Discipline 01
Hash-chained audit
Every AI output is written to an append-only log with a
cryptographic hash that includes the previous log entry's
hash. Any tampering breaks the chain and is detectable.
The same primitive Keystone uses on verified-asset records.
Why it matters: when a regulator or
auditor asks how the AI reached a decision, the answer is
a query against an immutable log — not an investigation.
Discipline 02
Verified provenance
Every training input, every prompt context document, every
retrieval lookup carries a provenance record: source, entry
timestamp, authorization, license or consent. The
input-side counterpart to hash-chained audit.
Why it matters: when a regulator asks what
data the AI was trained on and where it came from, the
answer is a query, not a discovery process.
Discipline 03
Deterministic scoring where it fits
When the underlying calculation is definable — weighted
scores, rule-based classification, threshold lookups —
Applied AI uses a deterministic function even when a model
could produce a similar answer. Model uncertainty is
reserved for genuinely generative or subjective tasks.
Why it matters: deterministic scoring is
auditable, reproducible, and cheap. Using models where a
rule would do is the most common failure mode we correct.
Discipline 04
Licensed-partner posture
If an AI output would trigger a regulated action — a
credit decision, an insurance binding, a fund disbursement,
a medical recommendation — a licensed counterparty performs
the regulated action; the AI provides the analysis. Same
architecture Callisto Bridge uses for Keystone.
Why it matters: Callisto Bridge Applied AI
is not a regulated entity; our partners aren't asked to
become one. Regulated actions stay with licensed
counterparties.