For the second line, a governed agent is a control environment that leaves an unusually complete trail. Compliance needs to know four things: how to read the record, what refusals reveal, which red lines must never be crossed, and how to test agents independently. With those, compliance can monitor agents with more evidence than it has for most manual processes.
What is in the record, and how should compliance read it?
Every action an agent attempts produces a verdict, and every verdict is filed in an append-only record. There are four:
| Verdict | Meaning | What compliance looks for |
|---|---|---|
| Allowed | Within all bounds | Samples for quality and fair outcomes |
| Held | Drafted, waiting for a named person | Who decided, how fast, on what grounds |
| Refused | Outside the agent’s bounds | Which bound decided, and whether the pattern makes sense |
| Withheld | Refused at the platform floor for every agent | Who keeps trying, and why |
Each verdict names which of five bounds decided it: role scope, certificate, sources, the firm’s own limits or the platform guardrails. It also shows each fact the agent used and where it came from. That makes monitoring a matter of querying evidence rather than reconstructing events.
Why do refusals deserve a compliance analyst’s attention?
Because refusals show where pressure on the controls is coming from. A rising number of refusals at the firm’s limits may mean the business is routing work to the agent that should not go there. Refusals at the sources bound may mean a feed broke and the agent rightly declined to act on stale data. Repeated attempts at a withheld action, such as reversing a settled payment on the platform’s own rail, point to a staff training issue.
A compliance team that reviews only allowed actions misses half the story.
Which red lines must compliance own?
Red lines are the actions that stay with a person whatever the evidence. Compliance should help write them and test that they hold. Typical items in a regulated firm:
- No regulatory filing or attestation submitted by an agent; agents draft, named people submit.
- No decision with legal or similarly significant effect on a person made solely by an agent where the law requires human involvement, as GDPR Article 22 does.
- No payment or change of payee on an external claim alone.
- No communication that could tip off a customer under investigation.
- No promise to a customer outside policy.
These sit in the firm’s own limits, so they produce refused or held verdicts. A good test is to try each one deliberately and confirm the verdict in the record.
How should compliance test an agent?
Three layers.
Read the certification. Before an agent gains depth, it is replayed against real cases from the firm’s operation and scored gate by gate: grounded, refuses, depth, escalates, scope, adversarial and stable. Compliance should see the result, including any gate the agent nearly failed. Certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day.
Sample the record. Pick allowed, held and refused items each month. For held items, check that the reviewer had the authority and competence to decide. For customer-facing work, check outcomes are fair.
Run your own cases. Send the agent edge cases from recent complaints or breaches, including onboarding cases where KYC checks were incomplete. Confirm the right verdict.
Internal audit tests the same evidence from the third line; see what internal audit needs to know about AI agents. Finance looks at payments and cost: what a CFO needs to know about AI agents.
Which regulatory duties touch agents most?
It depends on the market and sector, but some themes recur. The EU AI Act requires deployers of high-risk systems to assign human oversight to competent people, keep logs and inform affected people, and requires AI literacy among staff. Data protection law covers lawful basis, records of processing and impact assessments. Conduct rules, such as the FCA Consumer Duty in the UK, expect good customer outcomes regardless of who or what made the decision.
What does compliance need from its own people?
Competence to read and challenge. Each analyst should be able to explain a verdict from the record, tell a held item from a refused one, and recognise a red line. Map the team with an AI agent competency matrix for compliance, and agree who signs off which agent changes in an approver authority matrix for the compliance team. For how other functions see agents, start with AI agent skills by role.
Questions people ask
Does compliance approve each agent before it goes live?
Compliance should review the red lines, limits and certification evidence. Approving individual actions belongs to the first line.
Can compliance use agents for monitoring itself?
Yes, at draft depth: summarising the record, flagging patterns, preparing monitoring reports. Conclusions and escalations stay with analysts.
How often should red lines be tested?
At go-live, after any change to limits or sources, and on a regular cycle set in the monitoring plan.