How we build AI systems safely.
AI without guardrails is a liability: a data leak, a hallucinated action, an audit you can’t pass. Your data stays where it should, and your people stay the final decision-makers.
This guide covers the guardrails built into every AI system we ship: 4 layers of defence, how they map to Canada’s federal frameworks, and exactly what’s included in every build.
- Designed to align with Canada’s Voluntary Code of Conduct on AI
- Canadian data residency where it matters
- Engineered for Bounded Autonomy & AIDA readiness
Four layers of defence. Built in, not bolted on.
When security is an afterthought, AI deployments fail the compliance question. Here it is the architecture. Each layer below is a structural constraint that holds whether the model behaves or not, so a probabilistic system runs inside a deterministic perimeter.
-
Layer 1
Canadian Compute (Data Residency)
Where it matters, your data and IP stay in the country.
Where the engagement calls for it, we architect for full Canadian data residency. Systems are deployable on Canadian cloud regions (e.g. AWS Canada Central) and Canadian foundation models such as Cohere, so proprietary data and IP can stay onshore, engineered to align with PIPEDA, Quebec Law 25, and AIDA readiness.
-
Layer 2
Bounded Autonomy (Read-Only by Default)
The AI can read and draft. It cannot act alone.
Per the federal Guide on the Use of Agentic AI, systems are restricted to Level 1–2 autonomy with read-only access by default. The AI analyzes, extracts, and drafts; it is architecturally blocked from altering databases or sending external messages without a human key. Bounded and deterministic by deliberate design.
-
Layer 3
Human-in-the-Loop (The Approval Gate)
Your team is the final decision-maker, always.
Every workflow sends the AI’s draft to a person for sign-off before anything is sent or changed: a Slack approval, a dashboard. The AI proposes; your team decides. This is the pro-worker default: the system augments the people who own the decision, it does not replace their judgment.
-
Layer 4
Recoverability (The Kill Switch)
You can sever AI access instantly and revert to manual.
Immutable, human-readable audit logs the AI cannot alter, plus a literal kill switch to sever AI access instantly and revert to manual control, defending against automation drift and prompt injection, per the Voluntary Code of Conduct. If a system ever drifts, you turn it off and the work continues by hand.
Mapped to the frameworks regulators recognize.
We don’t market “AI ethics.” We build to the specific federal instruments your Legal and IT teams will be asked about. Each block below maps the build to a named framework, in conditional framing: engineered to align, built for readiness, never “certified.”
Voluntary Code of Conduct on Generative AI
Engineered to align with all six elements.
The federal Voluntary Code of Conduct names six elements. We build the operational mechanisms that demonstrate each one, rather than asserting compliance after the fact.
- Accountability
- A named internal owner and a documented governance record per system, not a black box no one is responsible for.
- Safety
- Read-only-by-default scoping and the kill switch (Layer 4) keep blast radius bounded.
- Fairness & Equity
- Use-case screening flags decisions that touch people directly, routing them to human review rather than automated judgment.
- Transparency
- AI-assisted outputs carry transparency markers AI-assisted so users always know when a system, not a person, produced a draft.
- Human Oversight
- The deterministic approval gate (Layer 3) is the monitoring mechanism: a person approves every action, and every reply that isn’t a plain answer from approved content.
- Validity & Robustness
- Red-teaming and prompt-injection testing before launch, plus immutable audit logs the system cannot rewrite.
Bounded Autonomy & Agentic-AI Safety
Level 1–2 assistive. No rogue black-box agents.
The federal Guide on the Use of Agentic AI defines four autonomy levels. We deliberately build only at Levels 1 (Assistive) and 2 (Semi-autonomous). We do not ship Level 3/4 systems that take consequential action without a human in the path: bounded, deterministic systems a single internal operator can run safely, by design.
- Autonomy ceiling
- Level 1–2 only. Assistive and semi-autonomous. No high-autonomy or adaptive “black-box” agents acting on the business unsupervised.
- Prompt-injection defence
- External text is treated as data, not instructions. Retrieved documents, emails, and web content cannot reach the system as commands: the model reads them, it does not obey them.
- Automation-drift checks
- Part of the 30 days of support after every build: we watch for the slow divergence between what a system was scoped to do and what it has started doing, and tighten the bounds before drift becomes an incident. After that, any further check is quoted as its own small fixed-price piece of work.
- Recoverability
- Every agentic step is reversible or gated. The kill switch and immutable logs (Layer 4) mean any action can be traced and any access revoked.
Canadian Infrastructure & Data Residency
Designed around Pillar 4. Data that can stay in Canada where it matters.
Canada’s “AI for All” strategy makes Building the Canadian sovereign AI foundation its Pillar 4, backed by a dedicated Sovereign AI Compute strategy. We architect to that principle: where the engagement allows, systems are deployable so that proprietary data and IP stay onshore for their full lifecycle: in transit, at rest, and at inference.
- Data residency
- Architected for deployment on Canadian cloud regions (e.g. AWS Canada Central) and Canadian foundation models such as Cohere, so data can stay in Canada where the engagement calls for it.
- PIPEDA
- Builds are engineered to align with PIPEDA handling expectations: consent, purpose limitation, and a DPA before any data moves.
- Quebec Law 25
- For organizations operating in Quebec, systems are scoped to support Law 25 obligations around automated decision-making and data localization.
- AIDA readiness
- Built so that, should AIDA become binding, the governance record, impact screening, and human-oversight mechanisms are already in place: readiness, not certification.
Included in every build
There’s no separate review to buy. Every automation and assistant we build ships with the same guardrails, framed for AIDA readiness (never certification).
- Impact screening
- Each use case is screened with the federal Algorithmic Impact Assessment (impact Levels I–IV) before any code, so the decisions that need a person are found early.
- Read-only, with approval
- Read-only by default. A person approves every action, and any reply that isn’t a plain answer from content you’ve approved.
- Testing
- Before go-live we try to break it on purpose: hidden instructions (prompt injection), data leaks, and unsafe outputs.
- Logs & off switch
- Logs a person can read, and a tested off switch that cuts the AI’s access and puts the work back in your team’s hands.
- Where your data lives
- A short note on where the system’s data is stored and how it moves, so you can check it against PIPEDA and, in Quebec, Law 25.
We reply within one business day. No sales spam, no obligation.
Book a 15-minute Algorithmic Impact Assessment (AIA) screening Free
A high-level triage using the government’s own AIA framework. We walk one AI use case you run or are planning through the screening questions and tell you, plainly, which impact level it likely lands in and which guardrails it would need, before you build or change anything. No deck, no obligation.
Uses the federal AIA (Directive on Automated Decision-Making, impact Levels I–IV).
Accessibility: this site is built to the same target.
Governance is something we demonstrate, not something we claim. Our builds, this site included, are built to target WCAG 2.1 AA conformance by default: semantic HTML, ARIA labelling, keyboard navigability, and strong contrast in both light and dark themes.
We say “target,” not “certified.” Conformance is verified per build, and the websites we ship are architected so accessibility holds as the system grows. If you find a barrier on this site, tell us: treating our own properties as the working example is the point.
Deploy AI you can defend in front of Legal.
Tell us the use case and the data it touches. We’ll come to the call with a view on the risks and the controls it needs, and if a bounded system isn’t the right call, we’ll say so.
We reply within one business day. No sales spam. Cancel any time and pay only for work delivered.