APRA CPS 234

CPS 234 asks an Australian regulated entity to keep security capability in proportion to its threats. A bank, an insurer or a superannuation trustee must show that for every system, including an assistant. This starter narrows the question to AI traffic and supplies evidence inputs rather than an opinion.

A supervisor will ask which system holds sensitive data, who can reach it, and how a failure surfaces. An assistant that answers questions about accounts belongs in that inventory. The chain below turns the answer into configuration instead of a policy statement.

Before a prompt reaches the model, four checks run in a fixed order. Injection screening comes first, so a crafted instruction cannot switch off the identity check behind it. Identity enforcement then refuses any call without verified user and organization claims. Redaction masks tax identification numbers, and a block list stops account export requests, payment instructions, access tokens and private keys.

Returned text must reach a combined score of 0.86. Relevance must reach 0.78 and accuracy must reach 0.80, weighted equally. A reply under 120 characters or a single sentence fails the same test and is blocked. Source checking also runs, and it records a flag unless your team asks it to block.

Review is unconditional in this configuration. No answer reaches the caller, because every response stops for a person and the gateway records an escalation. Staff the review queue with the people who own control changes, report releases and incident response. The final stage marks each evaluated request and never blocks. It does not store, retain or seal that record, so evidence handling stays a separate decision.

Penetration testing, third party review and risk appetite remain human programs that no configuration can run for you. Choose the Monetary Authority of Singapore starter when the supervising regulator is Singaporean rather than Australian.