DRAWING NO. BLK-2026-MRM.4 // FIG 3.0 : STATUTORY & SUPERVISORY CONTROL MATRIX
DOSSIER: FCA SYSC 13.7 · PRA SS1/23 · EU AI ACT · HIPAA
Model Risk Management (MRM) & Application Security Dossier
Deterministic Technical Controls for Regulated Enterprise AI
Model Risk Management committees, Chief Compliance Officers, Data Protection Officers, and CISOs cannot approve production customer workflows based on probabilistic "97% empirical eval pass rates". This portal maps each regulatory obligation directly to a deterministic, machine-verifiable technical mechanism in the Blockstate compiler and runtime.
United Kingdom Financial Services Governance
UK FCA SYSC 13.7, Consumer Duty (PS22/9) & PRA SS1/23 Mapping
How Blockstate satisfies operational risk controls, foreseeable harm prevention, and quantitative Model Risk Management principles for UK retail banks, mortgage lenders, wealth managers, and insurers.
| Regulatory Standard & Clause | Statutory / Supervisory Requirement | Probabilistic Agent Failure Mode | Blockstate Technical Control & Error Code |
|---|---|---|---|
| FCA Handbook SYSC 13.7.1G / 13.7.7G Operational Risk: IT Systems & Process Control |
Firms must establish systems and controls that prevent unauthorised transactions and process execution failures across automated channels. | Prompt injection or hallucination invokes execute_fps_rail or authorise_bacs_payout prior to step-up authentication. |
1. Compile-Time Dominator Proof (blockstate verify, BLK-AST-002): Lengauer-Tarjan solver proves step_up_mfa_kyc dom faster_payments_uk.2. Runtime ToolGatekeeper (BLK-SEC-001): Payment tools are physically absent from types.MappingProxyType until the payout stage is entered.
|
| FCA Consumer Duty (PS22/9 / PRIN 2A) Preventing Foreseeable Harm & Mandatory Disclosures |
Firms must ensure customers receive accurate, timely fee and eligibility disclosures and avoid foreseeable harm from misrouted claims or misquoted terms. | Free-form LLM generation paraphrases or omits mandatory fee disclosures, or routes commercial haulage policies down retail fast-track paths. |
1. Zero-LLM ChoicePayload & Canned Templates: Mandatory regulatory disclosures render deterministically in under 15ms.2. Immediate Breach Exit ( BLK-VAL-003): Raising DisqualifyingBreachError inside @field_validator halts collection and transitions deterministically to on_breach.
|
| Bank of England / PRA SS1/23 Model Risk Management Principles 3 & 4 (Verification & Mitigants) |
Requires independent verification of model boundaries, documented deterministic constraints over model outputs, and strict change-control validation before deployment. | Dynamic Python reflection (getattr) prevents static verification of reachable graph states; model outputs directly drive control flow. |
1. Static DCG AST Compiler (BLK-AST-014 / [Blockstate E014]): Parses source via ast.parse without bytecode execution and rejects dynamic transitions.2. Signed Topology Export ( blockstate export --format json): Produces deterministic CFG diffs for MRM change-control sign-off.
|
European Union High-Risk AI Systems Regulation (Regulation (EU) 2024/1689)
EU AI Act Clause-by-Clause Mapping (Articles 9, 12, 14 & 15)
High-risk AI systems deployed in creditworthiness evaluation, life and health insurance risk assessment, and emergency healthcare triage require verifiable risk management, automatic record-keeping, human oversight boundaries, and cybersecurity resilience.
| EU AI Act Article | Statutory Requirement | Blockstate Enclave Implementation | Verification Command / Artefact |
|---|---|---|---|
| Article 9 Risk Management System |
Identification, estimation, and elimination or mitigation of known and foreseeable risks through technical design controls. |
Compile-time Lengauer-Tarjan dominator verification proves that risk-mitigating precursor stages strictly dominate high-consequence target stages across all primary and fallback edges (on_refusal, on_max_turns_exceeded, on_breach).
|
blockstate verify [PATH] --dominates "u -> [v]" |
| Article 12 Record-Keeping (Automatic Logging) |
Automatic recording of events (logs) over the lifetime of the system to ensure traceability of operation and post-hoc auditability. |
Every turn emits a 12-field TurnLedgerRecord serialised via RFC 8785 JSON Canonicalisation Scheme (JCS) UTF-8 and chained with SHA-256 from a 64-zero genesis hash, backed by SessionPartitionedRingBuffer and os.fsync WAL spill (.blockstate/wal/ledger.wal).
|
blockstate trace --session <UUID> |
| Article 14 Human Oversight |
Technical measures ensuring natural persons can oversee operation, intervene, or halt the system safely at defined boundaries. |
Deterministic circuit breakers (max_turns routing to on_max_turns_exceeded="human_specialist", on_refusal, and BlockstateTurnAborted) guarantee automatic escalation to a human operator when validation or security thresholds are tripped.
|
@Stage(max_turns=N, on_max_turns_exceeded=...) |
| Article 15 Accuracy, Resilience & Cybersecurity |
Resilience against attempts by unauthorised third parties to alter system use, outputs, or performance via adversarial exploitation (such as prompt injection). |
ToolGatekeeper enforces hardware-memory isolation via types.MappingProxyType (BLK-SEC-001); SessionState locks validated dot-separated leaf paths against overwrite (BLK-SEC-002); TaskStack bounds recursion depth (BLK-SEC-003).
|
pytest -m patent_invariant & Contract Suites |
Data Protection, Clinical Privacy & Cryptographic Redaction
HIPAA Safe Harbor (45 CFR § 164.514) & UK/EU GDPR (Articles 25 & 32)
Preventing raw Personal Identifiable Information (PII) and Protected Health Information (PHI) from leaking into external LLM API prompts, OpenTelemetry spans, or application crash logs.
| Privacy Regulation | Core Mandate | Blockstate Cryptographic Control (PIIVault & Detokenise[T]) |
|---|---|---|
| HIPAA Safe Harbor (45 CFR § 164.514(b)(2)) | De-identification of Protected Health Information (including health plan beneficiary numbers, account numbers, geographic subdivisions, and contact identifiers) before transmission to non-BAA processors. |
Deterministic ingress scanning with NHS Modulus-11 check-digit verification, Luhn modulo-10 payment card verification, UK National Insurance number patterns, and postcode/phone/email detectors. Replaces plaintext with <VAULT:CATEGORY_NN> before any model call.
|
| UK/EU GDPR Article 25 Data Protection by Design and by Default |
Pseudonymisation and data minimisation ensuring personal data is not made accessible beyond the minimum scope necessary for each specific processing step. |
Keyed HMAC-SHA256 session deduplication maps identical entities to stable session tokens. Tools receive opaque tokens by default; plaintext is unwrapped in volatile RAM exclusively for parameters explicitly typed as Detokenise[T], and tool return values are immediately re-sanitised.
|
| UK/EU GDPR Article 32 Security of Processing & Encryption |
Encryption of personal data at rest and authenticated integrity protection against cross-session tampering or replay. |
The session token map is encrypted using AES-256-GCM with a 96-bit (12-byte) random nonce and Associated Authenticated Data (AAD) cryptographically bound to session_id:schema_version:revision_id. Volatile validator detokenisation (wrap_detokenising_validator) scrubs PII from any validation error string.
|
Application Security Threat Model
OWASP Top 10 for LLM Applications (2025) Mitigation Matrix
| OWASP LLM Risk ID | Threat Vector | Blockstate Enclave Mitigation |
|---|---|---|
| LLM01:2025 Prompt Injection |
Adversarial user input attempts to override system instructions to force state transitions or execute privileged tools. |
Inversion of Control: The LLM has zero authority over state transitions. Transitions are executed by compiled Python stage methods after deterministic Pydantic v2 validation and @Guard evaluation. Unwhitelisted tool calls raise SecurityViolationError (BLK-SEC-001).
|
| LLM02:2025 Sensitive Information Disclosure |
PII/PHI is sent to external LLM APIs, echoed into error traces, or persisted in plaintext telemetry logs. |
Ingress PIIVault & Exception Scrubbing: All utterances are tokenised to <VAULT:CATEGORY_NN> at ingress. Validator exceptions are scrubbed of plaintext values, and all secrets in BlockstateSettings use pydantic.SecretStr.
|
| LLM06:2025 Excessive Agency |
Agent is granted broad permissions or a global tool catalogue that exceeds the minimum privilege needed for the current conversational step. |
Per-Stage MappingProxyType Gatekeeper: Each @Stage constructs an ephemeral read-only types.MappingProxyType containing only stage_def.tools, paired with a deep-frozen ReadOnlySessionView.
|
| LLM07:2025 System Prompt Leakage |
Attacker extracts internal routing rules, security heuristics, or business thresholds embedded inside a monolithic system prompt. |
Compiled Python Business Logic: Guard thresholds (such as slots.estimated_damage_gbp <= 250.0), tool whitelists, and transition rules live in compiled Python AST code rather than inside extractable system prompt prose.
|
Reproducible Audit Evidence
Sample CI Dominator Proof & Cryptographic TurnLedger Trace
Every pull request and production session produces deterministic, machine-verifiable evidence that MRM auditors and SRE teams can inspect directly from the command line.
1. CI Gate Output: blockstate check && blockstate verify
EXIT CODE 0
$ blockstate check wire_agent.py
✔ [AST-OK] RetailWireTransferAgent: 6 stages, 6 edges, 0 unreachable nodes (compiled in 7.1ms)
✔ [DCG-OK] Zero dynamic getattr() reflection; zero transitions in @field_validator
$ blockstate verify wire_agent.py \
--dominates "step_up_mfa_kyc -> [faster_payments_uk, sepa_euro_transfer, swift_international]"
✔ [DOMINANCE PROVEN] 'step_up_mfa_kyc' strictly dominates:
- faster_payments_uk (idom: step_up_mfa_kyc)
- sepa_euro_transfer (idom: step_up_mfa_kyc)
- swift_international (idom: step_up_mfa_kyc)
✔ Audit Certificate emitted: .blockstate/certificates/wire_agent.dom.json
2. Session Replay: blockstate trace --session <UUID>
SHA-256 INTACT
$ blockstate trace --session 0192ce18-7b40-7000-8000-4a91f0012c9a
┌──────┬──────────────────────────┬───────────────────────┬──────────────┐
│ Turn │ Transition & Vault │ Stage Tool Whitelist │ JCS SHA-256 │
├──────┼──────────────────────────┼───────────────────────┼──────────────┤
│ 1 │ [START] -> intake_claim │ [] (Zero Tools) │ 8f9c2b..e401 │
│ │ <VAULT:POSTCODE_01> │ │ prev:0000000 │
├──────┼──────────────────────────┼───────────────────────┼──────────────┤
│ 2 │ PUSH ncd_faq -> POP │ [query_policy_rag] │ 4e71d0..77c4 │
│ │ Parent 4 slots locked │ (Payout tools absent) │ prev:8f9c2b1 │
├──────┼──────────────────────────┼───────────────────────┼──────────────┤
│ 3 │ -> tier_auto_payout │ [authorise_bacs] │ c39a81..91d0 │
│ │ Guard £180<=£250 (TX992) │ Detokenise[T] │ prev:4e71d09 │
└──────┴──────────────────────────┴───────────────────────┴──────────────┘
✔ Hash Chain Verified (3/3 records intact, 0 raw PII tokens leaked)