Self-hosted LLMs and AI agents for Saudi banks

Banks were among the first to ask for private AI, for a simple reason: the data that would make an assistant useful (customer records, transaction patterns, internal policies, server logs) is the data a bank is least able to send elsewhere.

Why banks self-host

• Data control. Prompts and documents stay on infrastructure the bank operates or contracts in the Kingdom.
• Fewer processors. Without an outside model provider, there is one less party to assess, contract and monitor.
• Choice of model. The bank can change models without changing the platform or the controls around it.

What SAMA’s Cyber Security Framework asks for

SAMA’s framework applies to the banks, finance companies and payment service providers SAMA regulates. It is organised in four domains: leadership and governance, risk management and compliance, operations and technology, and third-party cybersecurity. For an AI platform, most of the work falls in the last two.

How AcTree supports the relevant subdomains

Identity and access management (3.3.5)

Customer-hosted installations support an identity provider through OIDC with PKCE. Hosted workspace SSO must be confirmed for the agreed deployment.

OIDC sign-in uses PKCE, nonce and state, and hands the session over with a one-time cookie-bound code — never a bearer token in a URL.

Change management (3.3.7)

Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.

Changing a host's execution policy from read-only to full is an administrator-only action.

Cryptography (3.3.9)

Bring your own model — OpenAI-compatible endpoints, Ollama, Anthropic, or Cloudflare AI Gateway / Workers AI — with keys envelope-encrypted at rest.

Event management and monitoring

Administrative actions — such as raising a host's execution policy or moving a host between workspaces — are recorded to an audit log with the actor, the action, the subject and the values before and after the change.

Host investigations show the commands that ran, their exit codes and output, per host.

Third-party cybersecurity

Skills ship with the release, come from AcTree's signed skill catalogue, or are your own uploads, and each workspace enables or disables each one.

The signed vendor skill feed is rollback-protected: an older signed catalogue cannot replace a newer one.

The framework is met by the bank, not by a product. These controls supply evidence for that work; the security and compliance page has the same mapping next to NCA ECC and PDPL.

The architecture for a bank

The platform runs inside the bank’s network, on one host or a k3s cluster, or fully isolated where policy requires it. The model runs on the bank’s GPUs or behind an endpoint in a region the bank approves. Servers are enrolled one at a time, in the zones the bank chooses.

Customer-hosted deployments use packaged deployment configuration. An offline deployment requires an accepted bundle, local model and disconnected installation tests.

Customer-controlled inference and execution boundaries.

Where agents help first

• Security operations: investigate an alert across the log platform, the endpoint tool and the host, with the evidence attached. See AI for SOC analysts.
• IT operations: find the servers with missing updates, expiring certificates or full disks, across the fleet. See AI for IT operations.
• GRC and audit: collect control evidence with the command behind each value.
• Finance operations: the reconciliation film shows the pattern with sample data.

The use-case library has a film for each of these.