Examiner Center
For the compliance stakeholder: the frameworks Runline is built to satisfy, who owns what, what the examiner sees, and how the kill-switch works.
Runline is built for the exam. Human oversight is enforced by the architecture, not by policy: the system cannot file a SAR, post a journal entry, or take any consequential action without a human approval on the record. This page is for the person who has to answer to an examiner.
The frameworks we are built to satisfy
We do not claim endorsements or seals. We name the specific rule, and the architectural control that answers it.
| Framework | What it asks for | How the architecture answers it |
|---|---|---|
| NCUA Part 748 | A security program and board oversight of third-party and AI risk | Every agent action flows through the Grid, keyed, gated, and logged. Oversight is a control, not a memo. |
| FFIEC | The IT and cybersecurity controls examiners run against | Scoped identity, least-privilege keys, tenant isolation, and append-only audit map to the IT handbook. |
| BSA / AML | A SAR/CTR program with a clear audit trail | No SAR is filed without a human approval. The disposition, the reasoning, and the decision are all on the record. |
| FinCEN | The reporting authority behind the BSA | Filings and their approvals are captured as durable, timestamped Decisions. |
| OFAC | Sanctions screening | Screening runs as a governed step. Every check and its outcome is logged. |
| GLBA Safeguards | Protection of member data | Member data is hashed in audit logs. No persistent member data sits in model context. |
| FCRA | Fair handling of credit data | Credit-data access is scoped, logged, and gated like every other consequential action. |
| SOC 2 | Independent assurance of security controls | The control plane is built to the Trust Services criteria, audit-ready by construction. |
Who owns what
Governance is a shared responsibility, and the split is deliberate.
| Runline owns | The credit union owns |
|---|---|
| The control plane, the audit trail, and the retention | Judgment, exceptions, and the final sign-off |
| Scoped keys and tenant isolation | Who gets which access, and the policy on each gate |
| The execution: Runners moving Items through Workstreams | The kill-switch, and the decision to use it |
| Keeping the record examiner-ready | The relationship with the examiner and the member |
The system holds the context and does the toil. Your people hold the judgment and the calls. Neither side can quietly become the other.
What the examiner sees
Every agent action is one append-only, hashed entry: attempted, approved, or blocked, timestamped, with the actor, the key, and the gate decision. Member data is hashed. Retention is five years, exportable on demand.
2026-09-15T14:02:11Z runner=bsa-runner action=sar.draft item=ALERT-4471
key=vendor:model / agent:bsa-runner gate=ask decision=approved
approver=analyst.02 member=sha256:9f2a... hash=b7c1...The record your operators work from and the record your examiner reads are the same record.
The kill-switch drill
Control is not a promise. It is a button in your hands.
- Open the Tower, or the Grid dashboard. The kill-switch is on your surface, not ours.
- Choose the scope: a single agent, a single vendor key, or a whole connection.
- Confirm behind 2FA. The disable takes effect in under 100 milliseconds.
- The key or agent is disabled, not deleted. It stays on the record for forensics, and nothing it attempts after that point gets through.
No call to Runline. No waiting. The authority is yours to exercise.
The story, by who is asking
- BSA Officer / CCO: every AI action is logged immutably with timestamp, actor, and context. Your team reviews everything before it is filed, and the kill-switch is on your dashboard, not ours.
- CTO / CISO: each credit union's data lives in a dedicated instance. No shared infrastructure, no cross-tenant queries. Keys are unique per vendor and per agent, and all traffic flows through the Grid.
- CEO / Board: built for NCUA examination from day one. Human oversight is enforced by architecture, not policy, and you can shut down any AI agent in under 100 milliseconds.
Learn more
- Governance-First: gated autonomy and the NCUA requirements table
- Security · The Grid: the control plane in depth
- Who We Serve: where the liability sits