internal knowledge search
Retrieval agents scoped to approved repositories and document stores only.
- Model-risk documentation
A per-agent record of permitted tools and actual behaviour for MRM review.
- Third-party agent evaluation
Trial a vendor agent inside an observe-only policy before granting it anything.
Deployment that fits the boundary
Policy is evaluated where the agent runs. Where the console lives is up to you.
Open-source runtime
The interception layer runs on the developer machine or the agent host. Policy is evaluated locally, so a blocked tool call never leaves the box.
Hosted control plane
Enrol devices and agents to the Prismor console for fleet-wide policy, live activity, approvals and Proof Pack exports.
Self-hosted or on-prem
Run the control plane inside your own VPC or data centre on Enterprise plans, with telemetry routed to your SIEM over OCSF.
Fail closed
If a signed policy cannot be verified or the runtime is tampered with, the agent stops rather than running unchecked.
Frequently asked questions
Does customer data leave our environment?
Policy is evaluated on the machine running the agent. Telemetry sent to the console is redacted at the source, and Enterprise customers can run the control plane self-hosted and route events to their own SIEM.
Can we stop an agent from reaching the model provider or the internet at all?
Yes. The egress allowlist names the hosts an agent may reach. Anything else is blocked at the tool call, including calls the agent makes through MCP servers.
What do we hand to an examiner?
The signed policy in force, the version history of changes to it, and the hash-chained trail of every tool call with its allow, deny or approval decision. Proof Pack bundles these for export.
Which agents does this cover?
Claude Code, Codex, Cursor and other hook-capable coding agents, plus Python and TypeScript agent frameworks through adapters, and any MCP server through the gateway.
Want a control plane over your AI agents?
Prismor checks every tool call your agents make against your policy, blocks what breaks it, and keeps the audit trail. Run the open-source runtime yourself, or let us set it up across your org.
Or email [email protected]