Research into two-party agentic delivery
Permitted actions, approval limits, mandates, expiry, and revocation.
AAO-020 / Governance and Accountability
Utility boards should decide what authority remains with the operator before buying an agentic service. Delegation, behavioral freedom, operating conditions, and intervention are separate decisions that require evidence appropriate to essential service.
AAO-013 / Commercial and Vendor Management
Buyers should evaluate contractual recovery and insurance against specific loss scenarios. A provider cap, an indemnity, and an insurance certificate address different questions and cannot be added together as assured protection.
AAO-014 / Data, Technology, and Security
Infrastructure managers should authorize provider agents through task-specific identities and tested revocation. Initial use should remain limited to approved low-risk support, with operational engineering defining how access can be withdrawn safely.
AAO-010 / Governance and Accountability
Bank leaders should approve outsourced credit assistance only when the bank can reconstruct each consequential decision, test relevant outcomes, and provide the explanations and review required by applicable law.
AAO-011 / Resilience and Exit
Executives should authorize containment and restoration as separate decisions across the buyer and provider. The mandate must establish who can stop harmful action, how acceptable service continues, and who can approve a controlled restart.
AAO-006 / Governance and Accountability
The buyer should approve a bounded grant of business authority for every outsourced agent. That grant must survive tool use, further delegation, configuration change, and revocation across both organizations.
AAO-002 / Data, Technology, and Security
Outsourcing security managers should test whether untrusted supplier content can cause a trusted agent to act outside its mandate. The test must follow content through retrieval, memory, tool selection, and the final business action.
AAO-004 / Governance and Accountability
Bank payment and vendor-access managers should preserve independently enforced preparation, approval, and execution when provider agents act. Different agent names do not establish separation if one credential or administrator can control the entire transaction.