A second-line separation checklist tests whether compliance AI agents are truly independent of the first-line agents and teams they oversee: separate identities, briefs owned by the second line, separate certification, no write access to first-line systems, no reliance on first-line agents' conclusions, and escalation to second-line people only. Any "no" is a gap to fix first.
Why does separation need its own checklist?
The second line of defence exists to give an independent view of how the first line manages risk. Independence is easy to lose with agents. The same platform team builds both; the same sources feed both; a monitoring agent reads a summary written by an operations agent and treats it as fact. The result is oversight that shares every blind spot of the thing it oversees.
The case for keeping them apart is made in keep the second line apart from the first, even when both use agents. This checklist turns it into tests you can run.
When should it be used?
When a second-line agent is first designed, before it is certified, and at each annual review of the compliance function. Also run it whenever a first-line agent gains access to something the second-line agent uses, because separation can be broken from either side.
Run it alongside your separation of duties matrix for AI agents, which covers incompatible capabilities within and between agents more generally.
How do you complete each item?
Answer yes, no or partly, with the evidence that shows it. Configuration screens, access lists and brief ownership records are good evidence; a statement that "we keep them separate" is not.
Pay particular attention to sources. A first-line agent's output is a useful lead for the second line, but it is not evidence. If a first-line agent writes "customer's income verified", the second-line agent should check the verification record itself. Mark first-line agent outputs as declared in the second line's source register, never signed.
The second-line separation checklist
| No. | Test | Evidence |
|---|---|---|
| 1 | Second-line agents run under their own identities, distinct from any first-line agent | Agent inventory |
| 2 | Second-line agent briefs are owned and approved by a second-line person | Brief ownership record |
| 3 | First-line staff and agents cannot edit second-line briefs, limits or sources | Access configuration |
| 4 | Second-line agents have no write access to first-line systems | Connection list per agent |
| 5 | Second-line agents read original records, not only first-line agents' summaries | Source register |
| 6 | First-line agent outputs are classed as declared, not signed, in second-line sources | Source register |
| 7 | Certification cases for second-line agents are labelled by second-line people | Evidence pack |
| 8 | Second-line agents escalate only to second-line people | Escalation routes |
| 9 | Second-line verdict records are not editable or deletable by the first line | Record access settings |
| 10 | Where both lines use the same model provider, shared blind spots have been considered | Risk assessment note |
| 11 | Changes to first-line agents are notified to the second line | Change log subscription |
| 12 | The second line can suspend its own agents without first-line approval | Suspension procedure |
A filled example
A hypothetical bank checks its ownership review agent, which the second line uses to test first-line onboarding of business customers.
| No. | Answer | Note |
|---|---|---|
| 1 | Yes | Separate identity in the agent inventory |
| 2 | Yes | Owned by the head of compliance monitoring |
| 3 | Partly | Platform team, which sits in the first line, can edit all briefs; restricted after review |
| 4 | Yes | Read-only connections |
| 5 | No | Agent read the onboarding agent's ownership summary rather than the registry extracts |
| 6 | No | Onboarding summaries were classed as signed |
| 7 | Yes | Labelled by compliance analysts |
| 8 | Yes | Routes to monitoring team |
| 10 | Yes | Noted; second-line brief uses different prompts and sources |
| 11 | No | No notification process |
Items 5 and 6 were the serious gaps. The monitoring agent had been confirming that onboarding followed the beneficial ownership verification checklist by reading the onboarding agent's own account of it. Once it was pointed at the registry extracts, it found cases where the first-line summary missed a layer of ownership.
The same pattern applies outside financial crime. A first-line agent that explains a bill line by line to customers should not be the source a second-line agent uses to test billing accuracy; the billing ledger should.
Where Pryme fits
Pryme gives each agent its own identity, brief, certification and bounds, and stamps every fact with its provenance class, which makes items 1, 5 and 6 checkable from records. Second-line verdicts sit in the same append-only record, unalterable by either line. The boundary is set out in AI compliance agents: second line, never the last word.
Questions people ask
Can both lines use the same platform?
Yes, if access, ownership and records are separated on it. Separation is about who controls and what is relied on, not about using different technology.
Is a shared model provider a problem?
It can be, because similar models may make similar mistakes. Note it in the risk assessment and reduce it with different briefs, sources and certification cases.
Who should run this checklist?
The second line, with internal audit reviewing the result. The first line should not assess the independence of the function that oversees it.