01
Spec
Every feature starts as a specification with acceptance criteria, each traced to an APRA control.
For teams shipping AI into regulated environments · Working toolkit · Book a walkthrough
AI-built software
your auditor can examine.
AssureNexus is the governed AI-SDLC framework and toolkit every Vanexus platform is built with: controls mapped to APRA CPS 230 and CPS 234 that make AI-authored software reviewable, auditable and provably intact.
The problem
AI writes code faster than your governance can watch it.
Agents author real changes in real repositories now. The question your risk function will ask, and your regulator after them, is simple: who reviewed it, what evidence exists, and how do you know the record is intact? Shipping AI-authored software into a regulated environment without answers is a finding waiting to be written. We built AssureNexus because we needed those answers ourselves.
The lifecycle every change follows
One run. Every step on the record.
No AI-authored change reaches main without passing through the same gated flow, and the flow itself produces the evidence.
02
Plan and tasks
The spec decomposes into a reviewed plan and discrete tasks before any code is written.
03
Test-first implementation
Each acceptance criterion is paired with a named test. The test exists before the feature does.
04
Self-evidencing PR
Test results, scan proofs and an auto-captured screenshot of the feature working are posted into the pull request.
05
Human approval
The agent cannot merge or push to main. Hooks enforce branch, PR, then a named human approval.
What you get
Built for the people who carry the risk.
Criteria traced to controls
Every acceptance criterion maps to an APRA CPS 230/234 control and a named test, so coverage is a lookup, not an assertion.
Reviewers see code and evidence together
Self-evidencing PRs put test results, secret-scan proofs and a screenshot of the working feature in one place, where the approval happens.
Telemetry measured, not asserted
Cycle time and control-evidence completeness are computed from the repository itself, so delivery claims are checkable.
Governed by construction
The controls are the architecture.
Four controls hold the frame. Each is deterministic, testable and demonstrable offline.
PR-only guardrails
The agent cannot merge or push to main. Branch, pull request, human approval: hooks enforce the sequence, not habit.
Secret-scan gate with a canary
CI fails on any leaked credential, and a detection canary proves on every run that the scanner can still catch one. A green build means the control is alive, not just installed.
Tamper-evident by construction
Every agent decision is SHA-256 hash-chained to its predecessor. Alter, insert, delete, reorder or truncate the record and verification breaks.
Fail-safe oversight tiering
Every change is classified across four risk dimensions and assigned an oversight tier. Unmapped paths and uncertain changes escalate. Unknown never means safe.
The toolkit
Four modules. One frame.
Governed AI-SDLC
The delivery lifecycle, gated and evidenced.
- Spec, plan, tasks, then test-first implementation for every feature
- Each acceptance criterion traced to an APRA control and a named test
- PR-only guardrails: the agent cannot merge or push to main
- Self-evidencing PRs: tests, scan proofs and screenshots in the review
- SDLC telemetry measured from the repo, not asserted
Tamper-Evident AI Audit Chain
Every agent decision, provably intact.
- SHA-256 hash-chained records with an independent head anchor
- Alteration, insertion, deletion, reorder and truncation all detectable
- Same algorithm in-memory and on DynamoDB, concurrency-safe on both
- ai_authored, agent_identity and model_id hashed into every record
- Offline-verifiable: the integrity suite runs with no cloud, no API key
Risk-Tiered Oversight Classifier
The right human attention for every change.
- Deterministic classification across four risk dimensions
- Assigns the oversight tier: auto, human review, or HITL with independent review
- Fail-safe by construction: unmapped paths escalate
- Uncertain changes go up, never through
AI Output Evaluation Harness
Offline evals that red-team their own scorers.
- Golden datasets held as reviewable data, not buried in test code
- Deterministic scorers that reuse the production guardrails
- Reports headlined by the safety-critical false-negative rate
- Adversarial behavioural cases that red-team the scorer itself
- Sampled runs that quantify output flakiness
Selling into banks or insurers yourself?
These are the controls your FS customers’ due-diligence teams ask about. Our vendor-readiness work helps you evidence yours.
AssureNexus
See the audit chain break a tampered record.
Thirty minutes, live: a governed change flowing spec to approved PR, and what happens when someone edits history.