What must a firm be able to show before it lets an agent act?
Witold Reichhart · witold.reichhart@capgemini.com
The map says what a firm needs in place. The reference model says what the firm must be able to show for it, at each level of autonomy it grants, so that the head of model risk, the CRO, and the chief data officer can hold an agentic programme against one model, in the vocabulary of the inventories they already keep. The model is an outline under review by its two authors, with a first version planned for the fourth quarter of 2026, so every level and every condition here is a proposal.
About 12 minutes. → or the space bar moves on, and through the steps first where a slide builds in steps. Click a line on the left to go straight to that slide.
M opens the contents, F finds a word, and T switches between light and dark.
Then the workshop, where a room marks the map in two rounds, and the research page for the papers the model rests on.
A firm that runs a vendor’s model on a hyperscaler usually cannot inspect the model, and will rarely be allowed to. It can decide, at the moment an act commits, whether that act is defensible on the evidence it rests on. So the model governs the act.
At the moment of commit: is this act defensible on this evidence? The agent’s profile is an input to the classification, never the thing that decides.
The head of model risk, the CRO, and the chief data officer, with the people who take an agentic programme past them. Written in the vocabulary of the inventories they already keep.
It states what must be demonstrable, so it reads the same on a vendor platform, on a hyperscaler, or on what the firm builds. It certifies nothing.
An element that cannot fill all five is published as guidance. The instruments are what an examiner can test.
The US model risk guidance of April 2026, SR 26-2, leaves agentic AI out of its scope and tells banks to govern it with their own risk management. The model is one way to write that risk management down. Source: SR 26-2, Federal Reserve, OCC, and FDIC, 17 April 2026.
A bank or an insurer already answers to a risk framework, a management system, and a law. Each keeps its own requirements. The reference model organises the controls and the evidence once, beneath all three.
Govern, map, measure, manage. Risk identified, evaluated, and treated.
Policy, roles, evidence, review, improvement. AI management made accountable, and audited like any other management system.
The use and the firm’s role decide the duties. Annex III lists the high-risk uses, among them credit scoring of individuals and life and health pricing.
The model adds two columns to the inventory a firm already keeps: the level of autonomy in force for each agent, and the evidence still missing for it.
Sources: NIST AI 100-1, AI Risk Management Framework 1.0, January 2023; ISO/IEC 42001:2023; Regulation (EU) 2024/1689, Annex III.
Networking defined the term first: the control plane instructs, and the management plane monitors and configures. In a regulated firm the decision is the regulated act, so a layer that only observes discharges no obligation, and a layer in the path that can refuse does. This model uses the term in that sense.
Inventories, dashboards, traces, evaluations, cost reports. Each tells the firm what happened, after it happened.
The mandate w3 and the check w4 and p4, joined to the record w5 and the loop w6. Each can stop an act before it commits.
Source: RFC 7426, Software-Defined Networking: Layers and Architecture Terminology, January 2015.
Each essential of the map gets one question, and the evidence that answers it. The check reads what the first three hold; the record and the loop remember, and learn.
validated as one unit · evaluated against error limits · tested after every change · able to be stopped
sources with named owners · the version in force on the date that matters
one named owner · scope, limits, expiry · who may withdraw it
identity, release, basis, mandate, the exact act, the current state with its cumulative limits · permit, block, or refer
the decision linked to its receipt · a way to recover
benefits and harms against the baseline · the evidence for the next level
The questions become reusable through the control requirements, the record of each act, the evaluation methods, and the mapping to each platform.
Where an act is intercepted, and what is read there. No person can sit in every act, so the check runs at machine tempo.
the agent states the exact act, its scope, and its basis
identity, and the act inside the mandate in force
the basis applies and meets the bar for the act’s tier; the authority is in scope; the route is admissible. It halts on any one that fails.
below the bar there are two exits: block, or refer to a named person
the decision recorded before the act runs, the receipt linked after it
A permit is for one exact act, bound to the mandate version, the release, and the basis the agent declared, and it expires. It is void once the mandate narrows, once the agent’s identity is revoked, or once the act changes in amount, counterparty, or basis. Every act carries one operation id, so a retry acts once, and an act whose outcome is unknown is reconciled with the receiving system before anyone retries by hand.
The capacity held by permits in flight counts against the limit, so acts that each sit inside their mandate cannot together breach it.
The model grades evidence on four levels, each stated as what must be true of the agent’s record. K2’s label is still open.
Every act carries evidential warrant and a named authority in scope, is graded to a consequence tier, and has a signed manifest bound to its basis. The check computes admissibility for each act, and refuses below the bar with no person in the path.
Someone who did not run the agent rebuilds a period of its acts from the record alone, in a set time, and reports what could not be recovered. Decisions carry reason codes, provenance is recorded at the source, and the second line samples.
Every act recorded with the agent’s identity, the principal, the time, the mandate version, and the check’s decision, append-only, with retention set. The agent is in the inventory with a named owner, and its outcomes are measured against a test set owned outside the team that built it.
Acts appear in application logs, with no act attributed to an agent identity, no principal named, and outcomes known by report. Where most pilots we have seen are today.
Each level of autonomy needs a level of evidence. Most firms we have seen can show K1, which licenses A.1 and A.2; the value above the line is value the models could deliver and the firm may not take.
Where an act cannot be undone, the evidence it needs rises one level. An A.2 agent that can settle a payment runs at K2, or under override.
Signed by a named executive, scoped to named classes of act, dated, and expiring, and reported to the body that can refuse, named before it is needed. Running A.3 on K1 happens; the model does not bless it.
A ceiling, the law, a confirmed sanctions match, a release without validation, or a shared identity.
The autonomy levels follow Kasirzadeh and Gabriel’s agentic profiles (arXiv 2504.21848, 2025). The evidence levels and the rule between them are the Hub’s proposal, under review, and not yet shown to predict acceptable risk.
Authority flows down the map and changes form on the way: a ceiling at the enterprise, a mandate in the workflow, entitlements and controls on the platform.
An entitlement lets the agent reach a system. A mandate says what it may do there.
The rights that move authority are approve, challenge, suspend, restore, and grant an exception. A challenge from the second line holds a widening while it is open, and the narrower position holds until it is decided.
The model lists, for each agent, the conditions its level of autonomy requires that are not yet met, and marks which of them block. It lands in the inventory the firm already keeps, as a column beside the agent’s profile.
The assessor did not run the agent: the second line, internal audit, or the client’s risk function. The owner is an executive. The list is reviewed monthly and tested again at every claim of a higher level; the count tracks the work, and a blocking condition decides the level.
The model in a project team’s hands: what the team agrees before its agent acts. Each answer needs an owner, a place where it is implemented, and evidence that it works.
Revisit the answers when the system changes, and before anyone proposes wider autonomy.
The map turned on its side. Each essential carries a contract: the call it answers, what it is keyed on, and one invariant a test can break. Independence from any platform is a property of the contracts, and each stack is a binding to them.
whoami() → agent, principal, releaseagent id · release versionholds no credential for a system that moves moneyresolve(question, case, as_at) → source, version, ownersource · version · as-atevery source has an owner and answers as-atmandate(agent, as_at) → version, level, limits, conditions, ownermandate id · versiona rule may narrow it; only the owner’s signature widens itdecide(act, as_at) → permit | block | refer, reasonsact id · payload hash · as-atnothing consequential runs before its decision is recordedappend(event) · query(agent, release, mandate, case, from, to)mandate version · release versionappend-only, and the agent’s identity cannot write to itrule(stream) → narrow(mandate) · review() → widen(signed)rule id · review idnarrowing is automatic, by a rule with a named owner; every widening is signedlist(kind, as_at) → objects, owners, versionsobject id · versionrecords configuration and decides nothingThe signatures are a first proposal. A product that ships one of these contracts natively becomes a binding to it.
An outline under review by its two authors, with a first version planned for the fourth quarter of 2026, and a new version each year on the evidence that comes back.
A workshop marks one workflow, one legal entity, and one environment, alone first and together after, and keeps both rounds. So the research can tell what a room believed from what it established.