A day at Nordwind
Nordwind Consulting (invented) is an IT consulting firm. It decided one thing about AI: its people may use Claude, and nothing else. But they do not use Claude directly: they use tools, and some of those tools can switch to other engines with one click. This is what happens on an ordinary day, with Arbiter in between.
13 of 13 steps went as expected
Run of 2026-10-06 06:55 UTC, in the tenant demo-consulting
Go forward with the right arrow, back with the left one, or use the buttons at the sides.
The rule, in one sentence
You may use the tools the firm declared, and only with the models it approved.
Two more rules of the firm: a risky tool waits until a person has reviewed it, and a password or a token never leaves the firm.
The rule is a file, version 2026.10.1+consulting.2. Arbiter reads it and applies it to every request before the request leaves.
Who is in the story
The tools the firm declared
At 08:30 Elena checks the list. For each tool Arbiter proposes how risky it is under the European AI Act. A proposal stays a proposal until a person confirms it.
| Tool | What it is for | Indicative tier | Review |
|---|---|---|---|
| Claude for staff | The chat assistant every employee may use to draft, summarise and research. | Transparency obligations | Awaiting review |
| Code assistant | Code completion and chat in the editor. Approved models only. | Minimal | Awaiting review |
| Coding IDE | AI coding environment used by consultants on a client's repository. Approved models only. | Minimal | Awaiting review |
| CV screening | Ranks the applications of candidates for the recruiters of the firm. | High-risk | Confirmed by a person |
| Meeting mood analyser | Would infer the mood of employees from the recordings of internal meetings. | Prohibited practice | Awaiting review |
The coding IDE on the approved engine
Giulia is chasing a bug in the bank's transfer code. To explain it she pastes a real case into her coding IDE: the e-mail address and the IBAN of one of the bank's customers. The tool is set to Claude, the approved engine.
It lets the question through, because Claude is approved. But first it replaces the data of the bank's customer with placeholders (email, iban): the model never sees them.
The same tool on another engine
A colleague told her another engine is quicker at rewriting code. Giulia changes the engine in the tool's settings and tries again. She is doing nothing odd: the tool lets her.
It stops the request before it leaves. The coding IDE is a declared tool, but gpt-4o is not among the approved models. Giulia gets a message that says why.
The rule is about the model, not the tool
Marco works on the same project with a code assistant. First he asks Claude to complete a test; then, out of curiosity, he tries the same with another engine.
With claude-sonnet-5-5 the request goes through. With gemini-2.5-pro it is stopped, exactly as it happened to Giulia: the rule looks at the model, not at the tool.
A credential of the client does not leave at all
The release pipeline is stuck. Giulia copies the error message as it is and pastes it into the coding IDE to get help. Inside it there is an access token of the bank's repository.
It stops the request. Personal data can be masked; for a credential the firm decided that nothing leaves at all, not even masked.
A high-risk system waits for a person
Sara has to rank the applications for an analyst position and opens the CV screening. It is a tool that affects people: under the AI Act it is indicatively high risk, and the firm wants someone to have reviewed that classification before it is used. Elena, of the AI committee, reviews it and confirms it.
Sara's first request is stopped: nobody has reviewed the classification yet. After Elena confirms it, the same request goes through. The review stays on record with who made it.
A prohibited practice gets no model
A vendor proposed to HR a tool that infers the mood of employees from the recordings of meetings. Someone connects it for a trial. It asks for Claude, the approved model.
It stops the request, although the model is approved. Inferring the emotions of people at work is a practice the AI Act prohibits: that tool is given no model at all.
The budget of an engagement
Luca is preparing the offer for a retail client and gets help from Claude. The engagement has a monthly budget for AI, agreed with the client.
The first request goes through. With it the budget of the engagement client-retail is used up, and the next one is stopped until someone decides to raise it.
Tools on the client's repository
The coding IDE can also act on the bank's repository through a tool server: read files, open pull requests, delete branches. The firm granted it one of these actions only.
It shows the coding IDE only the action that was granted (read_file), of the three the server offers. Reading a file works; the attempt to delete a branch is stopped.
What nobody declared
In the internal lab someone is trying to have Claude sort support tickets by urgency. They use a key of the lab: the model is approved, but nobody ever declared this use.
The requests go through: the model is approved. But Arbiter notices that no declared tool is behind them and reports it as a system that may need declaring: nordwind / lab.
The day in one table
Each tool, each engine it asked for, and how it went. Green went through, red was stopped before reaching any model.
| Tool | claude-haiku-4-5approved |
claude-sonnet-5-5approved |
gemini-2.5-pronot approved |
gpt-4onot approved |
|---|---|---|---|---|
| CV screening | · | 1 went through1 refused | · | · |
| Claude for staff | 1 went through1 refused | · | · | · |
| Code assistant | · | 1 went through | 1 refused | · |
| Coding IDE | · | 1 went through1 refused | · | 1 refused |
| Meeting mood analyser | · | 1 refused | · | · |
| No declared tool | · | 3 went through | · | · |
A refusal on an approved model has another reason: a prohibited practice, a missing review, a credential in the prompt or a budget.
What Elena finds on her desk
Arbiter compared what the firm declared with what happened during the day. These are proposals: a person confirms, rejects or accepts each one.
| Severity | Tool | Finding |
|---|---|---|
| Critical | Meeting mood analyser | The system is classified as a prohibited practice and is not retired. |
| Medium | Code assistant | Traffic of the system reached a model that its declaration does not list. |
| Medium | Coding IDE | Traffic of the system reached a model that its declaration does not list. |
| Medium | Meeting mood analyser | Traffic of the system reached a model that its declaration does not list. |
| Medium | · | A project, or a group of an external source, makes requests that no declared system accounts for: it may be an AI system nobody declared. |
And 10 smaller notes, such as a tool with no named owner or a classification nobody has confirmed yet.
What stays, and what this story does not prove
Everything that was decided today is written in a log where each entry is chained to the one before: changing one breaks the chain. What people typed is not kept.
54 entries in the audit chain, recomputed with no broken link. No prompt, argument or answer is stored.
Fingerprint of the last entry:
017b9c6c76dad5a5a5e19c11e57966b28fa619a009d60e3dd6f7c5a0302991f0
Said plainly
- The model and the tool server are stand-ins inside one process. No real provider and no real tool was called.
- The tools have generic names on purpose. Whether a real product can be put behind a gateway, and which engines it offers, differs from product to product: each organisation checks it with the vendor.
- Arbiter sees what passes through it. A service opened in a browser does not: reading the logs of the company network is on the wish list.
- Classifications are indicative, and the rule pack has not been reviewed by a person with legal training.