An outsourcing provider's board is governing someone else's risk. Directors need tested literacy on how far agents may act for each client, how that authority is certified on each client's own cases and expires, what the record lets a client audit, and which of the provider's people are accountable. Without it, the board cannot stand behind its contractual assurances.
Why is an outsourcing board's position unusual?
A bank's board governs its own agents under its own appetite. An outsourcing provider runs agents inside processes that belong to clients: their customers, their limits, their regulators. The client remains accountable to its regulator, and expects the provider to prove that the work done on its behalf is controlled.
That changes what the board needs to understand. It is not enough to know that agents are governed in general. Directors must know that each client's agents are governed to that client's standard, and that the evidence can be handed over on request.
What must directors understand?
- Depth is per capability and per client. An agent may draft refunds at depth 2 for one client and execute them at depth 3 for another, because each client's cases and limits are different.
- Certification is per client. Authority is proven on each client's own cases. Evidence from one client does not carry over to another.
- Expiry. Certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day, for that client. Service levels in the contract must allow for it.
- The record. Every verdict is filed append-only, so the provider can give a client a reconstructed decision without exposing other clients' data.
- Accountability. The provider's people who release held actions on a client's behalf need current credentials, and the client may ask to check them.
How do client limits fit into the agent's bounds?
Every action meets five bounds: role scope, certificate, sources, the customer's own limits and the platform guardrails. In outsourcing, "the customer's own limits" are the client's: its refund ceiling, its payment approval matrix, its rules on vulnerable customers. The lowest bound wins.
The board should insist that every client's limits are encoded as bounds, not just written into a process document. Where a client's limit is stricter than the provider's default, the client's wins. Where it is looser, the provider can still narrow it.
What stays with people?
| Work | Agent | Stays with the provider's people |
|---|---|---|
| Client customer enquiries | Answers within the client's bounds at depth 3 | Complaints and escalations |
| Back-office processing | Executes routine items within limits at depth 3 | Exceptions |
| Payments on the client's behalf | Prepares and holds at depth 4, if certified for that client | Releasing them |
| Anything outside the client's limits | Refused or held | The client's own approvers, where the contract says so |
What will clients audit?
Expect clients to ask for:
- Depth by capability for the agents serving them, with certificate dates.
- Failed runs and how service continued afterwards.
- The names and current credentials of people approving their held actions.
- A sample decision reconstructed from the record.
- Evidence that their data was read only by agents scoped to their account.
A board AI literacy briefing template helps directors prepare. The order in which to train staff is set out in who in an outsourcing provider needs AI agent training first. A readiness assessment in the outsourcing provider and a plan to roll out AI agent training across the provider follow. The full model is in AI literacy and certification for people who work with agents.
Where the Academy fits
Pryme Intelligence Academy certificates are issued through VerifyDoc.ai, so a client can check an approver's credential at source by number or QR code, and a lapsed or revoked certificate shows as such on the same page. A provider can adopt the practice of granting approval rights only while a current certificate is held.
Questions people ask
Can one agent serve several clients?
It can run for several clients, but its depth, sources and limits are set and certified per client. Treat each client's configuration as a separate authority.
Who is accountable when an agent errs on a client's behalf?
The client remains accountable to its regulator; the provider is accountable to the client under the contract. The record shows which bound decided and who approved.
Should provider staff hold credentials the client chooses?
Agree it in the contract. A credential the client can check at source avoids repeated requests for evidence.