Two related pieces on this blog established two constraints. Enterprise AI mostly fails, and not because the models are weak: inside a bank, a generic model guesses, and a guess about a rule or a deadline is a fine (see why 95% of enterprise AI pilots fail inside regulated institutions). And even a model capable enough to do the work often cannot be deployed, because the institution cannot send its data out to it (see the question that kills AI projects in a bank).
The constructive version of the question follows naturally. Set the products aside for a moment. Put the requirement in the chair of the person whose name goes on the outcome, the compliance officer, the risk lead, the head of operations. What would an AI system actually have to be before that person signs off on letting it touch real work?
A close reading of how these approvals actually happen produces a short, consistent list. The striking part is what is absent from it. Almost nothing concerns the model being smart.
The four requirements
It must not decide the things it should not decide. The common instinct is that a better AI decides more. From the signer's chair, the opposite holds. The moment a model becomes the thing choosing whether a rule is met, whether a deadline has passed, or whether a case qualifies, judgment has been handed to something that guesses. The workable structure is different: the decision is made by the rule itself, encoded and checkable, and the model is kept away from it entirely. The AI drafts the letter. It does not decide the case.
It must show its reasoning, every time. Not a vague "the system determined that." An actual trace: this conclusion came from this rule, that sentence was written by the model, this step was completed by a person. If a decision is questioned six months later, there has to be a record that answers the question, not a shrug. In regulated work, "we cannot fully explain why it did that" is not a quirk. It is disqualifying.
A human must control how far it can reach. Not a single setting for everything. Reading a document and drafting a response is one class of action. Sending something, committing funds, conceding a case, or filing with a regulator is another entirely. Autonomy has to be configurable action by action, and the most sensitive actions need the option to be locked to human-only permanently, regardless of what is later toggled elsewhere.
It must stop when it does not know. This is the requirement most at odds with how a general-purpose model normally behaves. A general model always answers. What a bank actually needs is a system that, on encountering a case it was not built for, does not improvise a plausible answer. It stops and routes the case to a person. It is built to fail loudly and safely rather than confidently and silently.
What the list reveals
Read the list back. Not one requirement is "make the model smarter." Every one concerns restraint: what the system is not permitted to do, where it must stop, who it has to defer to, how it has to explain itself.
In a regulated institution, the most valuable AI system may be the one that is most restricted in what it is allowed to do.
That claim runs against the grain of how the technology industry usually talks about progress. Elsewhere, the system that can do more, decide more, and act more autonomously is the one that gets celebrated. Inside a regulated institution, the system that earns a signature is the one that has been deliberately constrained. The value is not in the reach. It is in the guardrails.
Which raises the operating implication directly. If restraint is the feature, the guardrails are the actual product: rules encoded so the model never has to guess them, a complete record of every step, configurable control over who can do what, and a system that stops when it should. None of that is a headline capability. All of it is unavoidably specific to the exact work being done.
This is also the design principle behind CaseClear's agent architecture: deterministic rules make every decision that has a defined answer, the model is confined to drafting and summarising, every action carries a reasoning trace back to a specific rule, and autonomy is set per action with sensitive steps locked to human approval by default.
There is a further complication worth naming here. Encoding a rule so the model does not have to guess it assumes the rule stays where it was left. Rulebooks do not sit still, and what happens when a rule changes without anyone updating the system underneath it is covered in why a static AI model quietly stops being correct.