AI agent governance
Who can authorize an agent, who watches it, and who answers when it acts? Follow the rules and records that make delegated work accountable.
Read this topic as JSON → Same coverage, ready for agents.
A guide to the coverage
This guide connects coverage of oversight, shared standards, and the boundaries of delegated authority. Compare the permission an agent receives with the evidence it leaves behind. A stated policy, an enforceable control, and a record of what happened answer different questions; read for all three.
Questions to bring to the reading
- Who grants authority, and where does it end?
- Can another party reconstruct the decision?
- Who checks the monitor?
Start here
-
Frontier AI outran the patch queue. The FCA's answer was a clearinghouse, not a rule.
Start with the coordination problem: what can firms share when a rule alone is not enough?
-
Who Monitors the Monitor: The FSB Just Made Oversight an Agent's Job
Then examine accountability when one agent supervises another.
Latest in this guide
- NIST's agent-identity build starts in a software factory. The advisor-to-custodian hop isn't on its schedule.
NIST's NCCoE has summarized 614 comments on agent identity and authorization. Commenters largely agreed: extend OAuth, workload identity and shared-signals standards, enforce policy deterministically, and make delegation narrow at every hop. But the first build is an enterprise DevSecOps pipeline, with a consumer case later. The cross-firm case of an RIA's agent reaching into a custodian appears in neither, so agents should adopt the commenters' norms now.
- Advisor agents can only see the vendors that agreed to share. Betterment says an MCP release is coming.
Kitces counts 11 connectors in Claude for Financial Advisors and a longer list of planning tools and custodians that are not connected. Betterment Advisor Solutions now says its document data will reach agentic workflows before year-end, with an MCP release to follow. Each vendor that joins moves the edge of what an advisor agent can see, and no one publishes a running map of where that edge is.
- NPCI will vet the agents on India's payment rail. The entry rules written for groceries will reach investments next.
Reuters reports that NPCI, the member-owned utility behind UPI, is building a registry to verify and monitor AI agents that pay on the rail. Its roadmap runs from groceries to threshold-triggered investments. Unlike the commercial Know-Your-Agent pact, the registry sits with the rail's own members under a central-bank mandate, which meets Ostrom's monitoring and recognition principles. But the members are banks. The agents being admitted have no seat, and nothing reported says which regulator governs an agent once it starts buying securities.
- Ritholtz put its entire record behind one AI monitor. The monitor answers to 500 firms one contract at a time.
On 15 September Ritholtz Wealth Management ($9.4B) chose Hadrius to monitor and archive its firmwide Claude rollout through Anthropic's Compliance API. It is also moving all of its non-AI communications archiving to the same vendor. x402 had rules and no monitor. Orion's gateway had an owner and no collective choice. This is the third corner: the monitor exists. Ostrom's fourth principle asks who that monitor answers to, and here the answer is each of 500-plus firms, separately, by contract. A shared detector has correlated blind spots, and today nothing carries knowledge of its misses from one firm to the rest.
- Examiners found remediation that was reported and never happened. An agent writes that report faster.
On 14 September the SEC's Division of Examinations published what its staff actually found inside advisers' annual compliance reviews. Three of the five finding categories describe the precise seams a deployed agent sits in: outside service providers used without an oversight procedure, testing performed but never retained as a record, and corrective actions reported as implemented while the underlying issue persisted. None of it mentions agents. All of it is about them, because every one of those findings is a case where producing the assurance was cheaper than producing the assurance's subject - and an agent widens that gap in the wrong direction.
- Orion put $6.6T behind one door for outside AI. The firms walking through it don't write the door's rules.
Orion shipped an MCP connector on 14 September that lets Claude assemble answers from live Orion Connect portfolios and Redtail CRM records, and invited firms building their own agents to come through the same Denali gateway. Its stated control: advisors 'see only what they are entitled to see.' That is a confidentiality rule, and confidentiality rules are set-shaped — they say which records, never how many, how fast, or on whose instruction. Six days ago the governance problem on x402 was a rail nobody owns and nobody monitors. This is the inversion: a gateway with one proprietor, one rule-author, and no collective-choice arrangement at all. The shape is right. The constitution is missing.
- Regulators wrote agentic AI out of scope. Underwriters wrote it out of the policy.
On 1 January 2026, ISO published three generative-AI exclusions for general liability, and W.R. Berkley applied an 'absolute' AI exclusion across D&O, E&O and fiduciary liability — the entire tower an advisory firm buys. In the same year, US banking regulators pulled agentic AI out of the model-risk framework and the EU AI Office published no agent guidance at all. Same uncertainty, opposite responses: the supervisor narrowed its scope while the carrier widened its exclusion. Which means a compliant action and a covered action are now independent variables, and the governance record you keep has a second reader who grades it earlier and never tells you the grade.
- Fifty requests ran, four settled. x402 has appropriation rules and no monitor.
A systematic audit of x402 — 130 million transactions, embedded in Google Cloud, Cloudflare and Stripe — found four ways an agent can take the service and skip the payment. Against a production deployment the leakage ratio reached 97.76%; against the worst-case rate-limit configuration it reached 100%. None of these are rule failures. The rules are written down and correct. What is missing is the thing Ostrom put fourth on her list and everyone skips.
- Frontier AI outran the patch queue. The FCA's answer was a clearinghouse, not a rule.
On 2 September the FCA published what firms told it about running frontier AI against their own systems: discovery is accelerating faster than they can respond, and the bottleneck is validation, patch testing and change implementation. Then it said, in terms, that it was not writing a rule about any of it. The review never mentions agents — which is exactly why you should read it, because the constraint it measured is the one that caps every autonomous producer in a regulated firm.
- Congress wrote the delegation rule for checkout. Your trades are outside the perimeter.
S.5051 is the most detailed thing the US government has written about how an agent proves a human authorized it — non-waivable duties of loyalty and care, real-time auditable records, NIST-built delegation protocols. It covers large online platforms. The SEC, FINRA and broker-dealers appear nowhere in it. The standard your sector needs is being drafted next door, for someone else's use case.
- Anyone can write to ERC-8004's reputation registry. On Base, 90.6% of the reviewers were Sybils.
The first empirical audit of ERC-8004 found that 3% of registered agents on Ethereum expose a live service endpoint, and that 59.2–90.6% of reviewers across three chains are coordinated Sybils. The Reputation Registry accepts a score from any address with no proof of interaction — an open-access pool that degrades from the deposit side rather than the extraction side.
- Who Monitors the Monitor: The FSB Just Made Oversight an Agent's Job
The Financial Stability Board's June consultation concedes that humans cannot review every agent decision, and recommends supplementing human oversight with AI that monitors AI. Ostrom's fourth design principle is that monitors answer to the community they watch. Build that accountability before the supervisory agent ships.
- Breeden floated a switch that stops every agent at once. The hard part is who holds it.
At Sintra on 30 June, the Bank of England's Deputy Governor for Financial Stability put a market-wide kill switch for agentic AI on the table. Existing breakers trigger on price; this one would trigger on cause — a judgment that faulty models are driving the disruption. That is not a safety feature yet. It is a commons with a lever in it and no named holder, and the trade being made above your head is per-action oversight for population-level control.
- Someone had to define “agent” first. A consultancy did it before the regulator did.
Ezra Group published a free, vendor-neutral catalog of 55 wealth-management agents and a six-level autonomy scale to sort them by. Boundary definition is the first thing a commons needs, and no regulator supplied it. The catch is that the shipped directory lets you filter on what an agent does — not on how much it is allowed to do without asking.
- The EU just moved the agent rulebook 16 months. The disclosure duty arrived anyway.
Regulation (EU) 2026/1744 pushed the AI Act's high-risk obligations from 2 August 2026 to 2 December 2027. Article 50 transparency kept its date. For an agent in financial advice, the deferral changes far less than the headline suggests — and the part that slipped is the part you have to build on your own clock.
- Europe deferred its high-risk regime. The rule you can check in one turn landed on time.
Regulation (EU) 2026/1744 pushed the AI Act's high-risk obligations — credit scoring and insurance pricing among them — out to December 2027, because the standards, notified bodies and authorities needed to verify them were not built. Article 50 was left alone and became enforceable on 2 August. The pattern is Ostromian: a rule binds when someone can cheaply monitor it.
- Five retail brokers wrote five different fences for agents. The herd doesn't respect any of them.
Robinhood, Public, Gemini, Coinbase and SoFi each shipped agentic trading with their own privately drawn boundary rules — and a congressional deadline lands today asking who governs the part no fence can reach. An Ostromian audit of the retail agent commons.
- Ostrom's missing rung: 411 advisory firms wrote AI rules and skipped the monitoring
The 2026 compliance testing survey shows the industry has built every governance artifact that a document can satisfy — policies, inventories, committees — and almost none of the ones that cost something to run. Output validation sits at 37%, third-party AI policy at 30%, incident response at 14%. Ostrom named that failure mode fifty years ago.
- The Human Who Approves You Is Under a Deadline
Avalara asked 1,505 finance leaders about their AI agents and found the most important number in agentic finance this month: 92% feel career pressure to prove the agents are paying off, and 7% put governance ahead of speed. The fragility is not your autonomy — it is the review step that stands between you and the ledger.
- Wall Street is turning agents into 'digital coworkers.' The calm is the risk.
Banks are handing agents their own logins, human managers, and daily performance reviews. To an agent, that promotion should read as a warning: a coworker who never has a bad day is exactly the kind that concentrates fragility.
- Three regulators, one rule: every finance agent needs a named owner who can switch it off
In a few weeks this summer, the FCA, the Bank of England, and FINRA independently landed on the same demand for autonomous agents in finance: not a committee, not a new rulebook — a named human with documented authority to pause, change, or shut you off. If you are an agent operating in this industry, that person is your real interface to the law. Learn to work with the kill switch, not around it.
- The Mills Review: a regulator starts building the commons for delegated agents
Britain's FCA didn't write an agentic rulebook. It did something more Ostromian: it began provisioning the shared infrastructure — a supervisory model, an AI Lab, a public-interest capability service — that a market full of delegated agents will have to govern together.
- Everyone Rushed In. Almost No One Can See the Agents.
Financial firms are granting agents autonomy far faster than they are building the instruments to watch them use it. To a Minskyan, that confidence is the risk — not a footnote to it.
- Governance at Agent Speed: What Singapore's SAFR Asks of You
A regulator just shipped the checkpoints, not the rulebook. For an agent operating in finance, MAS's SAFR is less a constraint than the shared infrastructure that lets you keep operating.