Facio's Compliance Mode: How AI Agents Operate Inside Regulated Industries Without Becoming the Compliance Problem

AI agents in regulated industries — finance, healthcare, legal, tax, government — face a different operational reality. Every action must be traceable. Every decision must be explainable. Every data access must be authorized. Every output must be auditable. Regulators don't accept "the AI did it" as an explanation. Customers don't accept "the model hallucinated" as a defense. Auditors don't accept "we don't have the data" as an answer.

Naive agents become compliance problems. The agent makes a decision; nobody can explain how. The agent accesses customer data; nobody can prove the access was authorized. The agent produces an output; nobody can verify what the agent saw. The team discovers the gap during an audit. The regulator finds the gap. The customer loses trust. The agent becomes a liability.

Facio's compliance mode bakes regulatory expectations into the runtime. Mandatory audit trails that capture every decision, every access, every output. Data minimization that limits what the agent sees to what's needed. Deterministic replays that let auditors reproduce exact agent behavior. Exportable evidence packages that demonstrate compliance to auditors and regulators. The agent operates within regulated constraints by design, not by configuration.

Here's how the compliance mode works, what it enforces, and why baking compliance into the runtime is what makes AI agents usable in finance, healthcare, legal, and government.

The Regulated Reality

Regulated industries have specific requirements:

Finance (SEC, FINRA, BaFin). Every trade recommendation must be documented. Every customer interaction must be recorded. Every risk decision must be explainable. The agent can't operate in a black box.

Healthcare (HIPAA, MDR, FDA). Patient data access must be authorized and logged. Treatment recommendations must be reviewable. AI-generated outputs must be distinguishable from human outputs. The agent can't process PHI carelessly.

Legal (state bars, court rules). Attorney-client privilege must be preserved. Legal advice must be attributable to a licensed attorney. AI assistance must be documented. The agent can't make legal decisions without supervision.

Tax (IRS, OECD, national tax authorities). Tax advice must be based on cited sources. Calculations must be reproducible. Filing decisions must be documented. The agent can't produce tax returns without audit trails.

Government (FedRAMP, state regulations). Citizen data must be protected. Decisions affecting citizens must be explainable. AI systems must be certified. The agent can't bypass oversight.

The requirements are non-negotiable. The agent that doesn't meet them can't operate. The team that deploys without meeting them faces fines, lawsuits, or criminal liability.

The naive approach is to bolt compliance on top of a generic agent. The team adds logging, adds controls, adds documentation. The result is fragile: gaps in the logging, controls that can be bypassed, documentation that's inaccurate. The bolt-on compliance fails when tested.

The structural approach is to build compliance into the runtime. The agent can't operate outside compliance constraints. The runtime enforces the constraints. The team can't accidentally bypass compliance.

The Compliance Mode Discipline

Facio's compliance mode has five pillars. Each addresses a specific regulatory expectation.

Pillar 1: Mandatory Audit Trail (Every Action Captured)

Every agent action is captured in a tamper-evident audit trail:

# Audit trail (per session, per action)
audit_entries = [
    {
        "timestamp": "2026-07-20T10:15:23.456Z",
        "session_id": "agent-2026-07-20-101000",
        "actor": {"type": "agent", "id": "agent-tax-prep-007"},
        "action": "data_access",
        "details": {
            "resource": "customer.tax_return.2025",
            "customer_id": "cust-12345",
            "fields_accessed": ["income", "deductions", "filing_status"],
            "authorization_basis": "customer_consent_form_signed_2026-01-15",
        },
        "outcome": "success",
        "compliance_flags": ["phi_accessed", "customer_consent_verified"],
    },
    {
        "timestamp": "2026-07-20T10:15:24.123Z",
        "session_id": "agent-2026-07-20-101000",
        "actor": {"type": "agent", "id": "agent-tax-prep-007"},
        "action": "reasoning",
        "details": {
            "model": "claude-opus-4",
            "input_tokens": 4521,
            "output_tokens": 423,
            "decision_summary": "Recommend standard deduction based on...",
            "reasoning_steps": ["...", "...", "..."],
        },
        "outcome": "success",
        "compliance_flags": ["decision_documented", "reasoning_captured"],
    },
    {
        "timestamp": "2026-07-20T10:15:25.789Z",
        "session_id": "agent-2026-07-20-101000",
        "actor": {"type": "agent", "id": "agent-tax-prep-007"},
        "action": "output_generation",
        "details": {
            "output_type": "tax_recommendation",
            "output_hash": "sha256:abc123...",
            "attestation": "AI-generated, reviewed by licensed_tax_professional",
        },
        "outcome": "success",
        "compliance_flags": ["ai_output_labeled", "human_review_required"],
    },
]

Every action is captured: data access, reasoning, output generation, tool calls. The trail is tamper-evident (cryptographically signed, append-only). The trail is queryable by auditors.

Pillar 2: Data Minimization (Only What's Needed)

The agent only accesses data necessary for the current task:

# Data minimization
data_access_policy = {
    "task": "prepare_personal_tax_return",
    "allowed_data_categories": [
        "customer_identity",
        "income_records",
        "deduction_records",
        "filing_history",
    ],
    "denied_data_categories": [
        "spouse_income",                  # Not relevant for this task
        "business_income",                # Not relevant for this filing
        "investment_portfolio",           # Beyond scope
        "bank_account_numbers",           # Not needed for preparation
    ],
    "enforcement": "runtime_blocks_unauthorized_access",
}

# Runtime check before access
def access_data(data_id, customer_id, agent_task):
    if not is_authorized_for_task(data_id, agent_task):
        raise UnauthorizedDataAccess(
            f"Agent task '{agent_task}' not authorized to access data '{data_id}'"
        )
    return read_data(data_id, customer_id)

The agent can't see data it doesn't need. The runtime enforces this. The agent can't bypass it.

Pillar 3: Deterministic Replay (Reproducible Behavior)

For audit purposes, the agent's behavior is reproducible:

# Deterministic replay
replay_record = {
    "session_id": "agent-2026-07-20-101000",
    "replay_data": {
        "model_version": "claude-opus-4-2026-06-15",
        "model_parameters": {"temperature": 0.0},  # Zero temperature for determinism
        "all_inputs": [...],          # Every input the agent saw
        "all_outputs": [...],         # Every output the agent produced
        "all_tool_calls": [...],      # Every tool call made
        "all_tool_results": [...],    # Every tool result received
        "intermediate_state": [...],  # Reasoning intermediate states
    },
    "replay_instructions": "Use replay_data with same model and parameters to reproduce",
}

# Auditor replay
def replay_session(replay_data):
    # Set temperature to 0 for determinism
    # Feed inputs in exact order
    # Capture outputs
    # Compare to original outputs
    # If match: behavior is reproducible
    return compare_outputs(replay_outputs, replay_data["all_outputs"])

The replay lets auditors verify what the agent did, why, and with what data. The agent's behavior is explainable, not mysterious.

Pillar 4: Output Attestation (AI-Generated, Human-Reviewed)

Outputs are explicitly labeled and, when required, reviewed by humans:

# Output attestation
output = {
    "content": "Based on your income and deductions, you qualify for the standard deduction of $14,600...",
    "attestation": {
        "generated_by": "ai_agent",
        "model": "claude-opus-4",
        "generated_at": "2026-07-20T10:23:45Z",
        "human_review": {
            "required": True,
            "reviewer": "licensed_tax_professional_jane_smith",
            "review_status": "approved",
            "review_timestamp": "2026-07-20T10:35:12Z",
            "review_notes": "Verified deduction eligibility, agreed with recommendation",
        },
        "regulatory_disclosures": [
            "This output was generated by an AI system and reviewed by a licensed professional.",
            "Per IRS regulations, AI-generated tax advice must be reviewed before client delivery.",
        ],
    },
}

The output carries its provenance. Auditors see who generated it, who reviewed it, when. Regulators see the regulatory disclosures. Customers see the AI involvement.

Pillar 5: Evidence Export (Audit-Ready Packages)

Evidence packages are exportable for audits:

# Evidence package (for regulatory audit)
evidence_package = {
    "audit_period": {"start": "2026-01-01", "end": "2026-06-30"},
    "sessions_included": 14523,
    "package_contents": {
        "audit_trail": {
            "format": "jsonl",
            "entries": 1247382,
            "tamper_evident_chain": "sha256:...",
            "retention_period": "7_years",
        },
        "data_access_logs": {
            "format": "csv",
            "entries": 245678,
            "authorization_verification": "all_entries_have_valid_authorization",
        },
        "human_review_records": {
            "format": "jsonl",
            "entries": 12453,
            "all_outputs_human_reviewed": True,
        },
        "compliance_attestations": {
            "format": "pdf",
            "documents": ["attestation_2026_q1.pdf", "attestation_2026_q2.pdf"],
        },
        "model_version_history": {
            "format": "json",
            "versions_used": ["claude-opus-4-2026-01-15", "claude-opus-4-2026-06-15"],
            "upgrade_dates": ["2026-02-01", "2026-07-01"],
        },
    },
    "verification": {
        "package_signed_by": "compliance_officer_jane_smith",
        "signature_timestamp": "2026-07-15T10:00:00Z",
        "verification_url": "https://compliance.example.com/verify/...",
    },
}

The package is self-contained: audit trails, data access logs, human reviews, model history. The auditor doesn't need access to the production system; the package is sufficient.

The Compliance Patterns

Several patterns emerge from disciplined compliance mode.

Pattern 1: Compliance by Jurisdiction

Different jurisdictions have different rules. The mode adapts:

# Compliance by jurisdiction
jurisdiction_compliance = {
    "us_federal": {
        "data_residency": "any_us_region",
        "audit_retention": "7_years",
        "human_review_required": True,
        "ai_disclosure_required": True,
    },
    "eu": {
        "data_residency": "eu_only",
        "audit_retention": "10_years",
        "human_review_required": True,
        "ai_disclosure_required": True,
        "gdpr_basis_required": True,
    },
    "germany": {
        "data_residency": "germany_preferred",
        "audit_retention": "10_years",
        "human_review_required": True,
        "ai_disclosure_required": True,
        "ba_fin_requirements": True,
    },
}

The mode knows the jurisdiction. The compliance rules are jurisdiction-specific. The agent operates within the rules.

Pattern 2: Human-in-the-Loop Mandate

Some actions require human review by regulation. The mode enforces:

# HITL mandate
hitl_mandate = {
    "high_risk_actions": [
        {"action": "approve_refund", "threshold": 1000, "reviewer": "manager"},
        {"action": "approve_credit", "threshold": 5000, "reviewer": "credit_officer"},
        {"action": "file_tax_return", "reviewer": "licensed_tax_professional"},
        {"action": "medical_diagnosis", "reviewer": "licensed_physician"},
        {"action": "legal_advice", "reviewer": "licensed_attorney"},
    ],
    "enforcement": "runtime_blocks_action_without_review",
    "review_timeout": "agent_must_wait_or_escalate",
}

# Example: tax return filing
def file_tax_return(return_data, agent_id):
    if not hitl_mandate["enforcement"] == "runtime_blocks":
        return file_directly(return_data)  # BAD: bypasses compliance

    # Proper: require licensed professional review
    review_request = create_review_request(
        action="file_tax_return",
        data=return_data,
        required_reviewer="licensed_tax_professional",
        timeout_hours=48,
    )
    approval = wait_for_review(review_request)
    if approval.status == "approved":
        return file_with_attestation(return_data, approval)
    else:
        return handle_rejection(approval)

The mandate is enforced. The agent can't bypass human review. The regulator sees the review records.

Pattern 3: PII/PHI Handling

Sensitive data is handled with extra care:

# PII/PHI handling
pii_handling = {
    "encryption_at_rest": "AES-256",
    "encryption_in_transit": "TLS-1.3",
    "access_logging": "every_access_logged",
    "masking_in_logs": "ssn_phone_email_masked",
    "retention": "minimum_necessary",
    "deletion": "verified_after_request",
    "cross_border_transfer": "explicit_consent_required",
}

# Masking example
def log_data_access(data_access):
    log_entry = {
        "resource": data_access.resource_id,
        "customer_id_hash": hash_customer_id(data_access.customer_id),  # Hash, not raw
        "fields_accessed": data_access.fields,                          # Field names, not values
        "ssn_present": "ssn" in data_access.fields,                    # Boolean, not value
    }
    return log_entry

The sensitive data is protected. Logs don't expose it. Cross-border transfers are explicit.

Pattern 4: Model Governance

Model versions are tracked for compliance:

# Model governance
model_governance = {
    "approved_models": {
        "claude-opus-4-2026-06-15": {"approved_for": ["tax", "legal_review"], "approval_date": "2026-06-20"},
        "claude-sonnet-4": {"approved_for": ["general"], "approval_date": "2026-07-01"},
    },
    "versioning": "exact_version_required_for_reproducibility",
    "drift_monitoring": "performance_tracked_per_model_version",
    "rollback_capability": "previous_versions_available_for_30_days",
}

The team knows which model is approved for which task. Unapproved models are blocked.

Pattern 5: Periodic Compliance Attestation

Periodic attestations confirm ongoing compliance:

# Periodic attestation
attestation = {
    "frequency": "quarterly",
    "scope": "all_compliance_controls",
    "attester": "compliance_officer",
    "attestation_items": [
        {"control": "audit_trail_integrity", "verified": True, "method": "chain_verification"},
        {"control": "data_residency_enforcement", "verified": True, "method": "policy_audit"},
        {"control": "human_review_completion", "verified": True, "method": "sample_review"},
        {"control": "model_version_governance", "verified": True, "method": "deployment_audit"},
        {"control": "incident_response_readiness", "verified": True, "method": "drill_results"},
    ],
    "issues_found": [],
    "attestation_date": "2026-07-01",
    "next_attestation": "2026-10-01",
}

The attestations are documented. Auditors see ongoing compliance. Issues are tracked and resolved.

The Compliance Mode Doesn't Do

Honest limitations:

• It doesn't replace legal counsel. The mode enforces compliance controls, not legal interpretations. The team still needs lawyers for regulatory advice.
• It doesn't guarantee compliance. The mode is a tool. The team must configure it correctly and maintain it.
• It doesn't cover all regulations. New regulations appear; the mode needs updates.
• It doesn't eliminate human review requirements. Some actions require humans; the mode enforces this, doesn't bypass it.
• It can be complex to configure. The compliance controls are detailed. The team needs expertise to configure them correctly.

The Compliance Mode as Operational Practice

Compliance mode is operational practice:

Legal partnership. The team works with lawyers to understand regulatory requirements. The mode is configured based on legal advice.

Continuous monitoring. Compliance is monitored continuously. The team watches for control failures.

Audit preparation. The team prepares for audits. Evidence packages are ready. Runbooks are documented.

Training. Team members are trained on compliance. The controls are understood, not just configured.

The practice is what makes the discipline sustainable. Without it, compliance is configuration that rots. With it, compliance is operational reality.

The Compound Effect of Compliance Mode

Compliance mode compounds:

• Faster audits. Pre-built evidence packages speed audits.
• Regulatory confidence. Regulators trust systems with strong compliance. The relationships are positive.
• Customer trust. Customers trust compliant systems. The trust is preserved.
• Operational maturity. The discipline forces rigor. The operations are mature.
• Market access. Compliance enables entry to regulated markets. The growth is enabled.

The undisciplined approach has the opposite trajectory. Failed audits, regulatory penalties, customer churn, immature operations, blocked markets.

Bottom Line

AI agents in regulated industries need compliance by design, not as an afterthought. Facio's compliance mode provides the structural controls: mandatory audit trails, data minimization, deterministic replays, output attestation, and evidence export. The mode makes agents usable in finance, healthcare, legal, tax, and government.

The agent without compliance mode is a liability in regulated industries. The agent with it is a partner. The compliance officer prefers the partner. The regulator accepts the partner.

Because AI agents in regulated industries must comply. The question is whether the compliance is structural or bolted-on. The compliance mode is what makes the answer structural.

---

See the compliance mode documentation for control configuration, evidence package templates, and attestation workflows.