Can the institution trust the engine?
The screen the reviewing lawyer never opens — and the one a Chief Risk Officer signs. Every number is derived from the same cases the queue routes, so governance and operations never disagree.
When the engine says 95%, observed accuracy must hold at 95%. Nothing auto-routes to the left of the gate — those cases are escalated to a human. That invariant is the SR 11-7 commitment.
Validation is not one-time. A share of auto-routed cases is pulled back for a lawyer to confirm — continuous evidence the gate is still calibrated in production.
- Quantum Cloud Services→ Junior pool98% · cleared
- Pinto Marketing Group→ Junior poolSampled · confirmed
- DataSpring Analytics→ Privacy Counsel96% · cleared
Every lawyer override becomes an institutional rule. As the bank's own precedent accrues, the engine defers to a human less often — a moat a generic model can't copy, because it's thisbank's judgment.
- JV NDAs with regional banks → Senior Corporate Counsel (not Junior pool, even at low standstill exposure)learned 6 weeks ago · now governs Westfield Bank
- Vendor MSAs touching customer PII → Privacy Counsel ahead of standard vendor reviewlearned 2 weeks ago · now governs DataSpring Analytics
Every decision carries its extracted signals, policy basis, calibration, and the reviewer's disposition. The model-risk pack bundles this into the evidence a CRO hands a regulator.