Governance and metrics

Strategy

Vision and roadmap Product spec Delivery plan Governance and metrics

Executive readout

Composed from live data · no model

Status amber. Partner Aurora's data room is live: 506 of 506 entitlement checks pass against the database; 4 governance items open.

WinsEntitlements enforced in the database: Program scope, purpose grants and column masking enforced by Postgres on every read path: the simulator, the API and the AI analyst.
WinsContracted partner aggregates: The partner receives contracted metrics by contracted dimensions; any cell under 25 cardholders is suppressed.
WinsGoverned AI analyst: Plain-English questions compile through a semantic layer onto masked views. Verified questions cost no model call.
RisksOngoing monitoring (drift): KS drift 0.041: inside the 0.05 tolerance but rising.
RisksOffshore and affiliate access to US cardholder data: Residency is not yet a policy attribute.
AsksAdverse-action reasons (Reg B, 12 CFR 1002.9): Complete reason-code validation before production.
AsksIndependent validation: Complete the validation report before promotion.
NextIdentity-bound personas: Replace persona switching with SSO and SCIM identity, with signed claims read by the same policies.
NextTime-bound unmask exceptions: Request, approve and auto-expire a 15-minute unmask grant, with every step logged.

Metrics tree

Program targets roll up to one north star. Control metrics are measured live where the database can prove them.

506 of 506 policy checks pass

North star

Days from signed agreement to the partner's first governed report

10business days · target

Controls

Partner-visible metrics traceable to a contract clause

100%

Target

Cardholder-level rows delivered to the partner

0rows

Measured live: 0, asserted by the self-test

Read paths enforced in the database (UI, API, AI)

100%

Measured live: all paths use the same views

Adoption

Questions answered from verified queries

70%

Target

Weekly active data-product consumers

25% QoQ growth

Target

Reliability

Partner report SLA adherence

99.5%

Target

Governed query latency p95

5seconds

Target

Model-risk and governance register

Controls under SR 26-2 (which superseded SR 11-7), fair-lending rules where a credit decision is made, and data-sharing controls.

Control	Model	Status	Finding	Remediation	Owner
Conceptual soundness (SR 26-2)	Real-time fraud detection	Pass	Development evidence and assumptions reviewed at Tier 1.	-	Model Risk
Outcomes analysis	Real-time fraud detection	Pass	Back-test AUC 0.942 on a temporal hold-out (synthetic).	-	Independent Validation
Ongoing monitoring (drift)	Real-time fraud detection	Attention	KS drift 0.041: inside the 0.05 tolerance but rising.	Retrain trigger armed at KS drift 0.05.	Fraud Data Science
Decline reason codes for servicing	Real-time fraud detection	Pass	Not Reg B adverse action: point-of-sale authorization refusals are excluded (12 CFR 1002.2(c)(2)(iii)). Reasons are available to agents.	-	Fraud Data Science
Adverse-action reasons (Reg B, 12 CFR 1002.9)	Credit line increase eligibility	In review	Principal-reason mapping from model drivers under review.	Complete reason-code validation before production.	Compliance
Fair-lending testing (BISG proxy)	Credit line increase eligibility	Pass	Adverse impact ratio 0.91 on a BISG proxy, above the 0.80 threshold (synthetic).	-	Fair Lending
Independent validation	Cardholder attrition propensity	In review	Validation in progress before production.	Complete the validation report before promotion.	Model Risk
Fair treatment of retention offers	Cardholder attrition propensity	Pass	Offer rates consistent across segments.	-	Compliance
Partner data minimisation (GLBA and Reg P)	Platform	Pass	The partner receives contracted aggregates only; no cardholder-level rows leave the bank.	-	Data Governance
Offshore and affiliate access to US cardholder data	Platform	Attention	Residency is not yet a policy attribute.	Residency-aware entitlements (roadmap: Later).	Data Governance

Conceptual soundness (SR 26-2)Pass
Real-time fraud detection · Model Risk
Development evidence and assumptions reviewed at Tier 1.
Outcomes analysisPass
Real-time fraud detection · Independent Validation
Back-test AUC 0.942 on a temporal hold-out (synthetic).
Ongoing monitoring (drift)Attention
Real-time fraud detection · Fraud Data Science
KS drift 0.041: inside the 0.05 tolerance but rising.
Remediation: Retrain trigger armed at KS drift 0.05.
Decline reason codes for servicingPass
Real-time fraud detection · Fraud Data Science
Not Reg B adverse action: point-of-sale authorization refusals are excluded (12 CFR 1002.2(c)(2)(iii)). Reasons are available to agents.
Adverse-action reasons (Reg B, 12 CFR 1002.9)In review
Credit line increase eligibility · Compliance
Principal-reason mapping from model drivers under review.
Remediation: Complete reason-code validation before production.
Fair-lending testing (BISG proxy)Pass
Credit line increase eligibility · Fair Lending
Adverse impact ratio 0.91 on a BISG proxy, above the 0.80 threshold (synthetic).
Independent validationIn review
Cardholder attrition propensity · Model Risk
Validation in progress before production.
Remediation: Complete the validation report before promotion.
Fair treatment of retention offersPass
Cardholder attrition propensity · Compliance
Offer rates consistent across segments.
Partner data minimisation (GLBA and Reg P)Pass
Platform · Data Governance
The partner receives contracted aggregates only; no cardholder-level rows leave the bank.
Offshore and affiliate access to US cardholder dataAttention
Platform · Data Governance
Residency is not yet a policy attribute.
Remediation: Residency-aware entitlements (roadmap: Later).