About
Blake Medulan
Technology and AI Sherpa at 3 Halves Labs. Twenty-five years leading global enterprise technology teams, working as a digital transformation and AI architect. Based in Markham, Ontario.
Why this exists
Canadian federally regulated institutions have no shortage of control frameworks. What they tend to lack is evidence — the kind somebody outside the team can check without taking the team's word for it.
The usual arrangement is a control attested quarterly by the people who operate it, recorded in a GRC platform that is itself trusted, and reviewed by someone with no practical way to reproduce the finding. Every step is reasonable. The result is a chain of assertions with no point at which anyone can independently confirm anything.
osfi-gate takes the opposite position: the evidence should survive not being trusted. A
gate run records what it saw, what policy it applied and what it decided, signs it, chains it,
and makes the whole decision replayable offline. If the tool that produced it disappeared
tomorrow, the evidence would still check out.
That constraint is what shaped the design, and it is also what rules things out. It is why approvals happen in Git rather than in a web form, why the tool refuses to report "unknown" as "passing", and why there is no hosted service that would require sending you evidence you were told you did not have to trust us about.
What is on this site
- The live demo — a console over a year of evidence for a fictional Canadian bank. Twenty-eight repositories, 1,418 gate runs. Nothing in it is real, and it says so on every page.
- Verify it yourself — what verification actually checks, and what it does not.
- Controls — the 23 controls in the reference policy, what blocks and what only warns.
- Free tools — the E-23 model risk tool, which runs entirely in your browser.
- The roadmap — what has shipped, by milestone, and what has not.
Getting in touch
For a walkthrough, a pilot on your own estate, or an awkward question about any of the stated limits — email is the fastest way to reach me.