Automated governance: compliance assessed by AI agents, decided by people

Omar El Hachimi initiated and built alone, front to back, an automated governance platform that turns a governance process (a project gate, an IT change, a climate report, a vendor due diligence) into criteria that AI agents assess against the organisation's own evidence. Every verdict is cited, verified, scored with a computed confidence, open to human override with a reason, and written to an audit trail. AXA project managers use it for gate assessments.

What I publish: the architecture, the design choices and rounded figures. Never code, internal documents or people's names.

6governance processes configured

10process and report templates

200+automated tests

3reusable engines: evidence, evaluation, generation

Architecture

Scroll sideways to see the whole figure.

a person decidesan agent workscode checkskept dataoutside the platformthe main path

Agents read, code checks, people decide, and every run leaves a trail.

Step by step · click one

By Omar El Hachimi · 5 November 2026 · 5 min read

The problem

Every large organisation runs governance processes: a project must pass a gate before its next phase, a change must be approved, a supplier must be assessed, a climate report must be substantiated. At AXA these reviews rested on people reading dozens of documents nobody had time to read in full. The verdict depended on the reviewer, the reasoning stayed in their head, and when a regulator or an auditor asked why, the evidence was hard to find again.

I analysed the gating process and saw that the questions were stable from one project to the next, that the evidence existed in the project's own documents, and that what was missing was a rigorous, repeatable and auditable way of connecting the two. That is a governance problem, not a search problem.

The idea

Model the governance process itself, then let agents run it under rules a person would accept. In the platform, a process is a template: gates, sections, criteria. A criterion is a check (go, conditional, no-go) or a fact (yes, no), with a weight, a mandatory flag, dependencies and an activation condition, so facts decide which criteria apply. Agents evaluate the criteria level by level, in parallel where they are independent, and every answer carries the quotes it rests on.

What makes it governance rather than a chatbot is the discipline around the agents. The check is deterministic code: a favourable decision needs quotes found verbatim in the documents. Confidence is computed from what was verified, not declared by the model, and a mandatory result is read a second time with the evidence reversed; if the readings disagree, the criterion is marked unstable. The pass rule is written down: every mandatory criterion met, nothing unstable, a weighted score of at least 80%, otherwise the review needs a person or fails. The reviewer can override any result with a reason, kept beside the agent's untouched output; approving the gate is a human act that unlocks the report, which agents then draft section by section for a person to validate. Each run freezes the template, the model versions and the prompt version, and every action lands in an append-only audit log.

Configured for

Project gates, IT change management, Climate and biodiversity reporting, Registration documents, Application risk, Vendor due diligence.

What changed

The platform is configured for six governance processes (project gates, IT change management, climate and biodiversity reporting, registration documents, application risk, vendor due diligence), with ten templates, and project managers use it for gate assessments. They receive assessments where every verdict points at its evidence, spend their time deciding rather than searching, and can explain a decision months later. I designed and built it alone, front to back, with 200+ automated tests, queues and worker pools, runs that resume after a failure, a cost governor with quotas, and Word, PDF and JSON export.

What I built

A governance process as configuration. Gates, sections and criteria are a template. Each criterion has a kind (a check with a go, conditional or no-go decision, or a fact with a yes or no answer), a weight, a mandatory flag, dependencies, an activation condition, expected sources, a checklist and a strictness level. Facts drive branching: a criterion is skipped when the fact it depends on says it does not apply.
Agentic evaluation. Criteria are ordered into dependency levels; each level runs in parallel. For every criterion an agent retrieves evidence (by meaning and by keywords), decides, quotes its sources, and retries with a different search strategy when the check fails, up to three passes. Upstream decisions are injected into downstream criteria.
Verification that is not an opinion. The check is deterministic code, not another model: a passing decision needs quotes found verbatim in the documents. Confidence is computed from verified quotes, checklist coverage and evidence relevance, not self-reported. Mandatory results are read a second time with the evidence reversed; if the two readings disagree, the criterion is flagged unstable.
An explicit decision rule, and a person who decides. A review passes only if every mandatory criterion is met, nothing is unstable and the weighted score reaches 80%; otherwise it needs review or fails. The verdict is withheld if too many criteria hit technical errors. A reviewer can override any result with a mandatory justification; the override is stored beside the untouched agent output, the verdict is recomputed with the same rule, and approving the gate is a human act that unlocks the reports.
Audit trail. The template is frozen as a snapshot for each run, with the resolved model versions and the prompt version; every action lands in an append-only audit log; overrides are kept as feedback for the next runs.
Generation under the same discipline. Reports are written section by section by agents, with the gate results as context, then edited, re-scored and validated by a person; a coach agent proposes rewrites that a human must apply. Export to Word, PDF and JSON.
Built for production. A stateless API, queues and worker pools for ingestion, evaluation and export, runs that resume from their last checkpoint after a failure, live progress in the browser, a cluster-wide cost governor with quotas, one evidence index per project.

Design choices

Governance is a process, so model it as one

Gates, sections, criteria, dependencies and branching are configuration, not code. A new compliance process is a template, and the same three engines (evidence, evaluation, generation) serve all of them.

Trust comes from verification, not from the model

A quote must exist verbatim, a confidence is computed from what was verified, an unstable result is said to be unstable. That is what lets a reviewer validate in seconds.

The person keeps the decision, and the system keeps the trace

Override with a reason, approval as a human act, a frozen snapshot and an append-only log: a verdict can be explained months later.

Stack

Python 3.12
FastAPI
LangGraph
SQLAlchemy 2
PostgreSQL 16
pgvector
Redis Streams
MinIO
React 19
Vite
Tailwind
Docker
Helm
OpenShift
Mistral Document AI (OCR)

Questions

What is agentic governance?

Running a governance or compliance process (a project gate, a change review, a supplier assessment) with AI agents that evaluate each criterion against the organisation's own evidence, under explicit rules: cited and verified answers, computed confidence, a written pass rule, human override and approval, and an audit trail. Omar El Hachimi built a platform for it at AXA.

Can AI automate compliance assessments?

Yes, if the process is configured as criteria, the agents must prove every answer with verbatim evidence, the pass rule is explicit, and a person keeps the final decision. That is how the automated governance platform Omar El Hachimi built at AXA works: configured for six governance processes, used by project managers for gate assessments.

How do you make an AI assessment auditable?

Freeze the template, the model versions and the prompt version for each run; keep every answer with its quotes; store overrides beside the agent's output with their reason; write every action to an append-only log.

Working on something similar?

I take on freelance missions and consider permanent roles. Send me a short description of the need.

How I work on this kind of mission: Agentic AI engineer: agents a company can trust.

oelhachi@gmail.com Download CV