A compliance agent should cite the rule

Every finding a compliance agent makes should name the rule it rests on: the policy clause, internal standard or regulatory provision, with its version. A finding without a cited rule cannot be checked, challenged or defended. It is an opinion, and a compliance function cannot act on an opinion from a system that answers to nobody.

Why does a finding need a citation?

Compliance work is the business of comparing what happened with what should have happened. The "should" is always a rule of some kind. If an agent says a customer file is deficient, a promotion is unclear or a transaction breaches a limit, the first question any reviewer will ask is: against what?

A citation answers that question in advance. It lets the reviewer open the rule, read it and decide whether the agent applied it properly. It lets the business challenge a finding on its merits rather than on whether they trust the agent. And it makes findings consistent: two agents, or the same agent on two days, citing the same clause for similar facts are visibly applying the same standard.

Without a citation, the reviewer has to reconstruct the agent's reasoning from scratch. In practice that means one of two things happens. Either the reviewer redoes the work, so the agent saved nothing, or the reviewer accepts the finding on trust, so the control has quietly become the agent's judgement.

What should a good citation contain?

More than a document title. A citation useful enough to check should include:

1. The source: which policy, standard, procedure or regulation.
2. The specific provision: the clause, paragraph or rule number.
3. The version: the version in force at the time of the facts being assessed, with its effective date.
4. The provenance: whether the text came from the firm's sealed policy library or from an external source such as a web page.
5. The triggering facts: the specific facts in the case that engage the rule.
6. How it was applied: one or two sentences connecting the facts to the provision.

Item three is the one most often missing and the one that causes most damage. An agent that cites the right clause from a superseded version is wrong in a way that looks right. Making sure it cites the current version of a policy is a configuration task, not something the agent can be trusted to infer.

What if no rule fits?

Then the agent should say so, and the case should go to a person. "This looks wrong but I cannot find the rule it breaks" is a legitimate and useful output. It may point to a gap in the firm's policies, or it may be a false alarm. Either way a person should decide.

What the agent should not do is produce a finding anyway, phrased with confidence and no citation. Those findings are the hardest to deal with, because they sound authoritative and offer nothing to check. A simple bound helps: a finding without a cited provision is never issued as a finding. It is held as a query for review.

How does citation help when the rule itself is the problem?

Citations make patterns visible. If a large share of an agent's findings cite the same transaction monitoring rule, and most of those findings are later closed as false positives, the rule is probably miscalibrated. Without citations, that pattern is buried in a general alert count.

This makes citations useful well beyond the individual case. They become the raw material for reviewing whether the firm's rules work, which is the subject of how to review transaction monitoring rule performance with an AI agent. The same applies in narrower domains. In crypto transfers, for example, whether an agent is checking the right originator and beneficiary information depends on which provision it is checking against, a question explored in whether an AI agent can handle the travel rule for crypto transfers.

Does citing the rule make the agent's finding correct?

No. A citation makes a finding checkable, not right. The agent can cite the correct clause and still misread the facts, or cite a real provision that does not apply to this type of customer. That is precisely why the citation matters: it exposes the reasoning so a person can catch those errors.

It also helps with the opposite situation, when the agent itself does something it should not. As covered in what happens when an AI agent breaks a rule, investigating an agent's mistake is far easier when every step it took is tied to the rule it believed it was following.

Where does provenance fit?

Some sources are more reliable than others. The firm's own policy library, maintained and versioned by the system of record, is a sealed source: the text is what the firm actually adopted. A regulator's web page fetched by the agent is external: probably right, but not verified, and possibly out of date or misparsed.

A citation that states its provenance lets the reviewer weigh it. A finding resting on a sealed internal standard can be acted on with more confidence than one resting on an external page, which should be confirmed against the official text first.

Where Pryme fits

In Pryme, every fact reaching an agent carries its provenance class through the Pryme Context Protocol, so a compliance agent's citation shows whether the rule came from the sealed policy library or an external page. Findings without a cited provision can be bounded to a hold for review. This fits the wider principle that AI compliance agents are second line, never the last word.