We Put an AI Image Model Inside the Browser

Ask an audit partner whether the team can use a generative image tool and you will get one question back: where does the prompt go? For a function that handles privileged access listings, SAP role assignments and client financials, “to a vendor’s GPU” is usually the end of the conversation — and reasonably so.

That constraint is not a reason to avoid AI. It is a reason to change where the AI runs.

GrcAI Imagine is a real diffusion model — not a template library, not a clip-art lookup. It runs inside the browser tab on your own GPU through WebGPU.

• The weights download once as ordinary static files, roughly 1.9 GB. They arrive in verified chunks, resume if the connection drops, and are cached so later sessions start in seconds.
• Every file is checked against a SHA-256 in a signed manifest before it reaches the runtime. A mismatch is refused and the cached copy is purged — there is no “continue anyway”.
• Generation happens on your device. There is no image-generation API in the product, no proxy, and no fallback that quietly sends your prompt somewhere else.
• The same seed gives the same image, so a picture in a report can be reproduced from its provenance record rather than merely described.

Turn the network off after the first download and it still works. That is the test that matters: if it runs offline, nothing is being sent anywhere.

A compliance product that oversells its AI is worse than one that ships less. So:

• It cannot spell. Diffusion models learn what text looks like, not what words are. Ask for a ServiceNow ticket and you get convincing typography made of nonsense. The product now says so on the image and points you at the renderer that does preserve exact text.
• It is not trying to beat the frontier cloud models. On raw generic image quality it will not match them, and we are not going to pretend otherwise. It is competing on a different axis: your data never leaves the tab.
• Nothing it produces is evidence. Every image carries an AI-GENERATED IMAGE — NOT AUTHENTIC EVIDENCE band, and the exported metadata records the model, seed, steps and an authenticEvidence: false flag.

Because the image model cannot render legible text, the parts of the job that depend on text are handled by a deterministic renderer instead. The Visual Intelligence Studio draws SAP SM19, SM20, SU01, SUIM, PFCG and STMS, ITGC and change-management workflows, control lifecycles, audit lifecycles, architecture diagrams and executive infographics — as vectors, with every field exactly as typed.

It also builds a risk register you type yourself into a risk-and-control matrix and a 5×5 heatmap, with inherent and residual scoring computed by published factors rather than guessed by a model. Same arithmetic every time, which is what makes it usable in a working paper.

Two engines, one honest split: vectors when the words matter, diffusion when they don’t.

Open the assistant, choose Data Extraction & Generation, and scroll to the GrcAI Visual Intelligence Studio. Diagrams render instantly with no download at all. If you want a photographic image, General Creative → Create an Image offers the one-time licensed model download first.