# Jones & Associates — Governed AI for Regulatory Control Assessment

> Enterprise AI should not replace professional judgment — it should make professional judgment transparent, repeatable, and reviewable. Heritage transforms regulatory interpretation from an opaque AI response into a governed, evidence-backed decision process that professionals can review, challenge, and reproduce.

## What This Is

Jones & Associates has built a governed AI decision methodology for regulatory control assessment. CRI v2.2 is the first framework implementation, but the architecture supports any regulatory framework (PCI, NIST, ISO, SWIFT, FedRAMP, HIPAA, SOC 2). The AI does not replace professional judgment — it decomposes expert judgment into governed, auditable steps. The Arthur Knowledge Repository is the platform; CRI is the first application.

## Key Principles

- Client data never leaves the client environment
- Generative AI where natural-language understanding is required
- Deterministic logic where precision is required
- Every determination traces to source evidence a reviewer can verify

## Demonstration Artifacts

The Heritage Community Bank demo is a prototype assessment using a fictional 568-control library against CRI v2.2 Diagnostic Statement PR.AA-01.01 (Identity and Credential Management).

- [Coverage Assessment Report](https://mcp.tristanjones.ai/heritage/demo/report.html): The completed PR.AA-01.01 workpaper with interactive review mode
- [Control Library](https://mcp.tristanjones.ai/heritage/demo/controls.html): The 568-control library used throughout the assessment
- [Deployment Architecture](https://mcp.tristanjones.ai/heritage/demo/architecture.html): How the CRI Assessor uses AI without exposing client data
- [How Coverage Determinations Are Made](https://mcp.tristanjones.ai/heritage/demo/verdicts.html): The assessment process with worked examples of Covered, Partial, and No Coverage ratings

## Architecture Summary

The CRI Assessor operates as a two-component system:
1. **Client Environment** — A containerized local model (L1) processes the institution's controls. No client data leaves the local machine.
2. **Arthur Knowledge Repository** — A remote knowledge service (MCP server) provides pre-validated CRI decompositions, taxonomy, and quality baselines. Only framework knowledge is exchanged — never client data.

## Contact

- Author: Tristan Jones, Senior IT Auditor, CISA, AAIA
- Firm: Jones & Associates
- Email: tristanmarvin@outlook.com
- Site: https://mcp.tristanjones.ai/heritage/demo/

## llms-full.txt

For the complete methodology specification, see: https://mcp.tristanjones.ai/heritage/demo/verdicts.html