Bounded AI Judgment Is the Compliant Workflow Pattern

The core claim. Perpetual CTO Karthic Rao argues that agentic AI fails in regulated industries because too much judgment sits in control flow. His team builds wealth-management workflows where deterministic machinery runs the process, records evidence, and executes side effects, while small classified model calls only interpret and judge at isolated decision points. The W-9 example grounds it: one adviser sentence becomes days of ambiguity resolution, missing data, follow-ups, e-signature, and audit.

The architecture. The engine separates planning from execution. A planner model call only translates a request into a semantic graph grounded in the original words. A compiler with no model call runs 11 deterministic phases to produce an immutable, hash-pinned plan with three verdicts: valid, needs clarification, rejected. It checks every action against a rulebook of 42 procedural nodes and around 40 safe-failure modes. The model cannot request anything the company cannot already do safely.

Human gates. Execution is gated everywhere. A person approves the plan first; each external side effect, an email or a signature request, has its own approval gate bound to a data fingerprint verified at send time. In the demo, the system waits 72 hours by default, then a deterministic rule decides the next step. A partial client response is marked provisional until a human confirms it, then follow-up runs as a new subplan. Approved plans never mutate; the cap is five rounds.

The cost tradeoff. Rao rejects the default of better models plus more agency. Around 95% of model decisions here are small classified evaluations like response completeness, document matching, or field extraction, handled by flash-class models. In a 20-decision demo run, 19 went to flash and one to a frontier model. Because every call is schema-checked, moving inference to a privately hosted model is a configuration change, not a rewrite. That is how firms with sensitive data keep inference private.

The open loop. The most interesting claim is also the least proven. Every provisional evaluation is confirmed or rejected by a person, and every frontier decision produces labeled training data for a future flash-class model. Rao frames the frontier share as shrinking release over release, but offers no production benchmarks, cost data, or evidence beyond a single demo. The architecture is credible; the efficiency curve is an aspiration.

What teams should take. For engineering leaders, the lesson is not whether to adopt agents but where to draw the boundary. Put control flow, evidence, and side effects in deterministic state machines. Keep model calls small, classified, and gated. Then measure which decisions actually need a frontier model and route the rest to the cheapest controlled inference you can operate.