Before an agent goes live, someone will ask for its release pack
Bank examiners, state insurance regulators and enterprise buyers now ask the same questions about an AI agent: what can it do on its own, who can stop it, and what proves the controls work. The answer is a release pack, written before launch. We built a tool that drafts one.
What happened
On 4 November the OCC issued Bulletin 2026-54, a supervisory framework its examiners may use to review how banks use AI. It is a guide for examiners, and it says it “does not establish supervisory expectations for banks.” But it is clear about what examiners will look at: risk may be classified by “potential consequences, transfer of agency, and the degree of human oversight,” not by how sophisticated the model is. It describes four illustrative tiers, puts an autonomous payment agent in the top one, and starts from a documented purpose statement for each system or agent.
Insurers have been living with the same questions for longer. The NAIC model bulletin on insurers’ use of AI, adopted in December 2023, expects a written AI program covering governance, risk management and internal controls, and oversight of AI bought from third parties, all available to regulators on examination. As of 3 November 2026, the NAIC’s adoption map lists 27 states, the District of Columbia and Puerto Rico; three of those states and Puerto Rico adopted it this year.
Growth companies have no single regulator, but they meet the same questions in a different form. An enterprise customer’s security review, an investor’s diligence list and a SOC 2 or ISO/IEC 42001 audit all ask what the agent can reach, who reviews its output and how you would know if it went wrong.
My view
The questions have converged. The work to answer them hasn’t, in most firms, because it is spread across a model team, a risk function and an audit plan that rarely sit in one document.
Autonomy is a setting, not a kind of agent
The useful question is not whether an agent is “autonomous.” It is what each action is allowed to do without a person, and how hard that action is to reverse. The same agent can read freely, draft for review and need approval before it writes. That is the OCC’s point about consequence and transfer of agency, and it is how a firm should decide autonomy: per action, raised only on evidence.
Every control needs three owners and a proof
A control nobody owns, or nobody can evidence, will not survive an examination, an audit or a customer’s review. For each control, someone in the business runs it, an independent function sets the standard and challenges it, and audit tests it. Banks and insurers call this the three lines of defense; the Institute of Internal Auditors has called it the Three Lines Model since 2020. A growth company has the same roles in smaller form: the team that runs the agent, someone who didn’t build it, and outside assurance. The test for each control is the same everywhere: what is the evidence, and who would hand it over?
Write the purpose statement first
Most of the evidence depends on one document written before launch: what the agent is designed to do and not do, who may invoke it, what it may reach, what it may change, and when it must stop or wait for a person. Without it, there is nothing to measure scope drift against, and every later review starts from scratch.
Why it matters
For the industry. Agents are moving from drafting to acting, and the review is moving with them, from the model team to the people who own the process. Firms that assemble the purpose statement, the control owners and the evidence before launch will pass reviews faster and expand with less argument. Firms that assemble it during an exam, a diligence process or an incident will pay for it in time and trust.
How it connects to our work. The Agent Patterns release pack drafts this for one agent: choose your organization, the agent’s design and what it can affect, and it returns a risk view, a draft purpose statement and each control with its owner in every line and the evidence that proves it, as an editable Word file. AI Governance Evidence sets out the evidence index a reviewer will inspect. Four steps before your next agent goes live:
- Write the purpose statement. One page, approved by the business owner, before any build budget is spent.
- Set autonomy per action. Read, draft and act are different decisions with different approvals.
- Name three owners for every control. Who runs it, who challenges it, who tests it.
- Collect the evidence as you build. Approval logs, evaluation reports and request traces are cheap to keep and expensive to reconstruct.
Sources
- OCC Bulletin 2026-54: Super Intelligence: Supervisory Framework, Office of the Comptroller of the Currency, 4 November 2026
- Supervisory Framework for Bank Use of Super Intelligence (PDF), Office of the Comptroller of the Currency, 4 November 2026
- OCC issues supervisory framework on use of AI, Reed Smith, November 2026
- NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers, National Association of Insurance Commissioners, adopted 4 December 2023
- Implementation of NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers (PDF), National Association of Insurance Commissioners, status as of 3 November 2026
- The IIA’s Three Lines Model: An update of the Three Lines of Defense, The Institute of Internal Auditors, 2020
Linked sources are the record. Check them for the full reporting.