What Belongs in an AI Agent Record

Summarize and analyze this article with

Chat GPT

Perplexity

Grok

Google AI

Claude

The question

What does an inventory entry for an AI agent need to contain so that it stands up when a supervisor asks about it? A model record says what the model is and who validated it. An agent record has to say which agent acted, what it was allowed to touch, who answers for it, and how it is stopped. Two documents published in October 2026 describe parts of that record. The Financial Stability Board’s final report of 15 October 2026, Sound Practices for Responsible Adoption of AI, sets out twelve nonbinding sound practices. The Financial Conduct Authority’s good-and-poor-practice page of 19 October 2026 describes what it has seen work and fail, and says its existing rules already apply. Neither creates a new rule. This is general information and not legal advice.

1. Identity and lineage

Give every deployed agent its own identifier, separate from human user accounts and from shared service accounts. The FSB report describes assigning individual unique identifiers to each AI agent so a firm can see which actions it took and which humans configured and oversaw it.

Record	What it proves	The failure it prevents
Agent register	Every agent, its owner, reach, identity, and autonomy	An agent nobody inventoried, acting on broad access
Shutdown procedure, tested	That the off switch works, with a dated result	A procedure that has never been run
Approval map	Which actions execute free, approved, or never	An agent technically able to take a prohibited action
Audit trail	Every action tied to an identity and an approval	Logs that cannot reconstruct what the agent did

2. Permissions, recorded as a set

List every tool, API, system, and data store the agent can reach, along with whether each grant is read, write, or execute. The FSB warns that risk from an agent’s access may compound multiplicatively, rather than additively, as its permissions expand. Record the combination, not just the items, and log who approved it and when. Capture each tool or system with its access level; the data classifications in reach, such as customer, payment, or health data; the approver and approval date for the current permission set; and the trigger for a fresh review, which should be any added tool, data source, or write permission.

3. Accountability and autonomy limits

Name one accountable individual for the agentic use case. Among its nonbinding sound practices, the FSB says financial institutions assign and document accountable individuals for each AI agentic use case. The FCA links AI oversight to the Senior Managers and Certification Regime while noting it does not expect senior managers to be technical specialists, so the owner needs a plain-language description of what the agent may and may not do. Capture the accountable owner and a deputy; the decisions the agent may take alone and those that need a human; the risk tolerance agreed at launch and the date of the last reassessment; and the escalation route when the agent hits a limit.

4. Stop, evidence, and retirement

The FSB lists implementing and testing risk-based kill-switch mechanisms that can pause, limit, override, or remove an agent’s access where appropriate. Record each test, not just the design. Capture the stop mechanism and who can trigger it; the date of the last stop test, the time to halt, and what was left in flight; the logging in place, covering prompts, outputs, tool calls, model version, and human decisions; and the criteria for retiring the agent, with the date they were last checked.

What usually goes wrong

The record gets built after the agent ships. The FCA lists this directly as poor practice: retrofitting governance after deployment proved difficult and left gaps in accountability. It also names firms that relied on vendors’ assurances without challenging or testing them, which is where agents inside purchased platforms slip through.
The retirement field stays blank. A Gartner survey of 2,002 CIOs and technology executives, published 19 October 2026, found that only 17 percent reported having guidelines for abandoning low-value AI initiatives already in production, and only 31 percent reported guidelines for when an AI pilot should not move to production. Gartner found organizations with those guidelines were 2.6 and 2.3 times more likely, respectively, to be vanguards, its term for CIOs delivering better business outcomes while also reporting high CEO-perceived AI value. An agent with no exit criteria keeps accumulating permissions instead.

Where PiTech fits

PiTech Solutions helps regulated organizations build agent inventories that connect to the model records and access controls they already run: unique agent identity and lineage, permissions recorded as a set with approvers, a named accountable owner with plain-language autonomy limits, and tested stop mechanisms with retirement criteria. It builds the record into deployment rather than after it, which is the failure mode the FCA names. It connects naturally to the AI inventory and model governance and the access controls already in place. Delivery runs under CMMI Level 3 and ISO 27001, 9001, and 42001 certifications. See AI, GenAI and ML, the banking practice, and Data Solutions. PiTech Solutions Inc. is headquartered in Durham, North Carolina (UEI GNLRY5LNNVH6, CAGE 530K4) and is distinct from similarly named companies.

The bottom line

Start with the agents already live, not the ones on the roadmap, and fill in identity, permissions, and owner before anything else. An agent record that captures identity and lineage, permissions as a set, accountability and autonomy limits, and tested stop and retirement criteria is the record that stands up when a supervisor asks about it.

Frequently Asked Questions (FAQs)

What should an AI agent inventory record contain?

More than a model record does. Beyond linking to the underlying model, an agent record has to capture identity and lineage (a unique identifier separate from human and shared accounts, status, environment, and vendor); permissions recorded as a set (every tool, system, and data store the agent can reach, with access levels, approver, and a review trigger); accountability and autonomy limits (a named accountable owner, the decisions the agent may take alone versus those needing a human, and the escalation route); and stop, evidence, and retirement (the kill-switch mechanism, the date and result of the last stop test, the logging in place, and retirement criteria). These four groups describe which agent acted, what it could touch, who answers for it, and how it is stopped.

Why does an AI agent need its own unique identifier?

So the firm can attribute actions to the agent and see which humans configured and oversaw it. The FSB’s final report describes assigning individual unique identifiers to each AI agent for exactly this reason. When an agent shares a human user account or a general service account, its actions become indistinguishable from others’ in the logs, which destroys attribution and makes it impossible to reconstruct what the agent did or to stop it without affecting other workflows. A unique identifier, separate from human accounts and shared service accounts, is the foundation the rest of the record rests on, because every permission, approval, and logged action ties back to it. Without it, the record cannot answer which agent acted.

What does it mean that agent permissions compound multiplicatively?

The FSB warns that risk from an agent’s access may compound multiplicatively, rather than additively, as its permissions expand, meaning that combining capabilities can create risks greater than the sum of the individual grants. An agent that can both read sensitive data and send external communication is riskier than the two permissions considered separately, because together they enable data exfiltration that neither allows alone. The practical implication is that an agent record must capture the combination of permissions, not just a list of items, and that adding any tool, data source, or write permission should trigger a fresh review of the whole set. Managing agent access as a combination, with an approver and a review trigger, is how a firm controls this compounding risk.

Who should be accountable for an AI agent?

One named individual per agentic use case, with a deputy. The FSB’s sound practices say financial institutions should assign and document accountable individuals for each AI agentic use case, and the FCA links AI oversight to the Senior Managers and Certification Regime. Importantly, the FCA notes it does not expect senior managers to be technical specialists, which means the accountable owner needs a plain-language description of what the agent may and may not do rather than a technical specification they cannot evaluate. The record should name the owner and deputy, state the decisions the agent may take alone versus those requiring a human, record the agreed risk tolerance and its last reassessment, and define the escalation route when the agent hits a limit.

What stop and retirement information should the record hold?

The record should capture the stop mechanism and who can trigger it, the date of the last stop test with the time to halt and what was left in flight, the logging in place (prompts, outputs, tool calls, model version, human decisions), and the criteria for retiring the agent with the date they were last checked. The FSB lists implementing and testing risk-based kill-switch mechanisms that can pause, limit, override, or remove an agent’s access, and emphasizes recording each test, not just the design. The retirement criteria matter because an agent with no exit conditions keeps running and accumulating permissions indefinitely, and survey data suggests few organizations have the guidelines that would fill this field, making it the one most often left blank.

What are the FSB sound practices for AI?

They are twelve nonbinding sound practices published by the Financial Stability Board in its final report of 15 October 2026, Sound Practices for Responsible Adoption of AI. The first four emphasize organization-wide AI governance (strategy, governance and accountability, risk appetite, and organizational adaptability), and the remaining eight set out a framework for managing AI risk across the lifecycle from inception to retirement, including data governance and the management of AI-related cyber, ICT, and third-party risks. The practices are principles-based, proportionate, and technology-neutral, and the FSB presents them as a menu to complement existing standards rather than new regulatory obligations. For agent records specifically, the practices on unique identifiers, accountable individuals, and tested kill-switch mechanisms are the most directly relevant.

What does the FCA consider poor practice for AI governance?

The FCA’s good-and-poor-practice page of 19 October 2026 names several failures it has observed. Chief among them is retrofitting governance after deployment, which it found proved difficult and left gaps in accountability, and relying on vendors’ assurances without challenging or testing them, which is where AI inside purchased platforms tends to escape oversight. The FCA frames its observations against its existing rules, which it says already apply to AI, rather than against a new AI-specific regime, and it links AI oversight to the Senior Managers and Certification Regime. The practical lesson is to build the agent record into deployment from the start and to test vendor claims rather than accept them, because both failures are common and both leave the firm unable to evidence control.

Why is building the agent record after deployment a problem?

Because it is the exact failure the FCA calls out: retrofitting governance after deployment proved difficult and left gaps in accountability. When the record is assembled after an agent is already live, the people who configured it have moved on, the permissions have expanded without an approval trail, no stop test was ever run, and no retirement criteria were set. Reconstructing all of that under supervisory attention is slow and incomplete, and the gaps it leaves are precisely the ones an examiner probes. Building the record into deployment, so identity, permissions, owner, and stop mechanism are captured as the agent goes live, costs far less than reconstructing them later and produces a record that actually reflects what the agent does rather than a best guess.

How does an agent record connect to the model inventory?

An agent record links to, but does not replace, the model inventory. The underlying model or models an agent uses should be linked to their existing model inventory entries and versions, so the two records stay consistent and a change to a model is visible from the agent that relies on it. But the agent record carries information the model inventory does not: the agent’s identity, its permissions across systems, its accountable owner, its autonomy limits, and its stop mechanism. The right architecture treats the model inventory as the record of what predicts and the agent register as the record of what acts, cross-referenced so that an organization can trace from an agent to its models and from a model to the agents that depend on it.

Does PiTech help build AI agent inventories?

Yes. PiTech Solutions helps regulated organizations build agent inventories that connect to the model records and access controls they already run: unique agent identity and lineage linked to the model inventory, permissions recorded as a set with approvers and review triggers, a named accountable owner with plain-language autonomy limits, and tested stop mechanisms with retirement criteria. Critically, it builds the record into deployment rather than after it, which is the retrofitting failure the FCA names as poor practice. Delivery runs under CMMI Level 3 and ISO 27001, 9001, and 42001 certifications. PiTech is positioned as a specialist partner for agent governance in regulated industries at a mid-market price, starting with the agents already in production rather than the ones on the roadmap.