AI @ Santander: the good, the bad & the ugly

Most write-ups of “AUX in the wild” cheat: they grade a product that was already built to the checklist. This one doesn't. Santander AI Lab's public portfolio — synthetic fraud-graph generators, fairness auditors, an LLM governance framework, a guardrail-search harness, and an agent that runs other agents in a loop — was not designed against any of the six AUX patterns or ten heuristics. Nobody on that team was thinking “Intent Handshake” when they set a default flag.

That is the value. Agentic experience design shows up most honestly in systems that were never built to its vocabulary. It doesn't live in the marketing; it leaks out as defaults, as the boundaries a team chose to make mechanical rather than advisory, and as the things they decided to make impossible. Read fourteen repositories that way and you get an unusually candid X-ray of how a regulated institution actually thinks about trusting machines.

A caveat that matters before the verdicts. AUX is a discipline for interactive agent products — systems that hold a relationship with a user over time. Most of this portfolio is infrastructure and research: libraries, datasets, training harnesses. You don't grade a fairness library on its undo button. So we tested the six genuinely agentic repos hard against AUX, and judged the rest on the slice that applies — whether an agent can discover, understand, and safely operate them, and whether they expose trust signals like provenance and calibrated uncertainty. Where a pattern simply doesn't apply, we say so, instead of inventing a deduction.

Quick legend, since we'll use it throughout: the six patterns are Intent Handshake, Confidence Cues, Adaptive Canvas, Escape Hatch, Memory in Motion, Generative Momentum. The ten heuristics (H01–H10) run intent visibility, progressive transparency, steering, dynamic trust, autonomy boundaries, graceful uncertainty, assertiveness, context efficiency, multi-actor clarity, behavioral consistency.

The Good

mech-gov-framework is AUX-as-code — and never says the word.

mech-gov-framework is the closest thing to AUX-as-code in the entire org. Its thesis is a research question: can you govern an LLM's high-stakes decisions with text instructions alone (regime R1), or do you need mechanical enforcement (regime R2)? R2's pipeline reads like H05 and H06 compiled into Python: hard gates → an entropy commit step → candidate freezing → an argument-quality check → an ambiguity gate → reveal. The team even ships metrics that measure exactly what AUX cares about and most teams never instrument: CDL, a cosmetic-deadlock rate — is the governance real or theater? — and DIU, deferral-information utilisation — when the system is allowed to defer, does it actually use that option, or does it bluff a decision? That is H06 (“when unsure, ask, escalate, or return a partial result — don't hallucinate”) turned into a number you can put on a dashboard. If you read one repo from this portfolio, read this one.

ralph-vault-skill — the best-behaved tool in the set.

ralph-vault-skill is a CLI plus skill for maintaining a tiered “deepwiki” knowledge vault for agent loops, and it quietly does four AUX patterns correctly: an explicit Intent → Action → Load router table, so the agent loads only the reference document for the task at hand — that's H08 (Context Efficiency) and progressive disclosure as a literal control-flow table; a hard autonomy boundary stated more crisply than most production agents manage — “the agent only runs deterministic CLI actions and never authors content; after `plan`, the agent's turn is done”; provenance as memory, where every generated doc is stamped with its source commit and last-sync and changes are logged — Memory in Motion done the responsible way, transparent and auditable, not an opaque vector store; and a validate-before-done gate where nothing is “finished” until a deterministic validator reports zero errors.

autoguardrails nails Agent Process Design.

autoguardrails is a guardrail-search harness inspired by Karpathy's autoresearch: keep the mutable surface tiny (one policy.md), the evaluator fixed, the budget capped. Its human-owned program.md reads like an AUX operating contract — “non-negotiable constraints” that bound what the agent may touch (H05), an append-only results.tsv decision log so every keep/discard is attributable (H09), a benign-pass floor so the system can't win by simply refusing everything (a beautifully calibrated take on H07 assertiveness), and explicit graceful-failure guidance: “if repeated runs are unstable, discard the candidate and investigate the harness before continuing” (H06).

Three cross-cutting wins worth stealing. First, AGENTS.md as a first-class artifact: auto-bayesian and linear-adapter-trainer ship agent-facing repo rules that open with an ## Intent section and include lines like “avoid hidden behavior and side effects” and “keep defaults deterministic.” Predictability-as-trust is the bedrock AUX is built on, and these two write it down for the machine reader. Second, Confidence Cues in the model libraries: auto-bayesian emits readable conditional probability tables — P(Converted = 1 | Source = referral) = 0.85 — instead of a black-box score; causal-perception-implementation returns bootstrap confidence intervals; genetic-algorithm forces you to make “better” an explicit, swappable fitness function. That's Pattern 02 by construction. Third, an org-wide H09 baseline: every repo carries CODEOWNERS, NOTICE, CITATION.cff, and SECURITY.md, backed by a central cla repo and an org GOVERNANCE.md — consistent attribution and ownership, exactly what multi-actor clarity asks for.

One honorable mention for sheer alignment of intent: sota-stressed-datasets exists to republish benchmark datasets in deliberately stressed form — noise, missingness, ambiguity, contradictions. It is, in effect, a test rig for H06 in other people's systems. A bank shipping robustness stressors as a public good is the AUX worldview applied one level up.

The Bad

Real, fixable gaps — the review kind, not the blocker kind.

Almost no Intent Handshake, and almost no dry-run. Across the portfolio, --dry-run / preview shows up in essentially one repo. The tools that generate or mutate — the fraud-graph generator, auto-bayesian, the mech-gov runners — simply execute. For tooling that carries a bank's name, a preview-before-cost step (Pattern 01, H01) is the cheapest trust upgrade available, and it's mostly absent.

llm_bridge — the literal “agentic API” of the set — under-surfaces trust signals. It's a clean vendor-neutral client for OpenAI, Bedrock, and Gemini, and its normalized LLMResponse carries content, token usage, latency, and finish_reason. What it does not carry is a structured refusal / safety-stop / confidence signal. So every agent built on top has to re-derive “the model declined” or “the model was unsure” per-provider, by hand. One normalized field here would hand Confidence Cues and graceful uncertainty to every downstream consumer for free. This is the single highest-leverage line of code in the portfolio.

Memory in Motion is unimplemented where it would matter most. ralph's “memory” is whatever the agent happens to write into the workspace between runs — implicit state, not the transparent, editable abstractions about the user and task that Pattern 05 describes. ralph-vault is the honorable exception, but its memory is about repositories, not the working relationship. And trust never gets to be dynamic — nothing adapts its verbosity or autonomy as a relationship matures (H02's transparency→summary→silent trajectory, H04's cautious-newcomer→trusted-veteran arc). Understandable — none of these are long-lived assistants — but worth naming, because it's the difference between a tool and a collaborator.

Finally, two of the six patterns are simply absent: Adaptive Canvas and Generative Momentum. There is no human-facing generative surface anywhere in the portfolio. That's not a bug; it's a portrait. This is an infrastructure and research body of work, not the AI Product Experience leg of AUX. The interesting question for Santander isn't “why no Adaptive Canvas” — it's “what happens when one of these governance cores finally gets a face.”

The Ugly

ralph ships maximum autonomy as the default.

There's one, and it's instructive precisely because the team was honest about it. ralph is the agent-runner: it launches a coding CLI — Codex, Claude Code, Gemini CLI, or Devin — feeds it a prompt, and runs it in a loop, fresh session every iteration, unattended, “keep working until it's done.” Useful. The problem is what it passes by default:

codex  → --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check
claude → --permission-mode bypassPermissions
gemini → --approval-mode=yolo --skip-trust
devin  → --permission-mode dangerous

Read against AUX, that fails the core heuristics at once. There is no Intent Handshake (Pattern 01). It is the inverse of H05 (Clear Boundaries of Autonomy) — the autonomy isn't ambiguous, which is the failure mode H05 warns about; it's “everything, always,” which is worse because it's deliberate. And the only Escape Hatch (Pattern 04) is a stop.md file checked between iterations — so there is no mid-iteration stop, and with the sandbox disabled a single iteration can do arbitrary, irreversible damage before the loop ever looks up.

Credit where due, because it changes the diagnosis: ralph is honest. The flags literally contain the word “dangerously.” It writes timestamped audit logs. Fresh-session-per-iteration genuinely does bound the blast radius of any one pass. It is a developer power-tool, not a consumer surface, and its users are adults. None of that makes “all guardrails off” the right default. In AUX terms, a default is a trust statement — it's the posture you've decided you're comfortable shipping to someone who never reads the docs. Shipping disabled-by-default sandboxing under a bank's brand is the riskiest single choice in the portfolio, and the fix is almost insultingly small: make the gated mode default, and require an explicit --yolo / RALPH_DANGEROUS=1 to opt out. Same capability, inverted trust default — a question of where you put the action on the Action Heat Ladder.

A smaller blemish in the same repo: it mixes languages. The README is English; CLAUDE.md and every entry under skills/ (juez, maestro, juzgar, auditar) are in Spanish. For an agent — or a contributor — reading the repo cold, that's an avoidable hit to legibility and behavioral consistency (H09/H10).

Scorecard

The portfolio, graded.

●●● strong · ●● partial · ● minimal. AUX fit = how much the discipline even applies.

¹ mutatis-mutandis, causal-perception-implementation, gen-fraud-graph, sota-stressed-datasets. Every repo named here was verified against the public SantanderAI GitHub organization on 24 June 2026.

Three fixes

In priority order.

You do not learn a team's real trust model from its governance framework. You learn it from its defaults.

The takeaway

Defaults are the design.

The most AUX-native lesson here isn't in any one repo — it's in the spread between two of them. mech-gov-framework is an entire research program devoted to proving that text-only governance is insufficient and that trust has to be made mechanical: gates, freezes, ambiguity checks, deferral you can measure. ralph, built by the same lab, ships the exact opposite as its out-of-the-box posture: text says “dangerously,” and the machine complies, unattended, with the sandbox off.

Both can be true in the same organization, and that's the point for anyone evaluating agentic systems — including the procurement readers this is partly for. The framework is what they argue for; the default is what they actually ship to the person who never changes a flag. When you're assessing an agentic vendor, skip the trust page and read the flags: what happens when nobody's watching, what the system can do before it asks, and how loud the path to “off” is. That gradient — which actions are cool and which are scalding — is exactly what the Action Heat Ladder exists to score, and where a system's trust architecture either holds or doesn't.