Research into two-party agentic delivery
Buyer duties and authority that persist when execution is delegated.
AAO-006 / Governance and Accountability
The buyer should approve a bounded grant of business authority for every outsourced agent. That grant must survive tool use, further delegation, configuration change, and revocation across both organizations.
AAO-008 / Regulation and Compliance
Direct oversight of critical technology suppliers does not establish that a bank’s own agentic service is governed or recoverable. Directors should require a dependency review connecting the primary provider to the bank’s actual business service.
AAO-001 / Regulation and Compliance
US bank leaders should require a complete control coverage decision for every outsourced agentic service. Exclusion from model risk guidance leaves the bank with a governance task that a provider model review cannot settle.
AAO-003 / Data, Technology, and Security
Executives should approve a processing activity map before delegating work to provider agents. Responsibility follows the actual purposes and decisions in the chain, while contractual labels alone cannot establish who controls personal information.
AAO-121 / Governance and Accountability
Every one of the study’s 150 engagements contained a reported departure from intended governance, oversight, or control functions. Bank boards should commission an independent audit of delivery, contain material exposure, and require evidence that corrections operate.
AAO-126 / Assurance and Audit
Reported control departures and manual alteration each reached 150 of 150 sampled engagements. The manual-alteration contrast is 100% of engagements versus under 1.3% of pooled disclosure answers. Bank boards should commission an independent portfolio audit covering provider delivery and the bank’s own readiness.