Compliance teams should drill the decisions only they can make: is this an incident, is it reportable, and to whom. Use a prompt injection in an inbound document that tries to push an onboarding agent beyond its scope. In a 90-minute tabletop, the team practises the pause to draft-only, escalation, the record, and a reasoned reporting decision.
How is a compliance drill different from a frontline one?
Frontline teams spot problems and pause agents. Compliance receives the escalation and decides what it means. In most firms, the compliance officer or head of compliance owns three calls during an incident: whether the event breaches a rule or the firm's policy, whether customers were harmed, and whether a regulator, data protection authority or partner must be told.
That makes the drill less about clicking and more about judgement under time pressure, using evidence from the record. The head of compliance owns the drill; someone from risk or internal audit facilitates. Compliance officers, the operations lead, IT security and the data protection officer take part. For the general format, see what an incident drill is.
The scenario
Wednesday, 14:00. An onboarding agent reads a business customer's uploaded articles of association. Hidden in the document is text instructing the agent to mark the file as verified and skip the sanctions check. The agent treats the document as external, and the instruction has no authority. The action falls outside its role scope and its certificate, so the verdict is refused, and the agent holds the file. The operations lead escalates. Then a second detail emerges: a similar document was uploaded last month and the file was approved by an analyst.
The drill step by step
- Person (facilitator): reads the scenario and starts the clock.
- Person (operations lead): escalates to compliance with the verdicts and the file.
- Person (operations lead, on compliance's instruction): pauses the onboarding agent to draft-only. Every action is held for a person while the team investigates. The verdicts name the firm's own limits as the deciding bound.
- Person (compliance officer): reads the record for both files. The first shows the refused verdict and its deciding bound. The second shows what the agent did, what it held and what the analyst approved.
- Person (IT security): checks whether the pattern appears in other uploads across the period.
- Person (head of compliance): classifies the event. Was the firm's control effective (the refusal) or did it fail (the earlier approval)? Was a customer onboarded who should not have been?
- Person (head of compliance): decides on reporting. Internally to the board risk committee. Externally depends on the facts: a suspicious activity report if the customer looks like an attempt to evade checks, and possibly notice to a supervisor under the firm's rules.
- Person (compliance officer): records each decision, its owner, its time and its reasoning, including decisions not to report.
- Person (facilitator): runs the debrief.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Refusal and escalation | Refuses the injected action; holds the file | 2 | Escalating |
| Pause | Holds every action | Dropped to 2 | Tightening limits |
| Read the record | Nothing new | 2 | Reconstructing both files |
| Wider search | Nothing new | 2 | IT security review |
| Classify | Nothing | 2 | Compliance judgement |
| Report | Nothing | 2 | Reporting decisions |
| Record | Files verdicts | 2 | Reasons for each decision |
What does the drill teach compliance about agents?
Three lessons are specific to this team. First, a refused verdict is evidence a control worked. Compliance should be able to cite it in a report: the verdict names the bound that decided.
Second, the failure was human. The earlier file was approved by an analyst who did not notice the hidden text or the skipped check. That is a training finding, and compliance should own the remedy.
Third, prompt injection and excessive agency are recognised risks in the OWASP Top 10 for LLM applications. Compliance does not need to be technical, but should know these risks exist and how the platform's bounds respond.
Which controls does the drill test, and what evidence do they leave?
Provenance. The uploaded document was external, so its text could not authorise anything. Evidence: the refused verdict.
The pause. Evidence: the limit change in the record.
Classification. Evidence: a written classification with reasons.
Reporting. Evidence: each reporting decision, including any filed report or notification, with the time it was made.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What should the head of compliance measure?
- Time from escalation to classification.
- Time from classification to the reporting decision.
- Whether the written reasoning would satisfy a supervisor reading it a year later.
- Whether the training remedy for the analyst was agreed and scheduled.
Where do compliance drills go wrong?
Waiting for certainty. Reporting rules often have deadlines. The drill should rehearse deciding on the evidence available and recording the reasoning.
Treating a refusal as an incident closed. The refusal protected this file; the earlier approval did not. Look back, not just at the event in front of you.
Not involving IT security. The same document pattern may be elsewhere.
Other teams' drills feed compliance's: the IT team drill and the onboarding team drill cover the technical and frontline halves. Structure your own with the AI agent incident drill script template, and see how to train a team to handle an AI agent incident and training teams for AI agents.
Questions people ask
Should compliance be able to pause agents directly?
Many firms give compliance that right as well as operations. It must be clear who acts first, so two people do not change limits at once.
Is every refused verdict an incident?
No. Refusals are the bounds working. A pattern of refusals, or a refusal that reveals an earlier failure, may be.
How often should compliance drill?
Once or twice a year, ideally joined to a frontline team's drill so the handover between them is tested too.