Every box has an owner; the boxes where authority changes need rights as well
Every box on the map has an owner. The boxes where an agent's authority can change also need rights: the ceilings, the control standard, the investment decision, the release, the mandate, and narrow or widen. The rights decide who may move it: approve, challenge, suspend, restore, and grant an exception. The table gives the firm's defaults, and the case chosen above renames them.
A challenge holds a widening, and one still open after ten working days goes to the board risk committee. Some things no one overrides: a ceiling, the law, a confirmed sanctions match, a release without validation, a shared identity. And when the lines disagree, the narrower position holds until the committee decides.
The consequence table: tiers declared by the firm, read by both rules
The firm declares the consequence table itself, at the control standard beside the ceilings, under a named authority and with a version, and the knowledge layer applies it. A classification that decides how strictly an act is gated cannot be an output of the thing gated, and the table is the set's answer to it. The tiers are routine, material, and critical. What classifies an act into one of them is written in the first column: what it is, the money band, the effect on a customer or a third party, whether it can still be recalled, whether it crosses a border or leaves the firm, and what it counts toward. The bands follow the case chosen above; a firm writes in its own.
Both rules read the row, and neither borrows the other's words. The first rule keeps its ladder: at the routine tier an agent decides, A.3, at K2; at the material tier it decides at K3, and only while the act can still be recalled; at the critical tier it never decides, and a person with the authority does, with the record naming both. An irreversible act asks one level more, as part three says. The second rule keeps its two axes: a routine act commits on premises at warrant validated, each with a named authority behind it; a material act needs its weakest premise corroborated from an independent origin and the binding source for the claims that bind; a critical act rests on claims read from the source at the act and confirmed by a person who holds the mandate to confirm them. And every act carries its tier and the table's version on its record line. So an examiner reads the bar the act was held to, and who set it. A referral changes who decides, never the tier.
The three lines, on the map
The three lines of defence, placed on the boxes. The first line runs: the business owner and the platform teams. The second line sets and challenges: the CRO, compliance, and model risk, which validates the release and the evaluations. The third line assures and reperforms from the record. The map shows which boxes each line touches. And where two lines touch the same box, the rights table decides.
One agent, three platforms: one identity, one kill path
A firm with three platforms has three control planes for three sets of agents, and one agent that spans them. So the agent register and identity, the mandate service, the check, and the record have to sit above the platforms. The kill path is tested every quarter by an act attempted after revocation. Nothing in flight escapes the re-check: a permit dies with its mandate or its identity, a queued act goes back through the check, an act already past the commit is reconciled from its receipt, and an outcome unknown is reconciled before the day ends. A residency rule binds the gateway for the model call and the check for the act.
From the proposal to the receipt: a permit is neither a send nor a receipt
The declaration, the check, the permit, the engine, and the receipt separate an agent's idea from a fact in the world. The agent assembles the act and declares its basis: the versions it read, the mandate it acts under, the exact act. The check reads its six inputs and permits, refers, or blocks, and there is no other route to the system of record. The permit it issues is bound to the mandate version, the release, the basis version, and the exact act, and it is valid for the next commit only. Then the engine, which holds the credential to act, reads the permit again against what is in force at that second. If any of them has moved, the permit is void and the act goes back through the check; if not, the engine executes once, under one id. And the receipt goes into the record beside the permit it answers, so that a permit, a send, and a receipt are three different lines, and an outcome unknown is reconciled from the receiving system before anyone retries.
Where the check sits is the architect's question, and the honest answers are a sidecar, a gateway, a step in the orchestration layer, and the system of record itself. A sidecar beside the agent sees everything the agent declares and nothing the engine does afterwards, so the re-check at the commit stays with the engine. A gateway in the path to the system of record catches every call that crosses the boundary to it, whatever runs the agent, must read the mandate service and the basis versions, and adds its time to every call. A step in the orchestration layer is natural where a workflow engine already hands referrals to people, and blind to a call that bypasses the workflow. Inside the system of record is the only place that binds permit and commit in one transaction, and the hardest to change. Whichever it is, the same holds: no route to the system of record except through the check, and the engine reads the permit again at the commit. The join underneath both is a mandate service the check can query, which is the first of the three joins.
What the law asks of each essential, and when it applies
The duties, each with the instrument, when it applies, the cases it touches, the boxes it lands on, and the evidence. GDPR Article 22 and the court's reading of it. Articles 15 to 17. The AI Act's high-risk list, and Articles 4 and 50. DORA. The EBA guidelines on restrictive measures. The second Consumer Credit Directive, for agreements concluded from 20 November 2026. The EIOPA opinion.
Every box code is a chip: hover a code and the map shows its box; hover a row and every box the duty lands on lights. The duties that do not apply to the chosen case are struck through with the reason. Dated, and not legal advice.
On the day the mandate narrows, the work comes back to people
The loop has a human cost. On the day the mandate narrows, the work the agent did comes back to people: from a few staff hours a day to many, in the figures of the case. So the people need authority at least as wide as the agent's. A referral has to be a packet a person can act on. The fallback is written in advance, with a deputy and an expiry. And staff representation, the works council or the CSE, is consulted before the pilot.
Count the cost of control, and only the saving that reaches the accounts
The business case, counted honestly. The planned figure, then what remains if a referred decision saves nothing and referrals double, then what remains if only 30 percent of the saving is realised. The cost of control is shown apart from the run cost. So nobody mistakes it for the agent's cost. Funding follows evidence. And a retirement test sits at the investment decision: an agent that no longer earns its evidence is stopped.
Start with one workflow, and one agent that recommends first
Start with one workflow, and one agent that recommends before it decides. The workshop's path, step by step. What day ninety looks like. And the lists for the first agent: what must be in place before the pilot, what may wait with a date against it, and what can never wait once the agent acts. The explorer and the workshop take it from here.