Nobody has to take the bank's word for it.
A record of what your AI agents did, and who allowed it.
AI agents approve, transfer, decide and hand work to other agents, thousands of times a day. Your systems record all of it, but that record is written by the system being examined. DOVU keeps a separate record of what each agent was allowed to do and what it did, somewhere neither party controls.
Built for banks, and for the firms that build agents for them.
Why now
Agents broke the audit model.
The audit model banks run on was built for people. One person, one decision, reviewed afterwards by another person. AI agents break every assumption in it.
- Volume
A human approver makes a handful of decisions a day. An agent makes thousands an hour. Nobody reviews them afterwards.
- Delegation
Agents call other agents, which call tools, which move money. Authority passes down a chain nobody drew in advance.
- Non-determinism
The same input can produce a different action. An agent’s behaviour cannot be replayed from its settings, so "the system was configured correctly" stops being a defence.
- Revocation timing
You disable an agent at 14:02. Did it act at 14:01? Your own system says no. That is the one account an examiner will not accept.
- More than one owner
The bank’s agent talks to a vendor’s agent, which calls a third-party service. Three accounts, three owners, no shared version of events.
The problem
A self-attested record is one your system writes about itself.
When an examiner asks what an agent did and whether it was allowed to, the bank hands over a file its own software wrote. The vendor hands over another. Neither can be checked by anyone outside.
DOVU writes the same facts somewhere neither the bank, nor the vendor, nor DOVU can edit. The examiner reads the record without asking any of them.
What you get
A record nobody can edit. Not you, not your vendor, not DOVU.
- Authority Trail
The permission behind each agent: who granted it, the limit, any delegation to another agent, and the second it was revoked. Revoking a permission never rewrites what the agent was allowed to do before.
- Flow
The process the agent was following: the steps, the human review, and the record of each step as it happened. Flow checks Authority Trail before every step.
What regulators ask for
Regulators are asking for records of what agents did.
All of these rules ask for the same thing: a record of what an AI system did, kept where an examiner can rely on it. That is the record DOVU keeps.
- EUEU AI Act
-
Article 12 requires high-risk AI systems to record events automatically for their whole lifetime. Article 26 requires the bank deploying them to keep those records for at least six months. Credit scoring of people is high-risk. These duties apply from 2 December 2027, after the Digital Omnibus on AI moved the date in July 2026.
- EUDORA
-
The Digital Operational Resilience Act has applied since 17 January 2025. Banks must keep records of ICT incidents and stay responsible for systems a vendor runs on their behalf.
- UKPRA SS1/23
-
The Prudential Regulation Authority’s model risk principles have applied to banks since 17 May 2024, with AI in scope. Principle 2 asks for governance and documentation of every model in use.
- UKBank of England
-
On 30 June 2026 Deputy Governor Sarah Breeden said existing frameworks "were not built to contemplate autonomous agents", and named consent, authorisation and liability for agent transactions as open questions.
- USSR 26-2 and OCC Bulletin 2026-13
-
On 17 April 2026 the Federal Reserve, OCC and FDIC replaced SR 11-7 with revised model risk guidance. It says generative and agentic AI are not within its scope, and that each bank’s own risk management must set the controls for them.
- USFINRA 2026 oversight report
-
FINRA’s December 2025 report names agents as an emerging risk and asks firms "how to track agent actions and decisions" and where to place human review.
- SingaporeMAS Guidelines on AI Risk Management
-
Proposed in November 2025 and being finalised. MAS told Parliament on 5 August 2026 that the Guidelines apply to all AI use cases, including agentic AI. The industry SAFR framework, published with MAS in July 2026, sets out how agent actions are authorised and what is recorded at every consequential decision.
MAS written reply, 5 August 2026Safeguards for Agentic Finance at Runtime
- GlobalFSB Sound Practices
-
The Financial Stability Board’s June 2026 consultation on responsible AI adoption calls for enhanced documentation and logging for generative and agentic AI, with the final version due in October 2026.
What changes
The same event, with and without an independent record.
| When this happens | With your own account | With DOVU |
|---|---|---|
| Regulatory examination | Your evidence about your own system | A record anyone can check, held by neither side |
| Customer dispute | "Our system says we were right" | A timestamped record held outside both parties |
| An agent exceeds its remit | You investigate your own files | The grant, the limit and the breach are all visible to anyone |
| Insider risk | Alterable by anyone with enough access | Nobody can rewrite it, including DOVU |
| Several parties disagree | One company's account, disputed by the rest | One shared record all of them can read |
Public record, private data
The record is public. Your customers' data is not.
What goes on the public ledger is narrow: that an action happened, which step it belongs to, the role it was taken under, the result of the permission check, and a fingerprint of the evidence.
The evidence itself, the customer data and the commercial terms stay inside your systems. The record shows that a specific piece of evidence existed at a specific time and was accepted by an authorised actor. It does not reveal the evidence.
Durability
A record you must keep for seven years cannot depend on a seven-year contract.
DOVU writes to Hedera, a public ledger. Every permission and every action stays readable through any public copy of that ledger, timestamps intact, whether or not DOVU is still operating.
If you build agents for banks, the record travels with your product. DOVU sits alongside your identity and orchestration systems. Nothing is replaced. Your customers' examiners read the record without asking you.
Next step
What can't you prove today?
Thirty minutes with our CEO. Bring the problem.