Topic starter
10/06/2026 10:31 pm
TL;DR: Verification flows and transaction monitoring rules can now be generated from plain-language instructions, turning a read-and-suggest assistant into one that creates live platform configurations with human review before go-live, according to SumSub. The shift matters because governance now has to cover machine-generated configuration, not just human-authored policy.
Editorial analysis by NHI Mgmt Group, based on content published by SumSub: “Sumsub Adds Level Builder and Rule Builder to Summy AI Copilot”.
Key questions
Q: How should compliance teams govern AI-generated verification flows?
A: Compliance teams should treat AI-generated verification flows as production controls, not draft content.
Q: Why do plain-language rule builders create governance risk in monitoring programmes?
A: Because the prompt can become executable decision logic.
Q: What are the signs that AI-generated compliance configuration is not being controlled well?
A: Common warning signs include repeated edits after generation, unexplained default selections, reviewers approving changes without reading diffs, and inconsistent outcomes across similar prompts.
Practitioner guidance
- Define approval boundaries for generated configuration Specify which verification flows and monitoring rules may be generated, which require manual creation, and which need a second reviewer before activation.
- Validate generated outputs against platform schema Check whether the AI-selected steps, document types, country settings, AML checks, and trigger logic match the intended control design and regulatory scope.
- Require versioned diffs for all AI-authored changes Capture a before-and-after comparison for every generated rule or flow so reviewers can see exactly what changed before go-live.
Bottom line: AI-generated verification flows and monitoring rules move control risk into the configuration layer, where prompt quality and schema mapping matter as much as policy intent.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
11/06/2026 2:35 am
Generated configuration is now an identity control surface. When an AI system can produce verification flows and monitoring rules directly, the governance question moves from who can use the platform to who can author enforceable controls through it. That expands the identity boundary into configuration generation, where machine output can shape compliance outcomes. Teams should treat generated configuration as a governed artefact, not a convenience feature.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- AI governance is already lagging in practice: 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to the same report.
A question worth separating out:
Q: Should organisations separate AI configuration creation from publication rights?
A: Yes. Separation of duties should apply to AI-generated controls just as it does to human-created ones. The person who describes the need should not be the only person who can publish the resulting rule or flow, especially when the object affects verification or monitoring decisions.
👉 Read our full editorial: Plain-language configuration for verification flows and monitoring rules
12/06/2026 4:09 am
Plain-language configuration turns policy intent into a governed change-management problem. Once an AI system can write verification flows and monitoring rules, the critical question is no longer whether the policy team can describe requirements clearly. It is whether the organisation can validate, approve, and reverse AI-authored configuration with the same discipline it applies to any production change. The practitioner implication is that governance must move closer to configuration control, not stay at the policy-document layer.
A question worth separating out:
Q: What should organisations do when AI can write production platform settings?
A: Limit the AI to scoped workflows, define who may approve generated changes, and require human review that is backed by test cases and rollback capability. The goal is not to block automation, but to keep machine-authored configuration inside a governed change process.
👉 Read our full editorial: Plain-language configuration for verification flows and monitoring rules
This post was modified 2 days ago by NHI Mgmt Group