Your Model Risk Framework Doesn't Cover Your Agents

Earlier this year, the Federal Reserve, OCC, and FDIC replaced the prior model-specific framework with broader principles-based guidance. The sentence that matters most to anyone running AI in a regulated workflow sits in a footnote, where the agencies state that generative and agentic AI models are "not within the scope of this guidance."

That reads like relief, but functions as the opposite. SR 26-2, issued as OCC Bulletin 2026-13, rescinded SR 11-7 along with the older credit scoring and BSA/AML model issuances, and in doing so it withdrew the template institutions had been using to govern their AI systems by analogy. The obligation stayed exactly where it was. The same footnote directs banking organizations to let their own risk management and governance practices determine appropriate controls for anything the guidance leaves uncovered, which means a bank deploying agents now carries full responsibility for the framework without a supervisory framework specifically addressing agentic AI.

Who this is actually a problem for

An institution still running agents in a contained pilot, with a person approving every output, can reasonably wait. The agencies have said a request for information on banks' use of AI is coming, and building elaborate governance ahead of it would be premature.

The exposure belongs to institutions that already moved past that point. Agents are beginning to be deployed in financial crime alerting, regulatory change triage, controls testing, exception handling, and continuous transaction monitoring, which are precisely the workflows chosen because they pair high volume with tolerable error cost. Those systems are generating consequential decisions right now, under a governance framework the institution authored itself, measured against supervisory expectations that have not been written. Every one of those decisions is accumulating into a record that an examiner will eventually read backward, from outcome to input, asking how each one was justified at the time.

Why extending the old framework breaks

The instinct across most second-line functions is to apply the familiar discipline anyway: validate conceptual soundness, monitor ongoing performance, run outcomes analysis, and treat the agent as a model with unusual plumbing. This fails on a structural property of agentic systems rather than on any shortfall in rigor.

Model validation assumes that the information used by the model can be identified and reconstructed after the fact. Conceptual soundness is assessed against the data the model consumes, drift monitoring watches that data for change, and outcomes analysis depends on being able to re-run the model against known inputs and confirm it behaves as documented. All three steps assume the information used by the model can be reconstructed as a defined input set for validation. An agentic system selects its inputs at execution time. It decides which sources to call, which records to read, how to reconcile sources that disagree, and when it has gathered enough to act, and it makes those choices on every invocation based on what it encounters. The complete input set only becomes knowable after execution, because the input set is itself an output of the system.

Logging is the natural fallback, and it is where the argument becomes uncomfortable for the institutions relying on it. A bank can capture every call its agent made and every value returned, producing a thorough internal account of its own system's behavior. When a supervisor asks whether the data the agent acted on was accurate at the moment of the decision, that log is the institution asserting the answer to a question about itself. Data lineage has moved firmly into audit scope because supervisors stopped accepting reconstructed narratives about where a number originated, and an agent assembling its own inputs at runtime generates lineage far faster than any documentation process can describe it.

The evidence problem is a data layer problem

The distance between what an institution can currently produce and what an examiner is asking for is a difference in the kind of evidence, and it cannot be closed higher up the stack. Model inventories, approval workflows, and governance committee minutes all document intent. What none of them yields is an artifact created at the instant the agent read the data, describing that specific read, which remains credible to a reader with no reason to trust the institution that generated it.

That artifact is a property of the data layer. Space and Time, the data blockchain securing onchain finance, returns query results accompanied by cryptographic proof that the query executed correctly against tamperproof data. The record of what an agent saw is established at the moment of seeing, by the system that served the data, and it stands on its own during examination rather than depending on the institution's account of its own logging.

Agent-specific supervisory expectations are coming, and the institutions building governance in the interval are effectively choosing what they will be holding when those expectations arrive. One option is a well-organized set of policy documents describing how their agents were supposed to behave. The other is verifiable evidence of what their agents actually read. Only one of those gets stronger under scrutiny.

‍