AI is in every workflow. Where's the record of what it decided?
PathReader turns your existing policy documents into governance rules, applied by deterministic policy evaluation. Check AI activity across your teams' AI tools, on the device. Violations map back to the rule they broke and the policy behind them, down to the exact quote for rules drawn from your documents.
LLM guardrails aren't compliance
Probabilistic filters catch obvious problems. They don't check AI use against your own written policies, or show which clause applied. When a regulator asks why, "the model thought it was fine" is not an answer.
68%
Lacked AI governance policies
Breached organizations with no policy to manage AI or detect shadow AI, leaving unapproved tools in use without security oversight.
49%
Suffered data loss or compromise
Nearly half of shadow AI incidents led to the loss or compromise of data.
1 in 5
Paid regulatory fines
21% of shadow AI incidents ended in a regulatory fine. Across all breaches, regulatory noncompliance was associated with an extra USD 201,112 in average cost.
Source: IBM, Cost of a Data Breach Report 2026.
Auditors need the same answer every time. PathReader makes rule-tied decisions. Probabilistic filters can't.
From policy document to governed AI, without writing a single rule
Set up once: approve your rules and roll out to your devices. From then on, AI activity is checked on the device.
- 1Upload your policy documentPDF, handbook or SOP
- 2Review rule candidatesEach cited to its source quote
- 3Approve, edit or reject Human sign-offNothing goes live without your team
- 4Publish a policy versionVersioned and auditable
Approved by your team. Applied the same way every time. Every approval and rejection is logged with who made it and when.
Your AI provider, your key. Rule extraction runs only on your organization's own AI provider key, so your policy documents are processed under your own provider account.
- 1Create a device groupIn PathReader
- 2Deploy the signed installermacOS and Windows, deployable through MDM (tested with Microsoft Intune)
- 3Devices enroll themselvesEach registers with its own key
- 4Checking startsRuns in the background
Runs on the device. Works with Claude today: in the browser, the desktop app, Claude Code and its VS Code extension. Prompts never reach PathReader's infrastructure.
Your policies, managed as rules
Observability tools, gateways and guardrails each do a job in your AI stack. PathReader adds the policy layer: it turns your written policies into rules your team approves, and keeps a record of how AI activity measured up.
Rules from your documents
Rules drawn from your policy documents cite the clause they came from.
Nothing live without sign-off
Your team approves, edits or rejects every rule. Each decision is logged with who and when.
Versioned like code
Every published policy version is kept, and each result records the version that applied.
No AI in the decision
Rules are applied by deterministic policy evaluation, the same way each time.
Gaps made visible
Activity that no rule covers is marked Not covered, so you can see where policy is silent.
A tamper-evident record
Every check is written to a log you can hand an auditor.
PathReader turns your policy documents into decisions an auditor can trace to the source.
Every flag cited to its source
Your own policies, applied to the AI tools your teams use. Violations trace back to the rule they broke.
Illustrative examples. Companies, policies and clause numbers are fictional. Prompts are checked on the device and never reach PathReader's infrastructure.
Regulators are already asking for the record
AI rules and regulator guidance now apply in the US and EU, with more taking effect through 2027. Most come back to the same question: can you show what your AI did, and why?
FINRA encourages firms using AI agents to track agent actions and decisions and to define where human review is required, under existing supervision rules.
At stake: Weak supervision is grounds for FINRA disciplinary action and fines.
Where it has been adopted, insurers are expected to maintain a written AI program with governance, risk controls and documentation. Colorado and New York run their own rules.
At stake: Regulators can demand your AI governance documents in an investigation or market conduct exam.
Notice before or when AI is used in consequential decisions, an adverse-decision notice within 30 days describing the AI’s role, and records kept for three years.
At stake: Enforced by the Attorney General as a deceptive trade practice, up to $20,000 per violation.
High-risk AI, including credit scoring and life and health insurance pricing, must keep automatic logs for traceability (Article 12). AI in regulated products follows Aug 2, 2028.
At stake: Fines up to €15M or 3% of worldwide annual turnover.
The common thread is evidence: what AI did, which rule applied, and who approved that rule. That’s the record PathReader keeps.
Be ready before the auditors ask
- Rules from your own policies, approved by your team
- Checked on the device, across your teams' AI tools
- Violations traced to their rules in a tamper-evident log
PathReader is available to teams in regulated industries. We review every request and prioritize organizations ready to deploy.
We respond within 48 hours.