> For the complete documentation index, see [llms.txt](https://docs.solcis.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.solcis.ai/what-solcis-does.md).
# What Solcis does
The Solcis Policy Engine enforces your controls on every action your AI systems take that passes through it; each decision is written to Compliance Studio as evidence a third party can verify.
The Solcis Policy Engine sits between your AI systems, the AI-powered software, agents, and models your organisation runs, and the actions they take. Every action that passes through it is evaluated against your organisation's controls before it proceeds. Every decision is written to the tamper-evident evidence ledger in Compliance Studio. Both products run in your infrastructure, under your certifications, with a model you choose. We host neither.
Compliance Studio imports your controls, the ones already in your governance, risk, and compliance (GRC) programme, and turns them into runtime policies, your controls expressed as code. Actions are checked at enforcement points. The Solcis Policy Engine enforces on the action path, where the Solcis SDK places it, and at model, tool and MCP endpoints. Gateways, the Solcis Gateway or your own, put enforcement in the traffic path. NVIDIA OpenShell and Microsoft AGT enforce security and infrastructure controls, and Compliance Studio can supply them enforcement policies. Where Solcis enforces covers each enforcement point. The Solcis Policy Engine evaluates the action against the policies that apply and returns one decision. An allowed action proceeds to the target system. A denied action is refused; an escalated action is held for a person. The Solcis Policy Engine writes a compliance receipt for each decision; Compliance Studio's universal evidence ledger collects receipts from every enforcement point.
## Enforcement, not observation
The Solcis Policy Engine evaluates the action before it happens. `Deny` refuses it. `Escalate` holds it until an authorised person decides. `Severity` lets it proceed with a rating attached for later review. `Allow` lets it proceed and records that it did.
Two steps make the decision. A deterministic check evaluates the action against rules. An inference check, using a model you run yourself, weighs what rules alone can't express: ambiguity, context, novelty. The compliance receipt for each decision says which step decided.
## Your controls, not ours
AI governance doesn't begin from a blank page. Your organisation has spent years building a GRC programme: risk registers, control libraries, framework mappings, audit programmes. Solcis extends that programme to your AI systems rather than standing apart from it. A control that already exists for people and systems becomes a control enforced on what your AI does. It keeps the same identifier and the same lineage to the framework requirement it satisfies.
The controls, rules and policies the Solcis Policy Engine enforces are inspectable in Compliance Studio. You can read every one of them. *How it works › Controls to policy* explains how a control becomes something the Solcis Policy Engine can enforce.
## Evidence a third party can check
Every evaluated action produces a compliance receipt: what was attempted, what was decided, which control and policy version drove it, and which step decided. Receipts are held in the evidence ledger, which is tamper-evident. A verifier can detect that a receipt was altered or removed after it was written.
The point of the ledger is independence. Internal audit, an external assurance provider or a regulator can verify it. They don't have to trust the people who built the system or the people who run it.
{% hint style="info" %}
**What "tamper-evident" means**
Each receipt is cryptographically chained to the one before it, so altering or removing any record breaks the chain. You don't trust that the ledger is intact, you can check it.
{% endhint %}
{% columns %}
{% column width="41.66666666666667%" %}
{% endcolumn %}
{% column width="58.33333333333333%" %}
#### **See Solcis enforce a control**
A walk-through of a live deployment with one of our engineers, on a scenario you bring. No slides.
Book a demoEvaluate Solcis
{% endcolumn %}
{% endcolumns %}
## In your infrastructure
Compliance Studio and the Solcis Policy Engine are software you run. Every component runs in your environment: your cloud, your data centre or an air-gapped network. The model doing the inference check is one you choose and host. No component in your Solcis deployment makes an outbound connection back to us.
## What it doesn't do
The Solcis Policy Engine governs the actions that pass through it. An AI system that isn't connected, or a tool called outside a connection, isn't evaluated and isn't recorded. Compliance Studio shows you the difference between what's covered and what isn't.
Solcis doesn't make you compliant with anything. It enforces the controls you've decided on and gives you evidence of having done so. Whether those controls satisfy a framework or a regulator is a judgement your organisation and its advisers make.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.solcis.ai/what-solcis-does.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
