The platform For banks and insurers running AI agents
An agentic AI governance platform, for regulated institutions.
Every agent in one inventory with its own identity, a policy checked before each tool call, high-risk calls held for a person, a kill switch with a name on it, and a record your examiner can verify.
01 What OSFI’s AI bulletin asks, and what the platform does
In July 2026 OSFI published a technology risk bulletin on generative and agentic AI. Its practices for agents are on the left in plain words; what MINERVA does about each today is on the right. Our plain-language summary of the bulletin covers the rest of it.
| What the bulletin asks | What MINERVA does |
|---|---|
| Give each agent its own non-human identity | Every agent is a sheet in the inventory with an owner, a developer, an approver and a kill-switch holder. Know Your Agent shows whether it is identified, bound to its policy, attested by its runtime and listed in your directory. |
| Least privilege and scoped permissions, tools on an allow-list | A policy permits named tools on named data scopes and refuses everything else by default; a forbid wins whatever the order. |
| No shared or inherited credentials | Each decided policy is signed and names one agent's identity, so a policy cannot be lifted from one agent and used by another. |
| Approval checkpoints for high-risk actions | Payments, customer decisions and data shares are held until a person holding a releasing role approves the exact call; the agent's developer is refused by name. |
| Limits on autonomy | Limit statements cap budgets and volumes per session; the institution's ceiling and each vendor's passport can only narrow what an agent may do. |
| Log and review agent activity | A live feed shows the newest decisions across every agent (permitted, refused, held, released) and every record is hash-chained. |
| Human oversight and accountability | Policies change only through a proposal a person decides; the person who built the agent cannot approve its policy or release its held calls. |
| Incident response for AI | A record under a policy nobody decided, a breach or a call waiting too long opens an incident routed to the owner, the approver and the kill-switch holder. |
| Third parties disclose their AI | A vendor's passport declares the tools its agents may use; the models inside a supplier's software are declared on the supplier's sheet. |
| Map AI dependencies to critical operations | Every agent's suppliers and models are strings on one record, so the exposure to a failing supplier is read hop by hop. |
02 The eight controls, read for every agent
- In the inventory
- Owner, purpose, tools, data scopes, models used and suppliers, beside the institution's models.
- Identity
- Identified, bound to one decided policy, attested by the runtime, and in the directory where you connect Microsoft Entra ID.
- A decided policy
- Permit, forbid, hold, limit and escalate statements, deny by default, changed only through a person's decision.
- Separation of duties
- The builder is never the approver, under any name the account has carried.
- Held calls
- High-risk calls wait for a person with the right role.
- Limits and monitoring
- Budgets and volumes capped; drift and breaches opened as incidents.
- A kill switch
- The named holder suspends the agent at once; anyone else can only propose it. The suspension is recorded.
- Evidence
- Every decision, policy change and release time-stamped and exported in a packet an examiner verifies offline.
03 From written rule to proof
- Write the policy
- In a visual editor or as JSON, validated against the agent's tools and scopes, with a 'try a call' simulator that shows what would be permitted, refused or held.
- Decide it
- A named approver decides; the decision is a row on the record and the policy is compiled into a signed key that names that decision.
- Enforce it
- The gateway or your own agent runtime checks every tool call against the decided key before it runs, and sends its decision records back.
- Watch it
- The control room shows decisions live, keys closing within 30 days, held calls waiting and incidents opened by the monitor.
- Prove it
- The evidence packet carries every agent's policies, decisions and releases for an examiner to verify without our systems.
04 What it does not do
MINERVA does not run your agents, choose their models or make an institution compliant. A call that never passes through the gateway, or a runtime that does not check the policy, is outside it: enforcement covers the path the calls take. Pricing is on our OSFI E‑23 platform page: agents are on the same record and the same subscription as the models.
05 Questions people ask
What is an agentic AI governance platform?
Software that keeps an inventory of an institution's AI agents and controls what they may do: an identity for each agent, a written policy checked before each tool call, a person's approval for high-risk actions, limits, monitoring, a kill switch and a record an examiner can check.
What does OSFI expect for AI agents?
OSFI's July 2026 technology risk bulletin on generative and agentic AI sets out sound practices that build on Guidelines B-13, E-21 and B-10: unique identities for agents, least privilege and scoped permissions, no shared credentials, approval for high-risk actions, logging and review of agent activity, and limits on autonomy. Guideline E-23 also brings AI and autonomous models into model risk management from 1 May 2027.
Does MINERVA run our AI agents?
No. Your agents run where they run today. MINERVA keeps their inventory and policies, and the gateway or your runtime checks each tool call against the decided policy and reports back.
How is a high-risk agent action approved?
The call is held. A person holding a releasing role approves that call; the agent's developer is refused, and the release is recorded with who gave it.
Who can stop an agent?
The person named as the agent's kill-switch holder suspends it at once. Anyone else can propose a suspension, which that holder decides. Either way it is recorded.
Does it work with Microsoft Entra ID?
An agent's Entra identity can be recorded on its sheet, and Know Your Agent shows it as in the directory. MINERVA does not query Entra; it says 'recorded, not checked' unless your Microsoft directory is connected and enforced.
Can an examiner see what our agents did?
Yes. Every decision is hash-chained and time-stamped, an examiner can be given a time-boxed read-only login, and the evidence packet can be verified offline.
Guides: Agentic AI governance, explained · Policy as code · Know Your Agent · OSFI’s AI bulletin · AI vendor risk software.