Financial services

Model risk management under SR 11-7 grew up around prediction: a model scores, a human reads the score and acts, and validation, monitoring, and documentation live in the gap between the two. An agent that initiates a payment, adjusts a limit, or touches a customer record removes the gap entirely.

Your three lines of defense have no box for that. The model inventory can list the agent and the validation file can attest to its accuracy, and neither answers what the agent was permitted to do at the moment it acted.

For firms in scope of DORA, an agent is an ICT system like any other: it needs risk classification, resilience testing, and incident reporting when it misbehaves. An agent's blast radius is set by what it can execute, so its risk register entry has to describe its permissions as well as its purpose.

That register stays accurate only if the permissions are enforced somewhere real. A policy evaluated before each tool call gives the register a ground truth to point at.

Actions carry different consequences, and the control has to distinguish them. A balance inquiry can be permitted outright. A payment initiation above a threshold can be routed to a named human for approval before it executes, and an action outside policy is denied before it happens rather than flagged after.

The routing itself is policy, versioned and reviewable. A prompt can ask the model to be careful with large payments. It cannot stop one.

An examination lands on records. For each agent action, the record has to show the action proposed, the policy version that evaluated it, the decision, the approver where one was required, and the data the agent acted on.

Kept per action, that record turns an examination question into a lookup. Kept per quarter, it turns into a reconstruction project with your name on it.