Home Live Demo Demo Brief Capabilities Pilot Architecture Implementation

CAIBots

CONFIDENTIAL · FOR AUTHORIZED PERSONNEL ONLY
SYNTHETIC DEMO DATA · NOT LEGAL OR CREDIT ADVICE

Engineering Documentation · Credit Underwriting AI

Implementation
Guide

Credit Underwriting Agentic AI · V1.1

AudienceIT Engineering · LOS Integration Team · Model Risk Management ScopeLOS Connectivity · API Provisioning · Policy Upload · Model Validation · UAT Protocol Estimated EffortPhase 1: 3–5 Days Engineering · Phase 2: 5–10 Days (includes validation) PrerequisitesBAA Signed · LOS API Sandbox Access · Bureau Permissible Purpose Confirmed VersionV1.1 · March 2026

LOS Connectivity

Loan Origination System Integration

Step-by-step guide to connecting the CAIBots Credit Underwriting Pipeline to your LOS via REST API or webhook.

Supported LOS Platforms

Native connectors available for: nCino (Salesforce-based), Finastra LaserPro / Mortgagebot, Baker Hill NextGen, FICO Origination Manager. Custom REST/webhook integration available for all other platforms. Average integration time: 3–5 engineering days.

Step 1 · Credentials

Provision CAIBots API Credentials Required

CAIBots Customer Success Engineer provisions your institution's API key pair (client_id + client_secret) for sandbox and production environments. Keys are scoped to your institution and carry your bureau permissible purpose linkage.

Request sandbox credentials via your CSE or the CAIBots customer portal at admin.caibots.com

Store credentials in your institution's secrets manager (AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault)

Never hardcode credentials in application code — strict policy enforcement

Production keys issued only after SR 11-7 validation sign-off and security review

Step 2 · Webhook or API

Configure LOS Trigger — Webhook or REST API Call

Two integration patterns supported. Choose based on your LOS capability:

# Pattern A: Webhook (LOS pushes to CAIBots on new application)
POST https://api.caibots.com/v1/underwriting/trigger
# Pattern B: Pull (CAIBots polls your LOS queue)
GET  https://api.caibots.com/v1/underwriting/pull/{los_queue_id}
# Authentication: Bearer token (OAuth 2.0 client credentials flow)
Authorization: Bearer {access_token}
Content-Type: application/json
        

Webhook pattern recommended for real-time decisioning (nCino, Baker Hill)

Pull pattern for batch environments or LOS platforms without webhook support

All traffic over TLS 1.3 minimum · Mutual TLS available for high-security environments

Step 3 · Field Mapping

Application Data Field Mapping Required

Map your LOS application fields to the CAIBots standardized schema. Field mapping configuration is YAML-based and maintained in the CAIBots admin portal. Required fields by loan type are pre-defined.

# Example field mapping (YAML) — Consumer/HELOC
loan_type:       consumer_heloc
borrower_ssn:    los_field:applicant.ssn_masked  # masked — 4 digits only
loan_amount:     los_field:loan.requested_amount
property_address: los_field:collateral.address_full
annual_income:  los_field:applicant.income_verified
loan_purpose:    los_field:loan.purpose_code
        

CAIBots provides pre-built mapping templates for nCino, Finastra, and Baker Hill

Custom field mapping validated by CSE before production activation

SSN transmitted as masked (last 4) — full SSN never leaves institution boundary

Step 4 · Write-Back

Decision Write-Back to LOS Required

CAIBots writes the decision package back to your LOS automatically upon pipeline completion. Configure write-back endpoint and field targets in the admin portal.

Decision (Auto-Approve / Auto-Decline / Route-to-Officer) written to loan status field

Risk grade (1–10) written to risk rating field

Credit memo attached as PDF to document management system

Reg B adverse action notice queued in notice management system

Exception log written to exception tracking fields

Audit log reference ID stored in LOS for examiner cross-reference

Data Source Setup

API Key Provisioning — Source Tools

Institution-credentialed access required for each data source. CAIBots never holds your bureau credentials — keys are vaulted in your infrastructure and passed at runtime.

MCO (Tri-Merge Bureau)

API · Bureau

Institution must have existing MCO relationship. Share permissible purpose code with CAIBots. Institution's API credentials stored in institution vault — never in CAIBots systems.

SBA SBSS Score

API · SBA

SBA lender credentials required. SBSS pull authorized by SBA 7(a) approval authority. CAIBots configures SBSS threshold at onboarding (default: ≥155 eligible).

CoreLogic AVM

API · Property

CoreLogic Direct API subscription required. Institution credentials vaulted. Confidence interval minimum configurable (default: ≥75%). Low-confidence routes to manual appraisal flag.

ATTOM Data Solutions

API · Property

ATTOM API subscription required. Provides deed, tax, and distress data supplementing AVM. No institution-specific credential linkage required — CAIBots platform subscription.

CoStar Group

API · CRE

CoStar institutional subscription or CAIBots platform access available. Required for CRE&I loan types. Institution may use existing CoStar relationship credentials.

GSFA / EDGAR / Finity

RAG · Financial

EDGAR is public API — no credentials required. GSFA and Finity accessed via CAIBots platform credentials. Institution uploads financial documents to secure document ingestion endpoint.

IRS 4506-C

API · IRS

Institution must be authorized IRS Income Verification Express Service (IVES) participant. Borrower consent captured at application. CAIBots submits request via institution's IVES credentials.

D&B Paydex

API · Commercial

D&B Direct+ API subscription required for commercial scoring. DUNS verification automated. Institution credentials vaulted.

Credential Security Architecture

All institution API credentials are stored in the institution's own secrets manager infrastructure. CAIBots implements a token-passing architecture at runtime — credentials are fetched from the institution's vault at execution time and never persisted in CAIBots systems. Full credential flow documentation available in the Security Architecture Supplement.

Policy Configuration

Credit Policy Matrix Upload & HITL Threshold Configuration

CAIBots operates on your institution's credit policy — not a generic model. Policy upload and HITL threshold configuration are performed at onboarding.

Credit Policy Matrix Upload

The credit policy matrix is uploaded via the CAIBots Admin Portal in Excel or PDF format. CAIBots parses the policy into a machine-readable rule set during onboarding. Policy versioning maintained — all decisions reference specific policy version at time of decision.

Policy matrix should include: FICO/score minimums by loan type, LTV/LTC maximums, DSCR minimums, concentration limits, maximum loan amounts by tier, and exception approval authority levels

Separate policy books supported by business unit (Community Banking, Commercial RE, SBA, etc.)

Policy updates processed within 24 hours — prior decisions not retroactively re-scored

Policy change audit log maintained for examiner review

HITL Threshold Configuration

HITL (Human-in-the-Loop) gates are configured during onboarding based on your institution's risk appetite and delegated authority framework. Default thresholds provided — customizable during Phase 1 calibration workshop.

# Default HITL threshold configuration (customizable)
hitl_triggers:
  policy_exception_any:     true   # Any policy exception → HITL
  risk_grade_threshold:     6      # Grade ≥6 → HITL (pass/watch boundary)
  loan_amount_consumer:    150000 # Auto-decision limit: $150K consumer
  all_commercial_loans:    true   # All SBA/CRE/ABL → HITL always
  fair_lending_flag:        true   # Fair lending signal → HITL + FL officer
  covenant_breach:          true   # Portfolio breach → HITL for remediation
  

Model Validation

SR 11-7 Model Validation Protocol

CAIBots provides a complete model validation package. Institution's Model Risk Management function conducts independent validation before production authorization.

CAIBots Provides (Model Documentation Package)

Model Development Documentation (MDD) — agent architecture, training data sources, decision logic

Conceptual Soundness Analysis — agent design rationale and regulatory basis

Ongoing Monitoring Plan — KPI dashboard, drift detection, performance metrics

Backtesting Results — shadow-mode accuracy vs manual underwriting on 500+ historical applications

Limitation Documentation — known boundaries, out-of-scope scenarios, edge cases

Parallel Run Comparison Report (generated during Phase 1–2 pilot)

Institution MRM Validation Steps

MRM Review

Review Model Development Documentation

MRM Officer reviews CAIBots-provided MDD. Validates conceptual soundness of agent design. Documents findings in institution's model risk register. Target: 5 business days.

Independent Testing

Independent Validation Testing (25-application Sample)

MRM or designated validator runs 25 historical applications through the CAIBots sandbox. Compares agent outputs to manual underwriter decisions. Documents concordance rate and material differences.

Sign-Off

MRM Validation Report & Sign-Off

MRM documents validation findings, conditions (if any), and issues conditional or unconditional approval. Approval required before production key issuance. Ongoing monitoring requirements documented.

User Acceptance Testing

UAT Protocol — Credit Officer Workbench

Structured UAT ensures the Credit Officer Workbench is validated across all loan types and user roles before production cutover.

Test Case