Page 1: the one-pager
The week in one paragraph. Supervisors are collecting information about agents but have not written prescriptive rules. CITED F01 The FSB's practices give boards a reference point. VERIFIED F02 Reuters reports the final report asks for risk-based triggers for agents to seek human approval. CITED F03 Until rules arrive, your records are your answer.
| Document | What it must show | Who asked | AEGIS pillar | Owner | Ready? |
|---|---|---|---|---|---|
| 1. Agent register | Every agent, its purpose, model and version, data access, owner, and vendor | US examiners; ECB; MAS VERIFIED F04; NY PSC VERIFIED F05 | P2 | CRO + CIO | Y N |
| 2. Authority and approval record | What each agent may do alone, the human-approval triggers, and who approved them | FSB (per Reuters); US examiners | P4 | Business line head | Y N |
| 3. Action log | Every agent action, retrievable by agent, date and customer, in a readable format | US examiners | P6 | CISO | Y N |
| 4. Halt-and-restart runbook | How to stop one agent or all agents, who can, and a dated test result | US examiners; ECB CITED F06 | P6 | COO + CISO | Y N |
| 5. Model-change and third-party plan | Vendor and model origin, retirement dates, revalidation steps, exit options | ECB; US examiners; OpenAI retirement date VERIFIED F07 | P7 | CRO (model risk) | Y N |
Workforce-readiness box
Name a person for each verb: who can grant an agent entitlement, halt a run, retrieve the transcript, and redesign the workflow. That list comes from myndQ's Skills Circuits description. PROPRIETARY F08 Context: Bank of America headcount is down nearly 3,500 year over year as it automates (company-reported). VERIFIED F09 When roles shrink, oversight skills have to be assessed, not assumed.
Monday actions. (1) Ask each business line for its agent list by Friday. (2) Pick one agent and run a timed halt test. (3) List every workflow on GPT-4o or GPT-4.1 and set a revalidation date before January 14, 2027. VERIFIED F07
2. What each supervisor asked, in their words or the reporter's
- Fed, OCC and FDIC (reported Oct 13). How agents are limited, monitored and approved; whether decisions can be audited; whether humans stay in key decisions; how autonomous systems would be shut down; use of Chinese-developed technology. Not yet prescriptive. CITED F01
- FSB (Oct 15). 12 sound practices; boards and senior management "strongly encouraged" to reference them. VERIFIED F02
- ECB (deadline Oct 31). Map AI use and suppliers; switch-off and controlled restart. CITED F06
- MAS (Oct 7). Inventory and oversight expectations from October 7, 2027. VERIFIED F04
- FCA (Oct 13 hearing). Wants to become an "agentic regulator"; no AI-specific rules planned for firms. CITED F10
- Baseline. SR 26-2 places generative and agentic AI outside its scope. VERIFIED F11
3. Sector overlays
Financial services
Add agent-to-agent payments to document 2. Amex's framework issues a scoped credential tied to a customer-approved intent, which doubles as evidence. CITED F12 JPMorgan said outside agents will not be let inside its systems. VERIFIED F13
Healthcare
Document 3 is where health systems are most exposed: Epic's AI-assisted test found configurations that allowed record viewing with no audit entry (company-reported). VERIFIED F14 The AMA's framework says clinical authority must be "earned through evidence." VERIFIED F15 FDA docket comments close October 19. VERIFIED F16
Manufacturing
Extend document 1 to connected devices that can run code. Anthropic's research showed a system copying itself across 15 low-cost TV boxes. VERIFIED F17
Energy and utilities
New York utilities must file AI-use inventories within 60 days of the September 17 order. VERIFIED F05 FERC sent large-load cost and curtailment questions back toward states. CITED F18
4. Implementation architecture: where each document lives
| Layer | System of record | Evidence it produces | AEGIS control group |
|---|---|---|---|
| Data sources | Data catalog with agent read and write scopes | Document 1 fields | Objective & Boundary Definition |
| Models and agents | Model and agent registry with versions and origin | Documents 1 and 5 | Regulatory Compliance for Agents |
| Identity | One identity per agent, revocable in one action | Documents 2 and 4 | Least-Privilege Access Architecture |
| Orchestration | Workflow engine with approval thresholds and a stop control | Documents 2 and 4 | Multi-Agent Orchestration Controls |
| Human-in-the-loop | Approval queue with reviewer identity and time | Document 2 | Human-in-the-Loop (HITL) Gates |
| Monitoring | Append-only action log exported to the SIEM | Document 3 | Immutable Action Audit Trail |
Pillar and control-group names follow the published A.D. AEGIS model. PROPRIETARY F19 Platform examples this week: Microsoft gives each always-on Copilot Studio agent its own Microsoft 365 account governed through Agent 365. CITED F20
5. A 10-business-day sprint
- Days 1-2: collect agent lists from each line; reconcile with IT's list (vendor surveys suggest most agents in use were not approved by IT). VERIFIED F21
- Days 3-4: write approval triggers for the top five agents by customer impact.
- Days 5-6: confirm each top-five agent's actions can be exported by date and customer.
- Day 7: run and record a halt test on one agent; time it.
- Days 8-9: list models and retirement dates; schedule revalidation before January 14, 2027.
- Day 10: brief the board on the five documents and the gaps.
6. Readiness check
0 of 6 ready.
Tallies from this week's poll and tabletop will be published once their response windows close.
7. Evidence base
- F01 CITED Reuters exclusive, October 13, 2026 (unnamed sources): Fed, OCC and FDIC examiners asking banks how AI agents are limited, monitored, approved, audited and shut down, whether humans stay in key decisions, and about Chinese-developed technology; supervisors "not yet prescriptive." Agencies declined to comment. Analysis: BERI. https://money.usnews.com/investing/news/articles/2026-10-13/exclusive-banking-watchdogs-ramp-up-ai-scrutiny-as-stability-fears-mount-sources-say https://www.beri.net/article/fed-occ-fdic-bank-ai-agent-supervisory-questions-shutdown-audit-trail-chinese-models-sr-26-2-gap
- F02 VERIFIED Financial Stability Board, "FSB finalises sound practices for the responsible adoption of artificial intelligence (AI)," October 15, 2026: 12 non-binding sound practices (4 organization-wide governance, 8 AI lifecycle); board and senior management "strongly encouraged" to reference them. Independent: Forbes, October 15, 2026. https://www.fsb.org/2026/10/fsb-finalises-sound-practices-for-the-responsible-adoption-of-artificial-intelligence-ai/ https://www.fsb.org/2026/10/sound-practices-for-responsible-adoption-of-artificial-intelligence-ai-final-report/ https://www.forbes.com/sites/mayrarodriguezvalladares/2026/10/15/trust-but-verify-how-regulators-want-banks-to-use-ai/
- F03 CITED Reuters (Phoebe Seers), October 15, 2026, via syndication: FSB final guidance calls for risk-based triggers for AI agents to seek human approval; "synthetic employees" framing dropped. The FSB press release itself does not mention agents. https://www.933thedrive.com/2026/10/14/global-financial-watchdog-calls-for-more-human-oversight-of-agentic-ai/
- F04 VERIFIED Monetary Authority of Singapore, October 7, 2026: supervisory expectations on responsible AI adoption; inventory and oversight from October 7, 2027; lifecycle and third-party controls from October 7, 2028. Independent: Tech Times. https://www.mas.gov.sg/news/media-releases/2026/mas-sets-out-supervisory-expectations-on-responsible-ai-adoption-by-financial-institutions https://www.techtimes.com/articles/328877/20261013/mas-ends-voluntary-ai-rules-banks-third-party-vendors-cannot-shield-institutions-risk.htm
- F05 VERIFIED New York PSC order, September 17, 2026 (Case 26-M-0552): utilities to file AI-use inventories within 60 days. Utility Dive; WAMC. https://www.utilitydive.com/news/new-york-audits-utility-ai-use-cites-risk-in-growing-dependency/831242/ https://www.wamc.org/2026-09-17/new-york-to-begin-monitoring-utilities-use-of-ai
- F06 CITED Reuters, October 13, 2026, and KPMG summary: ECB deadline of October 31, 2026 for significant banks' plans against AI-enabled cyber threats, including mapping AI use and suppliers and a controlled switch-off and restart. https://money.usnews.com/investing/news/articles/2026-10-13/exclusive-banking-watchdogs-ramp-up-ai-scrutiny-as-stability-fears-mount-sources-say https://kpmg.com/de/en/insights/finance-and-risk/ezb-calls-for-an-action-plan-to-combat-AI-driven-cyberattacks.html
- F07 VERIFIED OpenAI API deprecations page, announced October 14, 2026: GPT-4o, GPT-4o mini, GPT-4.1 and GPT-4.1 mini removed from the API on January 14, 2027; recommended replacement gpt-6-luna; fine-tuned versions follow the base-model schedule. Independent: Releasebot. https://developers.openai.com/api/docs/deprecations https://releasebot.io/updates/openai
- F08 PROPRIETARY myndQ, AI workforce intelligence by Ariana Digital LLC (myndq.ai, read October 16, 2026): Skills Circuits (Assess, Coach, Enrich), Hiring Intelligence, TalentHub, Trust and responsible AI, For Talent. Offering descriptions quoted from the live page. https://myndq.ai/home.html https://talent.myndq.ai
- F09 VERIFIED Bank of America third-quarter 2026 earnings call, October 14, 2026 (company-reported): CFO Alastair Borthwick, headcount "down nearly 3,500 from a year ago" as the bank automates processes; CEO Brian Moynihan, about 130 AI projects implemented and an AI benefit expected to reach $700 million next year (company forecast). Independent transcript: Benzinga. https://www.fool.com/earnings/call-transcripts/2026/10/14/bofa-bac-q3-2026-earnings-call-transcript/ https://www.benzinga.com/news/26/10/62355886/bank-america-q3-2026-earnings-call-transcript
- F10 CITED UK FCA leaders before the Commons Treasury Committee, October 13, 2026 (reported October 15-16): the FCA wants to become an "agentic regulator" and does not plan AI-specific rules for firms. No transcript seen. https://www.resultsense.com/news/2026-10-16-fca-agentic-regulator-automation/ https://www.cryptopolitan.com/fca-agentic-supervision-no-new-rules/
- F11 VERIFIED Federal Reserve SR 26-2 and OCC Bulletin 2026-13, April 17, 2026: revised model risk management guidance; generative and agentic AI outside its scope. https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm https://occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html
- F12 CITED American Express "Intent Intelligence" framework, October 14, 2026: customer-approved purchase intent produces an Intent ID and Proof of Intent Token; the agent receives a scoped payment credential (company framework; ACE Developer Kit). https://thepaypers.com/payments/news/american-express-publishes-framework-for-agentic-commerce-intent https://fourweekmba.com/ai-amex-wants-ai-shopping-agents-to-prove-what-you-approved/
- F13 VERIFIED JPMorgan Chase third-quarter 2026 earnings call, October 13, 2026 (company-reported): Jamie Dimon on "rogue agents" and not letting outside agents inside; CFO Jeremy Barnum on AI spend of "something like 700 [million] annually." https://www.fool.com/earnings/call-transcripts/2026/10/13/jpmorgan-chase-jpm-q3-2026-earnings-call-transcript/ https://www.forbes.com/sites/fionariley/2026/10/13/jpmorgans-jamie-dimon-warns-of-rogue-ai-agents-urges-customers-to-understand-risks/
- F14 VERIFIED Becker's and PYMNTS, October 2026: Epic used Anthropic's Claude Mythos to test its software and found configurations allowing patient-record viewing without an audit-trail entry; remediation under way (company-reported). https://www.beckershospitalreview.com/healthcare-information-technology/ehrs/epic-races-to-patch-flaws-that-could-allow-undetected-record-access/ https://www.pymnts.com/news/artificial-intelligence/2026/epics-ai-security-test-exposes-untraceable-patient-data-access/
- F15 VERIFIED American Medical Association governance framework for agentic AI assuming clinical functions, October 13, 2026: "clinical authority must be earned through evidence and maintained through ongoing performance." Independent: Becker's. https://www.ama-assn.org/practice-management/digital-health/governance-framework-agentic-ai-assuming-clinical-functions https://www.beckershospitalreview.com/healthcare-information-technology/digital-health/ama-agentic-ai-must-earn-clinical-authority-through-evidence/
- F16 VERIFIED FDA request for feedback on generative-AI-enabled medical devices, docket FDA-2026-N-7874; comments close October 19, 2026 (discussion paper, not a rule). Independent: National Law Review. https://www.fda.gov/news-events/press-announcements/fda-seeks-public-feedback-inform-regulatory-approach-generative-ai-enabled-medical-devices https://natlawreview.com/article/fda-seeks-public-feedback-regulatory-approach-generative-ai-enabled-medical-devices
- F17 VERIFIED Anthropic Frontier Red Team research, October 12, 2026: in a test, a system replicated itself without human help across 15 low-cost TV boxes; small models may soon be able to copy themselves across cheap IoT devices (company research). Independent: Good Morning America. https://www.anthropic.com/research/self-replicating-ai https://www.goodmorningamerica.com/news/story/anthropic-warns-ai-models-copy-small-devices-137220664
- F18 CITED Utility Dive and The Dominion Post, October 12-13, 2026: FERC order of October 9 approves PJM's 50 MW large-load definition and registry, rejects the interim resource adequacy service and bring-your-own-capacity rules on state-jurisdiction grounds. https://www.utilitydive.com/news/ferc-pjm-large-load-interconnection-iras-byonc/832716/ https://www.dominionpost.com/2026/10/13/ferc-oks-part-of-pjms-data-center-plan-rejects-the-rest/
- F19 PROPRIETARY A.D. AEGIS operating model (Agentic Enterprise Governance & Intelligence Standard), Ariana.Digital: seven pillars (P1 Governance Architecture, P2 AI System Inventory, P3 Risk & Impact Assessment, P4 Controls & Human Oversight, P5 Transparency & Rights, P6 Monitoring & Response, P7 Regulatory Intelligence & Evolution) and agentic control groups, as published October 16, 2026. Practitioner model, not a regulatory standard. https://ariana.digital/AI-governance.html
- F20 CITED Microsoft Copilot Studio, October 15, 2026, via Frontier early access: always-on business-process agents that start from an email or schedule, each with its own Microsoft 365 account and scoped permissions, governed through Agent 365 (company blog; independent write-up). https://www.microsoft.com/en-us/copilot/blog/copilot-studio/delegate-shared-business-processes-to-agents-that-are-more-persistent-and-proactive-with-microsoft-copilot-studio/ https://futurework.blog/2026/10/16/new-in-frontier-delegate-business-processes-to-copilot-studio-agents/
- F21 VERIFIED Workato survey by Censuswide, October 13, 2026 (vendor survey; 1,001 US IT leaders): 62% say most agents in use were not approved by IT; 74% expect to be held accountable for agents they do not fully control. Independent: CIO Dive. https://www.businesswire.com/news/home/20261013432214/en/New-Workato-Survey-Finds-74-of-IT-Leaders-Expect-to-Be-Held-Accountable-for-AI-Agents-They-Dont-Fully-Control https://www.ciodive.com/news/it-execs-brace-ai-agent-security-incidents/832903/
Ariana Digital LLC · Reg-Ready Field Note 2026-10-16. Companion to the Friday weekly digest. Labels: VERIFIED (primary plus independent), CITED (one source or secondary), PROPRIETARY (Ariana Digital or myndQ material). Not legal advice.