◆Financial services
An examiner does not want to hear that your AI agent is well governed. They want to pull one action from six months ago and see who approved it, what the model read before acting, and which version of the policy was in force at that moment. If your deployment can answer that in minutes, most of the rest of the exam gets easier.
Financial services teams have spent a decade building model risk discipline around systems that predict. Agentic AI is different in one specific way: the system acts. It files the ticket, drafts the response, updates the record, or triggers the downstream process. That shift moves the audit question from "was the output accurate" to "was the action authorized, reviewed, and reconstructable."
A slide that says "human in the loop" is a promise. A log line showing that analyst approval was captured at 14:32 before the agent executed, with the exact draft the analyst saw, is evidence. Audit and second-line teams already know this distinction well. The work is making sure the agent's infrastructure produces the second kind of artifact by default, not as a special export someone assembles after the exam letter arrives.
An end-to-end trail for an agent is not a single log file. It is four record types that join on a common identifier, so any output or action can be traced back through everything that produced it. Miss one layer and the reconstruction breaks. You can show what the agent did but not what it read, or what it read but not who signed off.
The join matters as much as the records. When an examiner picks a transaction, you should be able to walk from the action, back to the approval, back to the draft, back to the retrieved sources, back to the model and prompt versions in force, without leaving the tooling.
A grounded agent should cite its sources the way an analyst would: this figure came from that filing, this obligation from that section of the policy manual. The citation is only useful if it resolves. A reviewer clicks it and lands on the exact passage, in the version of the document that existed when the agent ran, not whatever the document says today.
That is why retrieval records and version records have to work together. Pinning citations to document versions means a claim made in Q1 can still be verified in Q4 even after the source was revised. It also gives you a clean rule for the reverse case: if the agent asserts something it cannot cite, that output gets flagged for review rather than passed through. This is the auditability pillar in our Governed-by-Design framework, and it is the single control that most changes an examiner's posture. Verifiable outputs invite spot checks. Unverifiable outputs invite full-scope reviews.
Examiners will ask what the agent is allowed to do, and the answer should be a document, not a description. An access-control map lists the roles the agent inherits, the data scopes attached to each role, the actions it can take autonomously, the actions that require a named approver, and the actions it is prohibited from taking under any condition. Deny by default, with every grant explicit.
Two details make this map hold up under scrutiny. First, changes to it are themselves logged, so you can show the permission set that governed any historical action, not just the current one. Second, the map is enforced at the tool layer, not in the prompt. An instruction that tells the agent not to touch production records is a suggestion. A tool call that fails because the credential lacks the scope is a control.
None of this replaces your model risk management program. It feeds it. Retrieval and version records supply the development and implementation documentation your MRM team needs for validation. Action and approval records give ongoing monitoring something concrete to measure, including override rates and review latency. And a trail that any second-line reviewer can walk end to end is what makes effective challenge practical rather than ceremonial. Our engagements are designed to support SR 11-7 expectations in exactly this way, by producing the artifacts your existing framework already knows how to consume. Our guide on model risk and Claude covers the validation side in more depth.
If you are preparing for an exam or scoping a first agentic deployment, this is what our Model Governance & Audit Pack packages: the trail schema, the access-control map, the citation policy, and the evidence a reviewer will ask for. A Governed Pilot builds the deployment with those records in place from day one, against a fixed scope and an agreed success criterion. If the criterion is not met, you do not pay. The free Claude Readiness Assessment is the fastest way to find out which of the four record types your current setup can already produce.
If a control fired but nothing recorded it, an examiner is right to treat it as if it never fired.
Agentic AI will get through an exam the same way every other system in your stack does: with records, not reassurance. Build the trail before the agent goes live, and the exam becomes a walkthrough instead of an investigation.