C4C Guardrails: proof your AI used the rules correctly
Getting AI to answer a compliance question is easy. Showing that the answer used the right rule, the current version, in the regulator’s own words, is the hard part, and it is what an examiner asks for. C4C Guardrails work in two halves: while your people work, and after the fact.
Why AI needs guardrails on regulatory work
In our test, the same AI answering from memory quoted the regulator’s exact words once in 15 questions, and made confident mistakes: it said Fannie Mae servicers inspect delinquent properties around day 45 (the Servicing Guide says day 90 to 120), and put the VA partial claim cap at 30% (the statute says 25% in general). With web search it did better, 6 exact quotes in 15, but it also stitched quotes together from fragments and offered one FHA “quote” that is not in HUD’s text at all. How we tested →
In session: prevent
Free with the C4C Connector and C4C Private
- The regulator’s exact words, with citation, version and effective date, instead of a paraphrase from memory.
- Currency signals on every answer: superseded, revised, optional now and mandatory later, two versions in force. In our test the connector flagged all 4 recent rule changes without being asked.
- One-call quote checks. Any passage, from any source, can be checked against
the regulator’s text with
verify_quote: exact, assembled from pieces (with what was skipped), or not found. - Decision records (in C4C Private): the rules relied on, pinned to their version, and a file note a person approves, tied to the loan or decision.
After the fact: detect
The C4C Monitor, early access on Claude Enterprise
- Reads your organization’s Claude records through the Claude Compliance API, inside your own network.
- Flags likely misquotes and made-up citations, reliance on superseded rules, borrower data in chats, and regulatory answers with no lookup behind them.
- Finds; your people decide. It reads only, never edits or blocks, and stores masked values.
Built for Fannie Mae’s AI governance rules
Section 4 of Fannie Mae’s Information Security and Business Resiliency Supplement (mandatory January 18, 2027) asks seller/servicers to govern their use of AI. C4C Guardrails produce evidence for several of its requirements. They support your program; they do not replace your judgment or your policies.
| Section 4 asks for | Where C4C Guardrails help |
|---|---|
| An inventory of AI use cases, with processes to detect and track them | Your Claude Compliance API records show which AI tools and connectors staff use; the C4C Monitor reads those records, and a use-case inventory report is in development |
| Processes to identify errors requiring remediation | Misquotes, outdated rules and unsupported answers flagged for review |
| Monitoring and auditing, including after deployment | In-session checks plus the look-back report |
| Controls for Confidential Information; AI outputs from it treated as confidential | Borrower data in chats flagged, with masked values |
| Third-party AI governance | C4C Private runs in your environment with no outside connections |
See the verbatim Section 4, and the Fannie Mae AI governance playbook that builds your inventory, policy and Section 4 crosswalk.
Want both halves in your own environment? The C4C Sandbox combines C4C Private, Guardrails and Playbooks, set up and supported.
Request C4C Monitor early access
Research tools, not legal advice. Findings are leads for your compliance team to confirm at the source.