No model can audit itself: the idea behind The Arbiter
Everything we build rests on one idea. When an AI makes a decision that matters, its own account of that decision is not enough reason to trust it. Something independent has to check it, before it takes effect.
This post introduces that idea and the family of applications built on it. It is the first in a series. Later posts go deeper, starting with banking.
Where it started
It started with patent drafts. I used AI models to review my own applications and found that one model would pass work that another model tore apart. The first model never saw what it had missed. Asking it again didn't help: it defended its first answer, or gave a different one with the same confidence. What worked was putting the same document in front of multiple independent models and looking at where they disagreed. The disagreements pointed straight at the problems.
The idea
The Arbiter is the architecture behind everything we build. It rests on five principles.
Independence, not headcount. The checking models come from different providers, are kept apart from one another, and work from the record itself rather than from what the deciding AI chose to show them. Multiple copies of one model are one opinion said more than once.
The divergence is the output. We don't blend the models into a single score. Where they agree, a decision stands on more than one model's word. Where they split, the split shows a person exactly where to look.
Unanimous, or it stops. A decision goes forward only when every independent model agrees. Anything else goes to a named person, who decides and records why.
The evidence stays with the customer. Where we deploy into a customer's environment, every check leaves a sealed, signed record the customer holds, and an auditor can verify it without us.
Every check leaves a receipt. A decision that has been checked carries a Verification Receipt Token: a signed record of what was checked, by which independent models, what each of them concluded, and when. Anything downstream can confirm the check happened and what it found, without rerunning it and without asking us. A decision with no receipt is a decision nothing checked.
The family
The same architecture applies wherever an AI decision has consequences. Each application fits it to one kind of decision.
The Arbiter Financial (TAF). Checks an AI compliance agent's decision on a money-laundering alert before the case is closed. It runs inside the bank's own environment. This is our current focus.
Commands (Arbiter-as-a-Service). A gate in front of the commands an AI agent issues, such as a payment, a file deletion or a message sent outside the company. It checks whether the command should run, before it runs.
Clinical analysis (AIX). The same checking applied to AI analysis of clinical scans.
Subject confirmation (SCS). Before an action is taken on a person or an account, confirms it is bound to the right one. It never releases silently: if confirmation fails, the action stops and someone is told.
Documents. Where it began: independent review of complex documents, such as patent applications.
A short primer, if banking isn't your world
Banks are required by law to watch for money laundering. Monitoring systems flag transactions that look unusual, and each flag is called an alert. Someone then investigates: pulls the customer's file, looks at the history, and decides. Most alerts have an innocent explanation and are closed. Where the activity really does look suspicious, the bank files a report with the government, called a Suspicious Activity Report, or SAR.
The volume is enormous, and the great majority of alerts close with no report. So banks have always looked for ways to work the queue faster, and AI agents are now doing that work: reading the case, weighing it, writing the rationale and closing the alert.
The stakes run both ways. Closing an alert that should have been reported means criminal money moves on unnoticed, and banks have paid billions in penalties for failures of this kind. Reporting everything to be safe buries investigators and law enforcement in noise.
Why banking first
The consequences of an AI decision are clearest here, and so is the accountability: when an AI agent closes an alert, a named officer still answers for it. Regulators have just left agentic AI outside their new model risk guidance, which leaves each bank to decide for itself what good control looks like.
The next two posts in this series cover what that guidance left out, and how a bank can test independent checking on alerts it has already closed, with no production risk.
Questions, pilots or partnerships: robert@divergenceip.com