# NORTHBRIDGE BANK — PRE-BUILD ASSESSMENT
## AI Credit Re-Scoring Platform — Vulcan Step 1

---

| Field | Value |
|-------|-------|
| **Document ID** | TKA-NB-BUILD-001 |
| **Engagement** | TKA-NB-20260702-001 |
| **Build Agent** | Vulcan — Build & Manufacturing Agent, Talastron Kinetic AI |
| **Date** | 2 July 2026 |
| **Stage** | Gate 4 — Pre-Build Assessment |
| **Input artefacts** | TKA-NB-ADR-001 · TKA-NB-HLD-001 · TKA-NB-COMP-001 |
| **Classification** | RESTRICTED — FCA Consumer Credit // OFFICIAL-SENSITIVE |

---

## PURPOSE

This assessment scores implementation feasibility for each workstream, identifies ambiguities that must be resolved before the corresponding build task commences, and records Themis's binding conditions that constrain specific components. Nothing flagged here is a surprise — it is a formal record that the factory has read the compliance output and will enforce it.

---

## FEASIBILITY SCORES

### 1. Infrastructure Foundation (Bicep / AVM deployment)

| Item | Score | Status |
|------|------:|-------|
| VNet, subnets, NSGs | 9/10 | Deployable — NorthBridge must provide VNet CIDR and subnet IDs |
| Private DNS zones (9 zones) | 9/10 | Standard AVM pattern — no blockers |
| Key Vault with CMK | 9/10 | AVM module available — purge protection enables CMK |
| Log Analytics + App Insights | 9/10 | AVM module available — straightforward |
| Azure Bastion (management access) | 8/10 | NorthBridge to confirm whether existing Bastion is available |

**Overall: 9/10 — HIGH FEASIBILITY**
Blocker: Subnet IDs and VNet resource IDs must be provided by NorthBridge IT before parameter file is finalised.

---

### 2. Azure Machine Learning — Re-Scoring Model

| Item | Score | Status |
|------|------:|-------|
| AML Workspace deployment | 9/10 | AVM module available — UK South confirmed |
| Responsible AI Dashboard configuration | 8/10 | Mandatory per ADR-002 — requires additional pipeline configuration |
| Training data ingestion | 5/10 | **BLOCKED PENDING TRAINING DATA** — see gap below |
| Feature engineering pipeline | 6/10 | Feature set not fully defined — dependent on AISP data schema |
| XGBoost/LightGBM model training | 7/10 | Model family confirmed — hyperparameter tuning time unknown |
| SHAP inference endpoint | 8/10 | Standard AML real-time endpoint pattern |
| Model card production | 8/10 | Responsible AI Dashboard generates — requires sign-off process |

**Overall: 7/10 — MEDIUM FEASIBILITY**
**Gap 1 (Critical):** NorthBridge must provide a historical credit decision dataset including: application features, legacy model decision, and actual outcome (default/performing). Without this, model training cannot commence.
**Gap 2:** The exact feature set to be ingested from the AISP response must be defined before the feature engineering pipeline is built. Data minimisation review (Themis C-13) must precede this.

---

### 3. AISP Open Banking Integration via APIM

| Item | Score | Status |
|------|------:|-------|
| APIM Premium deployment | 9/10 | AVM module available — VNet integration configured |
| OAuth 2.0 token validation policy | 8/10 | Standard APIM policy pattern |
| WAF policy (OWASP CRS 3.2) | 8/10 | Standard configuration |
| Rate limiting and IP allowlisting | 8/10 | AISP source IP ranges required |
| AISP endpoint activation | 0/10 | **BLOCKED — Minerva CONDITION 1 outstanding** |

**Overall: 6/10 — CONDITIONAL FEASIBILITY**
**Gap 3 (Condition 1):** APIM can be deployed and configured. The AISP gateway policy must not be activated until: (a) AISP FCA authorisation number is verified and recorded, (b) OAuth client credentials are loaded into Key Vault.
**Gap 4:** AISP source IP ranges for allowlisting not provided. NorthBridge must obtain from AISP.
**Gap 5:** AISP sandbox endpoint URL required for integration testing.

---

### 4. Azure OpenAI — FCA Rationale Engine

| Item | Score | Status |
|------|------:|-------|
| Azure OpenAI deployment (UK South) | 9/10 | GPT-4o available in UK South — ADR-001 override confirmed |
| Private endpoint configuration | 9/10 | Standard AVM pattern |
| Rationale prompt template | 7/10 | Template must be designed, tested, and Consumer Duty signed off (Themis C-12) |
| SHAP-to-rationale translation function | 8/10 | Well-understood pattern — implementation straightforward |
| Production activation | 0/10 | **HELD — Themis C-12: Consumer Duty prompt sign-off required before activation** |

**Overall: 9/10 — HIGH FEASIBILITY (infrastructure only)**
Note: Infrastructure can be built. The rationale endpoint must not serve production traffic until the prompt template has been reviewed and signed off by NorthBridge's compliance function.

---

### 5. FCA Audit Trail (Event Hubs + SQL + Blob WORM)

| Item | Score | Status |
|------|------:|-------|
| Event Hubs namespace deployment | 9/10 | AVM module available |
| Audit consumer Azure Function | 8/10 | Standard Function App + Event Hubs trigger pattern |
| SQL append-only audit table | 9/10 | Row-level security, no DELETE permission — straightforward |
| Blob WORM storage | 9/10 | Infrastructure deployable — **WORM lock must NOT be applied until BLOCK-02 resolved** |
| End-to-end audit validation | 8/10 | Testable in dev environment before production |

**Overall: 9/10 — HIGH FEASIBILITY**
**Constraint (Themis BLOCK-02):** Blob Storage will be deployed without the immutability lock applied. The WORM lock is a one-way, irreversible operation. It will not be applied until NorthBridge's DPO provides written confirmation of the Art 17(3)(b) exemption. This is enforced at the Bicep parameter level — `immutabilityPeriodSinceCreationInDays` will not be set in the production deployment until the written confirmation is received.

---

### 6. Entra ID / Zero Trust Access Layer

| Item | Score | Status |
|------|------:|-------|
| Entra ID integration | 9/10 | NorthBridge's existing tenant — Entra app registration required |
| Conditional Access policy | 8/10 | NorthBridge IT must configure in their tenant — not deployable via Bicep |
| RBAC role definitions and assignments | 8/10 | Bicep-deployable at resource group scope |
| Underwriter review portal | 6/10 | **See Gap 6 below** |

**Overall: 8/10 — HIGH FEASIBILITY**
**Gap 6:** Underwriter review portal — it is unclear whether this is a net-new application or integration into an existing NorthBridge tool. If net-new, this adds an application development workstream outside the current infrastructure scope. NorthBridge IT must clarify before Sprint 2.

---

## AMBIGUITIES REGISTER

The following ambiguities must be resolved before the corresponding build tasks commence. Each has been logged as a User Story in the ADO backlog with an appropriate blocker tag.

| ID | Workstream | Ambiguity | Owner | Deadline |
|----|-----------|-----------|-------|----------|
| AMB-01 | AML | Training dataset (historical decisions + outcomes) not provided | NorthBridge Data Team | Before model training sprint |
| AMB-02 | AML | Feature set from AISP response not defined — data minimisation review first | NorthBridge + Themis | Before feature engineering sprint |
| AMB-03 | AISP | AISP OAuth client credentials not in Key Vault — Condition 1 outstanding | NorthBridge Compliance | Before AISP activation |
| AMB-04 | AISP | AISP source IP ranges for APIM allowlisting not provided | NorthBridge / AISP | Before APIM policy test |
| AMB-05 | AISP | AISP sandbox endpoint URL not confirmed | NorthBridge / AISP | Before integration test sprint |
| AMB-06 | SQL | Existing Azure SQL applicant data schema not provided | NorthBridge IT | Before functions sprint |
| AMB-07 | SQL | Dataverse entity names and schema not provided | NorthBridge IT | Before functions sprint |
| AMB-08 | Portal | Underwriter review portal — new build or existing integration? | NorthBridge Product | Before Sprint 2 planning |
| AMB-09 | Networking | Existing private DNS zones — new or link to existing hub? | NorthBridge IT | Before infrastructure deployment |
| AMB-10 | Networking | VNet CIDR, subnet IDs and resource IDs | NorthBridge IT | Before parameters file finalisation |

---

## THEMIS BINDING CONDITIONS — VULCAN ENFORCEMENT RECORD

The following conditions from TKA-NB-COMP-001 are directly enforced at the build level:

| Block / Condition | Themis Finding | Vulcan Enforcement |
|-------------------|---------------|-------------------|
| BLOCK-01 | DPIA not initiated | Logged in ADO backlog as blocker. Build proceeds; DPIA must be in progress before any live applicant data is processed. |
| BLOCK-02 | WORM vs. Art 17 — legal exemption required | Blob Storage deployed without immutability lock. Lock will not be applied until DPO written confirmation received. Bicep parameter `lockDurationDays` is set to `0` until release. |
| BLOCK-03 | Art 22 lawful basis not documented | Logged in ADO backlog as blocker. Build proceeds; production deployment will not be released until DPO confirmation on file. |
| C-03 (AISP supplier) | AISP supplier security assessment | APIM deployed; AISP policy set to `INACTIVE` until Condition 1 and supplier assessment are complete. |
| C-12 (Consumer Duty) | OpenAI prompt template sign-off | Azure OpenAI deployed; rationale endpoint set to `INACTIVE` in APIM policy until compliance sign-off. |
| C-13 (Privacy notice) | Portal privacy notice update | Tagged in ADO backlog — must be resolved before MVP go-live approval. |

---

## BUILD PLAN SUMMARY

| Phase | Workstream | Duration (est.) | Dependencies |
|-------|-----------|-----------------|-------------|
| 1 | Infrastructure Foundation (VNet confirmed, IaC deploy) | Week 1–2 | AMB-09, AMB-10 |
| 2 | Data Layer (SQL, Event Hubs, Key Vault, Monitoring) | Week 2–3 | Phase 1 complete |
| 3 | AI Layer (AML Workspace, Azure OpenAI) | Week 3–4 | Phase 2 complete |
| 4 | Integration Layer (APIM, Functions, re-scoring API) | Week 4–6 | Phase 3, AMB-06, AMB-07 |
| 5 | Model Training (data ingestion, training, validation) | Week 5–8 | AMB-01, AMB-02 |
| 6 | AISP Integration (testing, activation) | Week 7–10 | Condition 1 resolved, AMB-03–05 |
| 7 | Consumer Duty chain (prompt template, portal comms) | Week 8–11 | C-12, C-13 |
| 8 | QA, Gate 4, Gate 5 preparation | Week 11–13 | All phases |

**90-day MVP target: achievable** provided AMB-01 through AMB-05 are resolved by end of Week 2.

---

## STEP 1 COMPLETE — PROCEEDING TO STEP 2

Pre-build assessment scored. Ambiguities registered. Themis conditions enforced at build level.
Opening the forge. Bicep artefacts generating now.

---

*Issued by: Vulcan — Build & Manufacturing Agent, Talastron Kinetic AI*
*Engagement ID: TKA-NB-20260702-001*
*Talastron BMAD Pipeline: Stage 4 of 5 — Build (Pre-Build Assessment Complete)*