We start withyour security team.
InfoSec is the first department we onboard, and it stays a delivery partner throughout. Every new connection and every autonomy promotion goes through them.
Turn the likeliest blocker into a sponsor.
Larger AI rollouts stall on approvals for connections and permissions. If InfoSec isn't involved from the start, those issues come back as blockers in Month 4.
So we start there. In Month 1 your security team gets its own Clones for security questionnaires, access review support, policy Q&A and vendor risk intake. They experience Clones as users before they review them.
- Clone
- Accounts Payable Clone · Finance
- Purpose
- Invoice intake, three-way match, exception routing
- Permitted data
- Vendor master, POs, invoices. No payroll, no PII beyond vendor contacts
- Permitted actions
- Draft entries; post under $5,000 after approval
- Never
- Change bank details, approve its own exceptions
- Escalation owner
- AP Manager · backup: Controller
- Autonomy
- L3 Execute with approval · review in 30 days
Signed off by InfoSec and the business owner
Nine controls, running the whole engagement.
InfoSec as delivery partner
A standing weekly sync, and approval on every new connection and every autonomy promotion.
Identity & access
Single sign-on, role-based access, least-privilege connections and custom organization roles.
Clone Governance Charter
Each Clone's purpose, permitted data, permitted actions, what it must never do, and its escalation owner.
Audit & monitoring
Audit log configuration, tamper-evident export, and mapping to SOC 2, HIPAA, NIST 800-53 and CMMC controls.
AI use policy
An organization-wide policy on acceptable use, data handling and documenting AI involvement.
Risk register
AI risks by use case, with mitigations, owners and a review cadence.
Regulatory readiness
Mapping to the EU AI Act, HIPAA and the rules of your industry for your specific use cases. Not legal advice.
Skill change control
Version pinning for production Clones, testing before upgrades, approved rollouts.
Vendor assurance
Our DPA, BAA, security whitepaper and compliance status, provided up front.
Nothing acts alone until it's earned it.
Assist
The Clone
Drafts, summarizes and researches.
Your people
Does everything else. Every send and every decision is yours.
Evidence to move up
Draft acceptance rate and accuracy on realistic test scenarios.
Recommend
The Clone
Prioritizes the queue and proposes next actions, with its reasoning.
Your people
Decides and acts on the recommendation.
Evidence to move up
Recommendation acceptance and a low override rate.
Execute with approval
The Clone
Acts after a named person approves each action, right in Slack, Teams or email.
Your people
Approves, edits or rejects. One click either way.
Evidence to move up
Approval rate, exception history and zero incidents above the agreed severity.
Execute within limits
The Clone
Acts on its own inside set thresholds, and escalates anything outside them.
Your people
Owns the thresholds, reviews exceptions and audits a sample.
Evidence to move up
Sustained accuracy, override rate under target and a clean audit log review.
Orchestrate
The Clone
Coordinates multiple workflows and Clones across systems, under monitoring.
Your people
Sets goals, monitors and can override at any moment.
How it's governed
Reviewed quarterly at the business review, with InfoSec.
Audit-ready, use case by use case.
Clone audit logs map to the controls your auditors already use. We build evidence packs for your own audits from Month 7.
Regulatory mapping is readiness work, not legal advice. Clone's own status: GDPR in place, BAAs available, SOC 2 Type I/II in progress, ISO 27001 and ISO 42001 targeted.
Questions, answered.
Why does InfoSec go first?
Large rollouts stall on approvals for connections and permissions. Bringing InfoSec in first turns the likeliest blocker into a sponsor, and your security team experiences Clones as users before they review them.
What compliance does Clone have today?
GDPR is in place and BAAs are available today. SOC 2 Type I and Type II, ISO 27001 and ISO 42001 are in progress and targeted. We share our DPA, security whitepaper and compliance status up front.
Can a Clone act without approval?
Only when you decide it has earned it. New Clones start at Assist or Recommend. Moving up the autonomy ladder takes evidence and sign-off from InfoSec and the business owner, and every action lands in the audit log.
How do you handle regulations like HIPAA or the EU AI Act?
We map your specific use cases to the rules that apply and build the controls into each Clone's Governance Charter. This is readiness work, not legal advice, and your counsel stays in the loop.
What stops a skill update from breaking production?
Skill change control. Production Clones run pinned skill versions, upgrades are tested against realistic scenarios first, and rollouts are approved before they reach your users.
Security first. Then everything else.
Request our security package: DPA, BAA if applicable, security whitepaper and compliance one-pager.