Kenshiki does not replace the lender's decision. It asks bounded questions of approved source environments and returns a record a reviewer can inspect.
The decision, not the data
A better file only matters if the decision holds up across reviewers.
The hard part of credit is not collecting more data. It is making a decision that holds up — the same way, for the same applicant, no matter who reviews the file or when. Human judgment alone does not do that consistently, and a single score does not give a reviewer enough to decide well.
55%underwriting judgment varied by reviewer
In a study of underwriting judgment, the premiums different underwriters set independently for the same customers varied by 55% — the same person could be quoted very differently depending only on who caught the file. Inconsistency like this is a fairness and credibility problem before it is a pricing one.
In a 2026 field experiment, loan decisions improved when the reasoning behind a recommendation was disclosed — reviewers could see when a rationale was internally inconsistent, and their overrides became more selective and more effective. The conclusion: a decision is stronger when the evidence can be opened and checked.
Most institutions already have AI governance on paper. Far fewer can prove it when it counts. In a benchmark survey of 500 financial-services leaders, only 21% were very confident they could produce complete, auditable evidence of how an AI-influenced decision was made: the exact record an examiner, auditor, or court asks for.
Kenshiki is built for exactly this. We do not hand a reviewer a number to trust. We return a bounded, corroborated record they can inspect, explain, and replay — the same evidence, defined in advance, applied the same way every time. The reviewer still decides. They just decide on something that holds up to an examiner.
Consistent input. Inspectable reasoning. A decision you can explain.
Proof without possession
The claim can be forged in a file. The source pattern is harder to fake after the fact.
The lender needs a reviewable answer, not a new warehouse of raw private data. Kenshiki sends narrow questions to approved source boundaries and records only the bounded result.
Proof moves. Raw data stays put.
Raw journey stays with sourceOnly the bounded result returns
Ask
What needs to be true?
Kenshiki sends the smallest possible evidence question.
Compute
The source answers on its side.
The provider checks against consented data without sending a raw feed.
Return
Only the bounded result comes back.
The answer can support, weaken, or contradict the file.
Record
The boundary is visible.
The reviewer sees what was checked and what Kenshiki did not take.
How corroboration works
Bring the question to the source. Bring back bounded proof.
Every check follows the same pattern: ask only what the credit decision needs, preserve the source boundary, and seal what came back into a reviewable record.
01
Ask a bounded question
Each check asks whether the claimed person, place, obligation, and continuity hold together for the decision in front of the lender.
02
Keep data with the source
Providers compute on their side and return a bounded result. Kenshiki never ingests more detail than the question requires.
03
Seal a reviewable record
The lender opens a record of evidence, reason codes, gates, and the raw data Kenshiki deliberately did not take.
The coherence cascade
Four test levels, one sealed output.
Each application traverses four nested tests before a coherence score is produced. A fail at any level raises a typed flag with the archived decision path; only a full pass yields the signed packet the reviewer opens.
Evidence architecture
Seven corroboration axes, one consented identity gate, one reviewable record.
Each axis tests one slice of whether the file and the life behind it cohere; uncertainty stays visible.
No single signal proves a life. Several bounded source patterns can show whether the story holds together, while validation measures how independent those patterns really are.
Gate
eCBSV identity gate
Consent-based SSA match/no-match verification before corroboration.
A match is necessary but not sufficient; it is not proof of a coherent life.
01
core
Score-back presence verification
Spatiotemporal presence
Asks a provider-side area-and-time question without acquiring raw location data.
Example
The life has a durable footprint.
Separates
A real but quiet file from an identity assembled for one transaction.
Boundary
Kenshiki does not buy, ingest, or store raw location trails.
02
core
Carrier attestation
Carrier-attested telecom
Checks whether line tenure and device signals cohere with the claimed identity.
Example
The number behaves like it belongs to the person.
Separates
Seasoned personal continuity from newly assembled contact infrastructure.
Boundary
Carrier signals corroborate continuity; they do not expose message content.
03
core
Identity and consumer data graph
Address and residency
Checks whether address and residency signals support the claimed life pattern.
Example
The address behaves like a residence, not just a field.
Separates
A real residence from a mailbox, borrowed address, or thin surface match.
Boundary
Residency corroboration supports context; it is not lifestyle scoring.
04
core
Payroll verification
Income at source
Checks whether income evidence can be verified at an authoritative source.
Example
The claimed income has a source-backed trail.
Separates
A stale risk snapshot from a materially recovered income picture.
Boundary
Income evidence supports capacity review; it is not an automatic approval.
05
core
Open banking
Open-banking cash flow
Checks whether account history supports the rhythm of the requested obligation.
Example
The payment rhythm has recovered.
Separates
A bounded hardship from an ongoing inability to support the obligation.
Boundary
Cash-flow fit avoids merchant-level storytelling and stays bounded to evidence.
06
core
Identity resolution
Identity-element trace
Tests whether identity elements have a seasoned, continuous history.
Example
The identity has history, not just matching fields.
Separates
A valid-looking profile from a lived identity with durable history.
Boundary
Identity continuity complements eCBSV; it does not replace consented verification.
07
candidate
Behavioral biometrics
Behavioral biometrics
A candidate signal for human-interaction and device-consistency checks.
Example
The session behaves like a person, not a script.
Separates
Human application behavior from scripted or ring-linked activity.
Boundary
This is candidate scope and must remain status-labeled until approved.
Kenshiki-built signal
Kadai SDK & API
The SDK records a behavioral-biometrics session during the application flow and returns a token.
Raw biometric data stays on device; Kenshiki receives a session token, not the typed content.
The customer API returns the already-sealed evaluation; it does not re-decide the file.
Presence can be checked without turning into surveillance.
The decision may need to know whether presence fits the declared region. It does not need a street-corner trail.
Kenshiki sends the bounded question; the provider checks presence on its side. Raw location never enters our system.
Provider layer
Providers mark proof boundaries, not logo coverage.
Each provider defines what can be checked, where computation happens, and what evidence can be returned without pulling raw source data into Kenshiki.
The evidence layer
Built on corroboration signals lenders already trust
Kenshiki binds independent corroboration signals into the decision record. Named providers stay review-gated until
the integration is real and public naming is approved.