A plain-language guide Updated 26 October 2026
Agentic AI governance, explained.
How a bank or insurer keeps its AI agents inside what was approved: who owns each one, what it may do, which actions wait for a person, and the record that proves it.
01 At a glance
- What it is
- The controls that decide what an AI agent may do, who answers for it, and how every action is recorded.
- Why now
- Agents no longer only answer; they call tools that move money, change records and reach customers.
- OSFI E‑23
- An agent that uses an AI model to produce results fits E‑23’s definition of a model, which asks for controls where a model acts on its own. In effect 1 May 2027.
- OSFI B‑10
- An agent or model a supplier provides sits inside a third-party arrangement. In effect since 1 May 2024.
02 What an agent adds to model risk
- It acts
- A model produces a result a person reads; an agent calls tools: it moves money, writes to systems, sends messages and opens files, often in a chain of steps no person sees one by one.
- It chains models
- One agent can call several models and other agents, so a weakness in one becomes an action somewhere else.
- Its reach drifts
- Tools, permissions and prompts change faster than a model's code, so what an agent may do today is not what was approved last quarter.
- It is often a vendor's
- Many agents run inside a supplier's platform, on a model the supplier chose and may change without notice.
03 The eight controls
- An inventory of agents
- Every agent named, with an owner, a purpose, the tools and data it can reach, the models it uses and a risk rating, beside the institution's model inventory.
- Identity
- Each agent has its own identity, tied to the policy it runs under, so every action traces back to one agent and one decided policy.
- A written policy, deny by default
- What the agent may do, on which data, within which limits, written down and checked before every tool call; anything not permitted is refused.
- A person for high-risk actions
- Payments, customer decisions and other high-risk calls are held until a named person with the right role releases them, never the agent's own developer.
- Separation of duties
- The person who builds an agent does not approve its policy or release its held calls.
- Limits and monitoring
- Budgets, rates and volumes are capped, and the agent's behaviour is watched against what was approved, with drift and breaches escalated.
- A kill switch
- A named person can suspend the agent at once, and the suspension is itself recorded.
- A record an examiner can check
- Every decision (permitted, refused, held, released), every policy change and who made it, time-stamped and kept as evidence.
04 Software for agentic AI governance
An agent decides in milliseconds; a control that lives in a policy binder cannot keep up. The policy has to be checked on every call, and the record kept as it happens.
Whatever tool you choose, it should do the eight things below. Beside each is how MINERVA Studio does it.
| What the software should do | How MINERVA does it |
|---|---|
| Keep an inventory of agents, beside the models | Every agent is a sheet on the same record as the models: owner, developer, approver, kill-switch holder, tools, data scopes and the suppliers it depends on. |
| Give every agent an identity (Know Your Agent) | Shows for each agent whether it is identified, bound to its policy, attested by its runtime and, where you connect Microsoft Entra, listed in your directory. |
| Write the policy as code, deny by default | Policies are documents of permit, forbid, hold, limit and escalate statements, edited in a visual form or as JSON, validated before they are proposed, and changed only through a decision a person makes. |
| Hold high-risk calls for a person | A held call waits until someone holding a releasing role approves it; the agent's developer is refused by name. |
| Layer the rules | The guideline's floor, the institution's own ceiling and each vendor's passport narrow every agent's policy; a layer can only take permissions away. |
| Watch the agents live | A control room shows the newest decisions across every agent as they happen, keys closing soon, held calls waiting and incidents opened by the monitor. |
| Stop an agent | Suspension is proposed and decided by the named kill-switch holder; drift and breaches open incidents routed to the right people. |
| Prove what happened | Every decision is hash-chained and time-stamped, and the evidence packet carries it for an examiner to verify offline. |
What it does not do: MINERVA does not run your agents, change a model’s weights or make an institution compliant. The policy is enforced by the gateway or runtime that dispatches the agent’s tool calls; MINERVA writes, decides, signs and records it. It runs on MINERVA’s cloud or in your own data centre, in English and French.
05 Questions people ask
What is agentic AI governance?
The controls that decide what an AI agent may do, who answers for it, and how its actions are recorded: an inventory of agents with owners, an identity for each, a written policy checked before every tool call, a person's approval for high-risk actions, limits and monitoring, a kill switch and an audit trail.
How should a bank govern AI agents?
Treat each agent as a model that acts: inventory it with an owner and a risk rating, give it an identity, write down what it may and may not do and enforce that before every tool call, hold high-risk actions for a named person, keep the developer away from approvals, cap its limits, watch it for drift, be able to stop it, and keep every decision as evidence.
Does OSFI Guideline E-23 apply to AI agents?
E-23 defines a model as any application of theoretical, empirical or judgmental assumptions or statistical techniques, AI and machine learning included, that turns input data into results, and it asks for controls where a model is a black box or acts on its own. An agent that uses an AI model to produce results or take actions fits that definition, so it belongs in the model inventory and its risk rating. E-23 takes effect on 1 May 2027.
Does OSFI B-10 apply to AI agents run by a vendor?
Yes, through the arrangement. Guideline B-10 covers every third-party arrangement of a federally regulated institution, in effect since 1 May 2024, with risk-based due diligence, written agreements, audit and information rights, monitoring and exit plans. An agent a supplier runs, or a model a supplier provides to your agent, sits inside such an arrangement.
What is policy as code for AI agents?
Writing what an agent may do as a machine-checked document (which tools, on which data, within which limits, and which calls need a person) so a gateway or runtime can check every call against it before it runs, and the policy itself can be versioned, reviewed and approved like any other control.
What is Know Your Agent?
The agent counterpart of know-your-customer: confirming that each agent is identified, bound to the policy it runs under, attested by the runtime that executes it and, where the institution uses one, listed in its identity directory, so every action can be traced to one agent and one approved policy.
How do you stop an AI agent that misbehaves?
With a kill switch held by a named person: the agent's policy is suspended so every call is refused, the suspension is recorded, and an incident is opened for the owner and the risk function. Monitoring that detects drift or breaches should propose the suspension, and a person should decide it.
What software helps banks govern AI agents?
Look for software that keeps agents in the same inventory as models, gives each an identity, enforces a written policy before every tool call, holds high-risk actions for a person, separates the developer from approvals, monitors decisions live, can suspend an agent, and keeps an audit trail an examiner can verify. MINERVA Studio is built for that record, for Canadian federally regulated financial institutions.
What does MINERVA do for agentic AI governance?
MINERVA puts every AI agent under a written policy as code, deny by default, layered under the guideline's floor, the institution's ceiling and each vendor's passport. It holds high-risk calls for a person with the right role, refuses the agent's own developer, shows every decision live in a control room with each agent's Know Your Agent reading, lets the named holder suspend an agent, and keeps every decision on a hash-chained, time-stamped record an examiner can verify offline.
This page is a plain-language summary, not legal advice. For any decision, read OSFI’s guidelines themselves.