Server-enforced segregation of duties
for AI agents that act on systems of record.

The question is not “is it logged” but “is it defensible to the auditor who walks in tomorrow.”

A Compliance Lead evaluating AI agent platforms is not asking about prompt quality or model size. The question is whether the platform can produce the technical evidence — within 60 minutes — that proves the control objectives your framework already names (SOX 404 for public; the equivalent for private; statutory audits for regulated industries; EU AI Act Article 9 risk management).

• Can the initiator of an action also approve it?Syntheka enforces segregation of duties server-side in the approval DAG. The initiator cannot self-approve, and the system refuses to record an approval when the actor and the requester resolve to the same identity — regardless of role, token, or any override path.
• Is the audit trail immutable?Syntheka stores every state change in an append-only log with bi-temporal timestamps (transaction time + valid time) and a hash chain that flags any retroactive edit, including administrator edits. Replayable for the retention period.
• How do you prove the action actually happened in the system of record?Three-way reconciliation: platform intent, system-of-record state, and field evidence must agree before status flips to executed. Discrepancies become tracked exceptions — never silent drift.
• Multi-entity / multi-ledger awareness.Entity, company, and ledger are first-class fields on every action. An action against Entity A cannot accidentally write to Entity B's books; cross-entity writes require explicit operator override, the default is refuse.
• Reversible under retention.Every action has a reversal. Reversal is a compensating entry that re-enters the approval DAG, with its own hash chain. Original action state is changed; original audit record is preserved.

Six states, seven transitions, one rule.

Syntheka's approval DAG has six states (Draft, Staged, Approved, Rejected, Executed, Reversed) and seven possible transitions. One rule runs through all of them: any single actor cannot occupy both the initiator and approver roles for the same action.

Honest boundaries for the compliance conversation.

If any of these are required for your evaluation, Syntheka is not the right vendor today. We will tell you, and refer you elsewhere if we can.

• Syntheka is not a control framework.We provide the technical evidence; you design the control objectives. The mapping (EU AI Act Article 9 risk management, SOX 404 segregation of duties, HIPAA technical safeguards, ISO 27001 control objectives) is your work, supported by our documentation.
• Syntheka is not a certification body.SOC 2 Type II, ISO 27001, FedRAMP, IL5 — these are certifications we have not yet obtained. We are explicit about timelines. When needed, we refer customers to notified bodies and certification auditors.
• Syntheka does not issue EU AI Act conformity attestations.We support your compliance preparation. The conformity assessment is the role of the notified body or your self-assessment, on top of our technical evidence.
• Syntheka does not replace your internal audit.We provide the technical evidence; you judge what it means in your control objective context. The auditor remains independent of the platform.

Twelve questions to ask of any AI agent vendor.

Use these against any vendor, including us. If a vendor cannot answer them clearly, treat that as the answer.

1. Is segregation of duties enforced in code, or is it a recommendation in documentation?
2. Can the initiator of an action also approve it through any sequence of role changes, token rotations, or override paths?
3. Is the audit log append-only and hash-chained? Can you verify on demand that the hash chain has not been broken?
4. Do you record bi-temporal timestamps (transaction time + valid time), or only one of them?
5. How do you reconcile platform intent against system-of-record state after the write — and are discrepancies surfaced as tracked exceptions?
6. For reversals, is the reversal a deletion or a compensating entry — and is the reversal itself auditable through the same chain?
7. What is the multi-entity / multi-ledger behavior — can one action accidentally touch two entities without an explicit override?
8. Are audit records exportable as structured JSON for our audit analytics tooling (SIEM, GRC, internal audit dashboards)?
9. Can you demonstrate a single concrete action end-to-end, with technical evidence, on a real system of record, in 60 minutes?
10. What is your upgrade cadence, and do security patches enter via the same chain that agent actions do — so the upgrade itself is auditable?
11. For our retention period (typically 7 years for SOX, longer for regulated industries), can the audit trail be replayed end-to-end?
12. If we end the engagement, what is the exit path — full audit trail export, hash chain continuation or verifiable bridge, credential revocation?

Three numbers that matter.

Syntheka's pricing is published, not quoted. There are no per-action variable surprises because there are no per-action variables in the price.

A fixed-fee pilot is $1,500 for one site, 60 days, up to two workflows. The pilot pricing is honored for the first three customers.

The pilot ends with a measured evidence pack: hash chain validation report, SoD verification record, three-way reconciliation pass rate, bi-temporal export — the artifacts you can take to internal audit or to the notified body.

The Compliance Lead path through the pilot.

Most Compliance Leads we work with run a 60-day pilot in parallel with their existing process — not a replacement. The pilot ends with a measurable evidence pack, not a swap.

1. Week 1: Define the action in scope (a payment run, a vendor master change, a refund queue). Identify the internal audit sponsor and the control objectives the pilot must evidence.
2. Weeks 2-3: Syntheka composes the agent from the industry template plus your artifacts. No data leaves your environment. The approval DAG is configured with the rule set your control objectives require.
3. Weeks 4-6: Run the pilot in shadow mode with the internal audit observer present. Every Syntheka-proposed action is compared against the existing process, side by side. Exceptions are tracked.
4. Weeks 7-8: Report. The pilot produces the evidence pack: hash chain validation, SoD verification, three-way reconciliation pass rate, bi-temporal export. The decision to adopt, extend, or end is yours, with the technical evidence.