Lyzr Research · October 2026 · A 45 minute read
The Agentic AI Risk
Playbook for Banks.
SR 26-2 left agents out of scope. This playbook gives risk, compliance and audit leaders a chain of custody for every agent action, the ten questions examiners will ask, and a first week you can run.
To the CRO, the head of model risk, the CCO and the chief audit executive
SR 26-2 left agents out of scope. Your examiner did not.
The guidance stopped at a footnote.
On April 17, 2026 the Fed, OCC and FDIC replaced SR 11-7. In one footnote they put generative and agentic AI outside it and told banks to rely on their own governance.
The exam did not stop.
Reuters reported in June that examiners now raise AI governance, vendor risk and kill switches in routine exams, citing people with knowledge. In the UK, AI is a named PRA priority for 2026.
The bank that can show the chain passes.
Evidence counts only if every hand it passed through is recorded. An agent’s action is evidence of that kind. The bank that can show who acted, for whom, under what policy and what followed will pass the first exam that asks.
This is the argument
This is a playbook. It gives you seven links to build, ten questions to expect and a first week you can run. Where it describes Lyzr’s products it says so, and says what is live.
Lyzr Research, October 2026
The short version.
- The gapSR 26-2 replaced SR 11-7 on April 17, 2026 and put generative and agentic AI outside its scope. Nothing has replaced that part.
- The pressureExaminers already ask about AI governance, vendors and kill switches. The UK has named AI a 2026 PRA priority and put named executives on the hook.
- The ideaEvidence is admissible only if every hand it passed through is recorded. An agent’s action is evidence of the same kind.
- The seven linksIdentity, duty, authority, gate, record, review, produce. The chain is as strong as its weakest link.
- Exam dayTen questions to expect, and what an answer from the chain looks like.
- Where it breaksShadow agents, agents inherited inside vendor software, shared credentials and quiet autonomy creep.
- Where Lyzr fitsMadison maps agents to duties and holds the evidence. Opencontroller gives agents identity and gates their calls. Optimus keeps it on-prem.
What this covers
Nine parts, start to finish.
SR 26-2 and after
The gap
What the guidance left out, what examiners ask anyway, and who is accountable.
Chain of custody
The chain
Why evidence needs an unbroken record, and five old ideas that prove it.
The playbook
The seven links
Identity, duty, authority, gate, record, review and produce, each with a test.
Ten questions
Exam day
What examiners ask, and what an answer from the chain looks like.
Eight failure modes
Where it breaks
Shadow agents, inherited agents, autonomy creep and the rest.
CRO to CAE
By seat
What each seat owns, the US and UK compared, and a ninety day plan.
What to ask
Vendors
Twelve questions for any vendor, ours included.
Predictions
What next
What we expect, and what would prove us wrong.
Madison and the rest
Where Lyzr fits
What our products do for the chain, what is live, and a first week.
OCC Bulletin 2026-13, April 17, 2026
SR 26-2 is written for banks above $30 billion, and agents sit outside it for everyone.
The asset size above which the agencies expect the revised guidance to be most relevant
Below that line the guidance may still apply where a bank has significant model risk, but it is voluntary and principles-based. Generative and agentic AI are outside it at every size.
Most banks are below the line
OCC Bulletin 2026-13, Model Risk Management, Revised Guidance, April 17, 2026.
The argument in one line
Evidence is only admissible if every hand it passed through is recorded. An agent’s action is evidence of exactly that kind.
Courts call it chain of custody. NIST defines it as documenting each person who handled the evidence, when it moved and why. A bank’s agents hand work through tools, models, vendors and people. If any hand goes unrecorded, the action becomes an assertion. The rest of this playbook is how to keep the chain unbroken.
The gap.
SR 26-2 drew a line around what it covers, and agents are on the other side.
This part sets out what the guidance says, what examiners are asking anyway, who is accountable in the US and the UK, and why every bank is improvising.
April 17, 2026
Generative and agentic AI are called novel and rapidly evolving, so they sit outside the guidance.
The Fed issued SR 26-2, the OCC Bulletin 2026-13 and the FDIC FIL-15-2026, together. They replace SR 11-7 and the 2021 BSA and AML model risk statement. Footnote 3 leaves agents out, then says a bank’s own risk management and governance practices should decide the controls.
What the guidance does and does not settle
The guidance sets no enforceable standards, and the promised AI request for information has not appeared.
The OCC says the guidance does not set enforceable standards or prescriptive requirements. The agencies said they would issue an AI request for information in the near future. A tracker showed it had not reached the Federal Register by September 21, 2026.
The agencies’ message
The message from the agencies is to use what you already have.
The Fed’s vice chair for supervision said in May 2026, “Today, banks are relying on existing risk-management frameworks to guide their use of AI.”
The OCC’s May 2026 risk report backs a measured approach with guardrails and human oversight, and says banks may consider using agentic AI for material financial decisions.
GAO found in 2025 that regulators examine AI inside their safety and soundness, IT and compliance exams, under existing laws.
A footnote hands the question back to the bank
An examiner will hand it back to you in the exam.
June 2026
Reuters reports that AI is now a standing topic in routine OCC and Fed exams.
Citing three people with knowledge, the report says examiners ask about AI governance, vendor risk and kill switches, across lending, customer verification and sanctions screening. The sources are anonymous, so read it as a strong signal and not a rule.
The UK has no carve-out, and AI is on the supervisor’s agenda.
The Senior Managers regime
In the UK a named senior manager is on the hook for harm caused through AI.
The FCA told the Treasury Committee that individuals are on the hook for consumer harm through AI, with no new senior manager function needed. A trade body, Innovate Finance, argued that weak explainability sits awkwardly with having to show you understand and control the risk. The Committee asked the FCA for guidance by the end of 2026.
Credit unions
Credit unions have the least guidance of anyone.
GAO found in May 2025 that NCUA’s model risk management guidance is limited in scope and detail, and recommended it be updated.
NCUA also lacks the authority to examine technology service providers, the vendors behind much of the AI credit unions use.
Treasury’s framework covers credit unions, which makes it the nearest thing to a checklist they have.
The chain of custody works at any size
It is a discipline, not a budget line.
The framework that exists
Treasury and the Cyber Risk Institute offered a framework, and it is voluntary.
A sector framework
Issued in February 2026 with more than 100 financial institutions and agencies. It adapts the NIST AI Risk Management Framework for banks, credit unions and insurers.
230 control objectives
A stage questionnaire, a risk and control matrix, a guidebook and a reference guide. It includes objectives for AI documentation and repositories suitable for oversight and auditability.
As the yardstick
It is voluntary. A voluntary framework that nobody else has replaced tends to become the reference point when examiners ask how a firm governs AI.
Bank Director, 2026 Technology Survey
Most of the agents inside banks arrived inside someone else’s software.
Of banks using agentic AI, the share that say it is embedded in third-party applications
Only 30% of surveyed banks said they deploy agentic AI at all, and 48% of those use custom tools built in-house. The agents you must govern may not be the ones you built.
The register has to include vendors’ agents
Bank Director, 2026 Technology Survey, as reported by FinXTech, 2026.
Adoption, by whoever you ask
Surveys put agent adoption anywhere from 11% to 81%.
Deloitte found 11% of organizations with agentic AI in production. Bank Director found 30% of banks deploying it. Cambridge found 52% of financial firms in active adoption. A vendor survey said 81%. The spread comes from definitions. Nobody agrees what counts as an agent, which is the first thing an inventory has to settle.
IBM, Cost of a Data Breach Report, July 29, 2026
In IBM’s 2026 study, 92% of organizations with an AI-related breach lacked proper access controls on their AI.
Of organizations that reported an AI-related breach, the share lacking proper access controls for AI models and data
Across all breached organizations only 40% applied access controls to AI models and data, and 68% lacked AI governance. IBM sells identity products, so treat the framing with care. The direction is hard to argue with.
The gap is already being exploited
IBM, 2026 Cost of a Data Breach Report, conducted by Ponemon Institute, July 29, 2026.
The result
Thousands of banks are writing their own answer to the same question.
There is no checklist from the regulators for agents.
There is a voluntary framework with 230 objectives, and nobody is required to map to it.
Examiners are asking anyway, and vendors are shipping agents inside products you already own.
The bank that can show a chain of custody for every agent action will answer the first exam that asks.
Chain of custody.
Evidence is only admissible if every hand it passed through is recorded.
This part borrows a discipline from forensics and the courtroom, and shows why it fits agent risk better than a model inventory does. Five old ideas, each from a field that learned the hard way.
The definition
Chain of custody records who held the evidence, when it moved and why.
NIST defines it as a process that tracks evidence through collection, safeguarding and analysis by documenting each person who handled it, the date and time it moved, and the purpose of each transfer. Every hand leaves a tag. That is all it is, and it is enough to decide whether evidence counts.
The courtroom
A gap in the chain gives the other side a reason to challenge the evidence.
Under Federal Rule of Evidence 901, the party offering evidence must show that it is what they claim it is, and the chain is the usual way to show it. Minor gaps do not destroy a chain, and they weaken it. If tampering is shown, a judge can keep the evidence from the jury.
The translation
An agent’s action is evidence, and it passes through many hands.
The agent that acted, and the credential it used.
The tools and data it called, and the policy that let it.
The model behind it, and the vendor that hosts the model.
The person who approved the output, and the system that stored it.
When an examiner says show me, you are producing evidence. Every one of those hands is a possible break.
A model inventory says what exists. A chain says what happened.
What good looks like
A good chain has five properties.
Identified
Every hand is named, never a shared login.
Complete
No handoff goes unrecorded, including to vendors.
Ordered
Entries are time-stamped and in sequence.
Tamper-evident
An edit shows, because each entry points to the last.
Producible
You can hand it over on request, in hours.
Instrument 01 of 08 · A model worth borrowing
Chain of custody
NIST, and Federal Rule of Evidence 901
Evidence counts only if you can show every hand it passed through.
Why it matters here
Forensics learned this from cases lost on a single unrecorded handoff. A bag of evidence is sealed, tagged and signed over each time it moves, so that no one can later say it was swapped or altered. Apply it to agents and the unit of evidence is an action. Each action needs the same tag at each hand, naming who held it, when and why. The empty row in the picture is what an unregistered agent, a shared credential or a vendor-held log looks like to an examiner.
NIST Computer Security Resource Center glossary, chain of custody. Federal Rules of Evidence, Rule 901.
Instrument 02 of 08 · A model worth borrowing
Provenance
The art market, and museum acquisition practice
An object is worth what its record of ownership can prove.
Why it matters here
Two identical works can differ greatly in value because one has an unbroken ownership record and the other has a gap. Buyers pay for the record as much as for the object. A bank’s agent actions are the same. The decision may be sound, but without a record of who authorized it and what policy applied, you cannot prove that to anyone who was not in the room, and an examiner was never in the room.
Standard practice in art provenance research and museum acquisition policy.
Instrument 03 of 08 · A model worth borrowing
The cold chain
Food safety and vaccine logistics
Perishable goods are safe only if the temperature record shows no break.
Why it matters here
A shipment that was perfect for every hour but one is treated as suspect, because nobody can show what happened during the excursion. The record exists to rule things out, and a gap cannot rule anything out. Agents behave the same way. Ninety-nine recorded actions do not vouch for the hundredth. The chain has to be continuous, which is why sampling logs is not enough.
Common practice in cold chain monitoring for food and vaccines, including WHO guidance on vaccine storage.
Instrument 04 of 08 · A model worth borrowing
The flight recorder
Aviation safety, ICAO Annex 6
Record everything before anything goes wrong, because afterward is too late.
Why it matters here
Large aircraft carry flight data and voice recorders so investigators can rebuild what happened. The recorder is installed long before it is needed, and it records continuously, not when someone suspects trouble. That is the right posture for agents. The log you want after an incident is the one you were already writing, with enough context to rebuild what the agent saw, decided and did.
ICAO Annex 6, Operation of Aircraft, flight recorder requirements.
Instrument 05 of 08 · A model worth borrowing
Maker and checker
Segregation of duties, a core internal control principle
The person or system that makes something is never the one that approves it.
Why it matters here
Banks have run maker and checker for generations, so the idea needs no explaining to a risk committee. An agent is a maker, and sometimes a very fast one. The control is a named person as the checker, on the record, with the authority to reject. The failure mode is a checker who approves everything. A rejection rate of zero is a finding.
COSO Internal Control Integrated Framework, segregation of duties.
What they share
Five fields, one lesson.
The record is made at the time, before anyone knows it will be needed.
A gap does not prove wrongdoing
It removes your ability to prove anything.
An independent party checks the work, and the checker is named.
Banks already run most of these ideas
The task is to point them at agents.
The seven links.
Identity, duty, authority, gate, record, review and produce.
Each link has the same two slides. First what an examiner asks and why it matters, then a table with what good looks like, how it breaks and a test you can run this week. Treat each as a checklist item for every agent you run, whoever built it.
The playbook
Seven links, and the chain is only as strong as the weakest.
- Order matters. You cannot map a duty to an agent you have not identified.
- Build in this order, and test each link on its own.
- Then test the whole chain with a mock examiner request.
Link 1 of 7, Identity
If an agent has no name, nothing it does can be attributed.
An inventory entry is not an identity. Identity means the agent presents a credential of its own on every call, separate from any person’s and from other agents’. It has an accountable owner, a purpose in plain words and a scope. A shared service account is the first break, because five agents behind one login look like one hand.
Identity at a glance.
Link 2 of 7, Duty
An agent that touches a regulated process inherits that process’s obligations.
A dispute agent touches Reg E. A lending agent touches fair lending. A screening agent touches sanctions rules. This link is the map from each agent to the obligations, policies and controls it touches. A rule change or an exam request can then find the agent, and you know which controls must test it.
Duty at a glance.
Link 3 of 7, Authority
An agent acts on someone’s authority, and the record has to say whose.
Agents rarely act for themselves. They act for a customer, an employee or a team. This link carries that person through every call, so the agent can never do more than the person could, and the record shows whose authority each action used. Without it, the agent did it becomes the answer to every question.
Authority at a glance.
Link 4 of 7, Gate
A policy that is only written down is advice. A policy in the request path is a control.
The gate sits between the agent and every tool, data source and model it calls. It checks each call against policy before it runs and refuses the ones that fail, with a recorded reason. Monitoring tells you what happened. The gate decides what can happen, and it includes a kill switch that works.
Gate at a glance.
Link 5 of 7, Record
If the record is written afterward, it is a reconstruction.
The record captures who acted, for whom, which policy applied, what was called, what came back and what the agent did next. It is written when the action happens, in a form that cannot be edited quietly. Each entry points to the one before it, so a gap shows. The log you want after an incident is the one you were already writing.
Record at a glance.
Link 6 of 7, Review
An agent cannot mark its own homework, and neither can its builder.
Review has two forms. A named person approves consequential outputs before they land, so the human decision is on the record. And an independent function tests the controls over the agent, the way the second and third lines test any other control, so that disagreement between them shows. This is maker and checker, applied.
Review at a glance.
Link 7 of 7, Produce
The chain only counts if you can hand it over.
An examiner asks. You walk backwards from the action to the agent, the person, the policy, the obligation and the evidence, and hand over a packet with the citation trail. Hours, not a war room. This is the link that turns the other six into an exam result.
Produce at a glance.
Try it on your own bank
How strong is your chain?
Seven honest answers. Be harsh. An examiner will be.
How strong is your chain
Answer all seven to see where it breaks.
A self-assessment, not an audit. Nothing you select here is sent anywhere.
Exam day.
Ten questions to expect, and what an answer from the chain looks like.
This part is a rehearsal. The questions below are paraphrased from the topics reported in exams and from the links in the chain. They are not an official list, and they are a fair test.
Ten questions to expect, the first five.
Ten questions to expect, the last five.
A worked example, illustrative
A Reg E dispute shows the whole chain in under twenty minutes.
A customer disputes a charge. An agent opens the case, reads the transaction and drafts a provisional credit. A named analyst approves it. A letter goes out. Six hands touched it, and each one left a tag. The times and names are invented, and the pattern is what an examiner will want to see for a real case.
The custody log for that dispute.
The packet
The packet is the action, the duty behind it, the approval and the trail that joins them.
An examiner asks about one dispute. You assemble the action record, the Reg E obligation and the policy that carries it, the approval with the exact version signed, and a citation trail that links each piece to the next. One analyst can do it in hours when the chain exists. Without it, it takes a room full of people and a deadline.
The honest answer
When you cannot answer, say what you can prove.
Say what the record shows, with the evidence.
Say what it does not show, and why.
Say how you will close the gap and by when, with a named owner.
A dated gap you found yourself reads as control. A confident guess that proves wrong reads as the opposite.
Do this before they do
A mock request takes an afternoon and finds the weakest link.
Pick one consequential agent action from last month.
Give it to someone who did not build the agent, with the ten questions above.
Ask them to reconstruct the decision, and time them.
List every point where they had to ask a person instead of a system.
Those points are your weak links
Fix them in order.
Where it breaks.
Eight ways a chain fails, and the first control for each.
Chains rarely fail where you expect. They fail at the handoff nobody owns. This part walks the eight breaks we see most often, then borrows two ideas from safety engineering and measurement to explain why.
Eight ways it breaks, the first four.
Eight ways it breaks, the last four.
Break 1, shadow agents
You cannot chain what you cannot see, and shadow AI is already expensive.
IBM’s 2025 study found one in five breaches involved shadow AI, adding about $670,000 to the cost where it was heavy, and only 37% of organizations had policies to manage or detect it. In 2026 more than two thirds of breached organizations said they lacked governance to limit shadow AI. Start with discovery, then offer an amnesty to register.
Break 2, inherited agents
Your third-party program probably does not ask which agents a vendor ships.
The interagency third-party guidance already reaches vendors. It rarely asks which agents come inside the product, what they can reach and what record they leave. Add three questions to every review. Does each agent have its own identity, what can it touch, and can you export its log in your own format.
Break 3, autonomy creep
Agents start as suggestions and end as decisions, unless someone writes down the steps.
The OCC’s May 2026 risk report backs human oversight in workflows and says banks may consider using agentic AI for material decisions. Between those two sentences is a slope. Define four levels in writing, from suggest to act and report. Moving an agent up a level is a decision with a named approver and a date, and it is recorded.
Instrument 06 of 08 · A model worth borrowing
The Swiss cheese model
James Reason, Human Error, 1990
Accidents happen when the holes in several defensive layers line up.
Why it matters here
Reason studied failures in aviation, medicine and nuclear power and found that no single defense fails alone. Each layer has holes, and harm needs the holes to align. For agents the layers are identity, the gate, the human approver and the independent test. The model’s lesson is practical. Do not hunt for one perfect control. Make sure the holes in your layers are in different places, and test whether they can line up.
James Reason, Human Error, Cambridge University Press, 1990. James Reason, Human error, models and management, BMJ, 2000.
Instrument 07 of 08 · A model worth borrowing
Goodhart’s law
Charles Goodhart, 1975, and Marilyn Strathern, 1997
When a measure becomes a target, it stops being a good measure.
Why it matters here
Tell a team its agent will be judged on a pass rate, and the pass rate will rise. Whether the agent got better is a separate question. The same applies to evaluations an agent has seen. This is why review needs an independent function, with test cases the builders do not control and a refresh schedule. An evaluation that never changes is training data in disguise.
Charles Goodhart, 1975. Marilyn Strathern, Improving ratings, audit in the British university system, 1997.
Who owns what.
Four seats, one chain, and no gaps between them.
The chain crosses every line of defense, so each seat owns links of it. This part sets out the three lines applied to agents, what each of the four seats should do, how the US and UK differ, and a ninety day plan.
Instrument 08 of 08 · A model worth borrowing
The Three Lines Model
The Institute of Internal Auditors, 2020 update
Management owns the risk, risk and compliance challenge it, and internal audit tests independently.
Why it matters here
The model gives a governing body, management with first and second line roles, and an independent internal audit function, plus external assurance providers who look in from outside. Applied to agents, the first line builds and runs them and owns the first five links. The second line sets the rules and tests the controls. Internal audit tests the second line’s work. The gap to avoid is the one between lines, where everyone assumes someone else owns the agent.
The Institute of Internal Auditors, The IIA’s Three Lines Model, 2020.
The chief risk officer owns the register and the appetite.
The head of model risk decides what to borrow from SR 26-2.
The chief compliance officer maps agents to duties and owns the packet.
The chief audit executive audits the chain, and tests the tests.
The US and UK, side by side.
A ninety day plan.
What to ask any vendor.
Twelve questions that work on anyone, including us.
Most of the chain will pass through someone else’s software. These questions turn the seven links into a vendor review. A good vendor will answer them without discomfort. Where the answer is vague, treat the link as broken.
Twelve vendor questions, the first six.
Twelve vendor questions, the last six.
Where your GRC tool fits
Your system of record and your chain of custody do different jobs.
GRC platforms hold obligations, policies and controls and track the status of work. That is a system of record, and you should keep it. The chain adds the links between those records and the agents acting on them, so that when a rule changes or an examiner asks, you can see what is stale and what an action touched.
Build it, buy it or extend what you have.
What comes next.
Five predictions, what would prove each wrong, and the strongest argument against this playbook.
Predictions are cheap, so each one comes with what would prove it wrong and what to watch for. The strongest argument against this playbook comes right after, because leaving it out would be dishonest.
Looking forward
Five things we expect to be held to.
A date
Each prediction names the year we expect it by.
A confidence
A rough number, so you can hold us to it.
Signals to watch
What would tell you early that it is happening.
What would prove us wrong
Written down before the fact.
Prediction 01 of 05 · Lyzr’s view
Within a year the agencies publish their AI request for information, and it asks how banks record what agents do.
Why we believe it
The agencies promised it in April 2026 and said it would cover generative and agentic AI. Questions about governance, vendors and kill switches already come up in exams. A formal request would put the same questions in writing.
What would prove us wrong
If the agencies decide agents fit existing model risk practice and drop the request, banks will keep improvising for longer.
Signals to watch
- The request appears in the Federal Register
- Its questions mention logging, identity or kill switches
- Trade groups ask for clarity on agent records
Prediction 02 of 05 · Lyzr’s view
Treasury’s FS AI RMF becomes the working checklist in exams, though it stays voluntary.
Why we believe it
A voluntary framework that nobody else has replaced becomes the reference point. Examiners need a shared vocabulary, and 230 control objectives are a ready one.
What would prove us wrong
If the agencies publish their own agent guidance in different terms, the FS AI RMF fades into a background reference.
Signals to watch
- Exam request lists cite FS AI RMF objectives
- Vendors answer questionnaires in its terms
- Banks report maturity against its stages
Prediction 03 of 05 · Lyzr’s view
The FCA publishes senior manager guidance for AI, and record-keeping is central to it.
Why we believe it
The Treasury Committee asked for it by the end of 2026. Firms told the Committee that unclear accountability was chilling adoption. The clearest answer is a record of what the agent did, for whom.
What would prove us wrong
If the FCA waits for the Mills Review to finish, the guidance may slip into 2028.
Signals to watch
- The FCA names a date for AI guidance
- Guidance cites reasonable steps and evidence
- Firms add agents to Statements of Responsibilities
Prediction 04 of 05 · Lyzr’s view
Banks add a line for agents to the model inventory and the third-party register.
Why we believe it
Both already exist and examiners already read both. An agent line in each is the cheapest way to answer the inventory question.
What would prove us wrong
If banks keep agents in a separate AI register that no examiner reads, the duplicate lists will drift apart.
Signals to watch
- Inventory templates gain an agent field
- Vendor reviews ask which agents ship in the product
- Internal audit plans cover the agent register
Prediction 05 of 05 · Lyzr’s view
A bank is criticized in public because it could not show what an agent did.
Why we believe it
A first order or finding that turns on an unrecorded agent action would move every other bank at once. The conditions for it already exist.
What would prove us wrong
If agent failures stay small and well contained, the first public case may be about something else.
Signals to watch
- A regulator cites agent records in a finding
- A bank discloses an agent incident in a filing
- Insurers ask for agent logs at renewal
The strongest argument against this playbook
A heavy chain may be overkill for low-risk agents, and the agencies may agree.
The argument
SR 26-2 is proportionate by design. Most agents draft emails and summarize documents, and a full chain of custody for those is cost without benefit.
Where it is right
Tier by materiality. A summarizing agent needs an identity and a log, and does not need a gate and an approver on every call.
Where it stops
Any agent that touches a customer outcome, a regulatory filing or a sanctions decision belongs in the chain. Those are the exam questions.
What would change our mind
Agency guidance that sets a lighter standard, and examiners who accept it.
Where Lyzr fits.
Madison, Opencontroller and Optimus, what is live, and a first week.
Lyzr publishes this playbook, so this is the one part where we describe our own products. We say what each does for the chain, what is live, and where you should look elsewhere. Everything here comes from Lyzr’s own materials.
Three products, seven links.
Lyzr Madison
Madison maps every agent to the duties it touches, and holds the evidence.
Madison holds a bank’s obligations, policies, procedures, controls, tests and evidence as one connected model. It extends that model to agents, so each agent is attached to what it touches. Its Third Party and AI Governance module holds the evidence. Madison proposes, and a named person approves. It reads your systems and never writes back to them.
Lyzr Opencontroller
Opencontroller gives every agent an identity, carries the human, and refuses out-of-policy calls.
Opencontroller sits in the request path. Each agent presents an identity of its own. The person it acts for travels with the call. Policy is checked before the call runs, and a call that fails is refused and logged. That is links one, three, four and part of five, enforced where it matters, in the path.
Lyzr Optimus
Optimus keeps all of it inside your walls.
Optimus is Lyzr’s on-premises appliance. It runs on your hardware, can run air-gapped, and makes no external calls. Lyzr lists it as shipping in Q4 2026, with pre-orders open. For a chain of custody this matters because evidence about your agents then stays where your agents run, under your retention rules and your keys.
What is live and what is coming, per Lyzr’s own materials.
Where Lyzr fits, and where to look elsewhere.
What a first week looks like.
Lyzr trust information, as shown in the Madison sales deck
Lyzr holds ISO 42001, the AI management system standard, alongside SOC 2 Type II and ISO 27001.
ISO 42001, the 2023 standard for AI management systems, held by the Lyzr platform, with SOC 2 Type II and ISO 27001 (2022)
Ask every vendor, including us, for the certificate and the scope. A certification covers a management system, so it tells you how the work is run, and it does not tell you that any one agent is safe.
Ask for the scope as well as the badge
Madison sales deck, Security and assurance, Lyzr platform, October 2026. Lyzr’s claims, not independently verified here.
About Lyzr
The full-stack agent infrastructure platform for enterprises and governments that want to own their intelligence.
Founded in New York in 2023. Agent Studio, Architect, Opencontroller, Open Cowork, Openfinetuner, Optimus and Madison cover building, governing, running and owning agents. Deploys in your AWS, Azure or GCP account, a dedicated tenant, SaaS, on bare metal, fully air-gapped, or on the Optimus appliance.
Backed by Rocketship.vc, BGV, Accenture Ventures, GFT, the Partnership Fund for New York City and Plug and Play.
Sources and notes
Every fact, and where it came from.
- OCC Bulletin 2026-13, Model Risk Management, Revised Guidance, April 17, 2026.
- OCC News Release 2026-29, OCC Issues Updated Model Risk Management Guidance, April 17, 2026.
- Federal Reserve SR 26-2 and FDIC FIL-15-2026, issued with the OCC bulletin, April 17, 2026.
- Quartz, U.S. bank regulators are making AI a core focus of every routine bank examination, June 12, 2026, relaying Reuters.
- Consumer Finance Insights, OCC Semiannual Risk Perspective coverage, May 2026.
- GAO-25-107197, Artificial Intelligence, Use and Oversight in Financial Services, May 19, 2025.
- U.S. Treasury, AI Lexicon and Financial Services AI Risk Management Framework, February 19, 2026, with the Cyber Risk Institute.
- Bank of England, PRA SS1/23, Model risk management principles for banks, in force May 17, 2024.
- UK House of Commons Treasury Committee, AI in financial services, January 20, 2026, with Bank of England and FCA responses.
- IBM, Cost of a Data Breach Report 2025 and 2026, conducted by Ponemon Institute, July 2025 and July 29, 2026.
- Bank Director, 2026 Technology Survey and 2026 Risk Survey, via FinXTech and Bank Director.
- Deloitte Tech Trends 2026, the Cambridge 2026 report on AI in financial services, and an nCino survey, as cited in trade coverage.
- NIST CSRC glossary, chain of custody, from NIST SP 800-72 and SP 800-101 Rev. 1.
- Lyzr, Madison sales deck and one-pager, October 2026. Vendor claims, not independently verified here.
Regulatory text is quoted from the issuing agencies where available. Surveys and press reports are labeled as such.
Sources and notes
The ideas, and who had them.
- Federal Rules of Evidence, Rule 901, authenticating or identifying evidence.The courtroom basis for the chain
- Provenance practice in the art market and museum acquisition policy.Value follows the record
- Cold chain monitoring in food safety and vaccine logistics, including WHO guidance.One excursion questions the batch
- ICAO Annex 6, flight recorder requirements.Record before you need it
- COSO Internal Control Integrated Framework, segregation of duties.Maker and checker
- James Reason, Human Error (1990), and Human error, models and management (BMJ, 2000).Holes line up
- Charles Goodhart (1975) and Marilyn Strathern (1997).Measures turn into targets
- The Institute of Internal Auditors, The IIA’s Three Lines Model (2020).Who owns which link
The playbook, the self-assessment, the predictions and the first week are our own, offered to be argued with.
Your next step
Bring one agent. Leave with its chain.
Thirty minutes, no slides. Pick the agent you worry about most, and we will show you where its chain would break, and whether Lyzr is the right fix.
01
Name it
We list the agent, its owner, its credential and the person it acts for.
02
Map it
We attach it to the duties it touches and find the controls that test it.
03
Prove it
We run a mock examiner request and time the answer.