Part two · Licence to Act · the interactive map
1 / 1
Licence to Act · Capgemini Financial Services · AI Enterprise Hub · October 2026 · witold.reichhart@capgemini.com
04
The control plane map · part four

Your firm: who holds which right, and how to start

The map, the decision, and the essentials, turned to the firm that has to run them: the rights over authority, the three lines, the estate, the law, the people, the value, and the first workflow.

RightsThree linesThe estateThe lawThe peopleThe valueHow to start
The estate

One agent, three platforms: one identity, one kill path.

Each platform brings its own control plane, for its own agents. The decision belongs to the firm, so the identity, the mandate, the check, and the record are kept above the platforms, with one owner each.

The firm, across every platform
Agent register and identitye1 · p1 · the CISOThe mandate servicew3 · the business ownerThe checkw4 · p4 · in the path of every actThe recordw5 · one line per act, on any platform
Cloud platform Aits identity, federated to the firm’sits gateway and toolsits traces, keyed to the recordits own kill switch
Cloud platform Bits identity, federated to the firm’sits gateway and toolsits traces, keyed to the recordits own kill switch
The business suiteits identity, federated to the firm’sits connectors and actionsits logs, keyed to the recordits own kill switch
The kill path
  1. Revokethe CISO revokes the agent’s identity once, at the firm
  2. Tokensevery platform stops accepting them within the token lifetime, fifteen minutes in the manifests, or at once where it checks revocation online
  3. Permitsthe check voids every permit issued to that identity
  4. The queueacts already waiting go back to people
  5. The recordshows the revocation and every refusal after it
Tested, not assumedEvery quarter, on every platform, a test tries to act after revocation, and the record shows that it failed.
Nothing in flight escapes the re-checkA permit is void once the identity is revoked or the mandate narrows. Queued acts go back through the check; an act already past the commit is reconciled from its receipt.
Outcome unknownEvery act carries one id. The receiving system is reconciled before anyone retries.
Where data may goA residency rule binds the gateway, p1, for the model call and the check, w4, for the act: a call that would send data out of the region is refused at either.
The permit

From the proposal to the receipt: a permit is neither a send nor a receipt.

The check decides before the act, the engine executes it, and the record holds all three. Between the permit and the commit the world can change, so the engine reads the permit again before it acts.

1
The proposal

The agent assembles the act and declares its basis: the versions it read, the mandate it acts under, the exact act.

w1 · w2
2
The check

Six inputs: identity, release, basis, mandate, exact act, current state. It permits, refers to a person, or blocks. There is no other route to the system of record.

w4 · p4
3
The permit

Bound to four things: the mandate version, the release, the basis version, and the exact act. Valid for the next commit, and void the moment any of the four changes.

w3 · w4
4
The commit

The engine reads the permit again against what is in force. Void: back through the check. Good: it executes once, under one id, and nothing executes without a permit.

p3 · p4
5
The receipt

Into the record, beside the permit it answers. Outcome unknown is reconciled from the receiving system before anyone retries.

w5 · p5
A sidecar beside the agentSees everything the agent declares and nothing the engine does afterwards, so the commit re-check stays with the engine.
A gateway in the path to the system of recordEvery call that crosses the boundary to the system of record passes it, whatever runs the agent. It must read the mandate service and the basis versions, and it adds its time to every call.
A step in the orchestration layerNatural where a workflow engine already hands referrals to people. Blind to any call that bypasses the workflow.
Inside the system of recordThe only place that binds permit and commit in one transaction, and the hardest to change: it has to learn to read a mandate version.

Wherever the check sits, there is no route to the system of record except through it, and the engine reads the permit again at the commit. The join underneath both is a mandate service the check can query.

How to start

Start with one workflow, and one agent that recommends first.

One workflow, with business, risk, and technology in one room
  1. Build one scenario togetherAn agent, a decision, and the act it might take, walked across the map.
  2. Mark every boxNot in place, designed, operating, or evidenced; unknown and disputed are kept as they are.
  3. Test the connectionsDoes the check read the current mandate? What happens when information is wrong? Who changes authority?
  4. Agree the first stepOwners, dates, and what stays “not yet”.
By day ninety, as a targetone workflow within agreed limits · one consequential act checked, by the gate or by a person · a referral queue with an owner · one review rule tested from trigger to decision
A first agent
Before the pilota named ownerthe mandate drafted as dataits own identity, never a person’s accounta record of every proposal, with its versionsan evaluation run by people who did not build it
May wait, with a datethe automated check, while it only recommendsthe return path from the recordfunding to widen
Never, once it actsa shared credentiala route to the system of record around the checka widening based on its own traces