What Should Regulated Enterprises Require From an Enterprise AI Agent Platform?

An auditor reviewing an autonomous KYC or claims decision wants to know what the agent did, which identity it acted under, and who approved the action. A vendor’s list of certifications answers none of those questions. Banks, insurers and health systems should judge AI agents for regulated enterprises by controls mapped to named regulations, and should prove each control works in a proof of concept before signing.

What regulated enterprises must require from an AI agent platform

Evaluate agent identity, audit trails, human-in-the-loop gates, PII redaction, data residency, private deployment and certifications. A platform is ready for a regulated workflow when four conditions hold:

• Every agent acts under its own scoped identity.
• Every action lands in a log an examiner will accept.
• High-risk actions stop for a person.
• Sensitive data stays redacted and inside the boundary the regulator expects.

Certifications set a floor, and they count only when the buyer reads them as third-party attestations with a defined scope.

Agent identity

Each agent needs a distinct non-human identity, permissions limited to its task, and a recorded link to the person or process that delegated authority. Shared service accounts fail this test because no log can attribute an action to a single agent.

Audit trails

The platform should record every input, tool call, output, rule applied and approval at the level of the individual action. It should keep those records in storage that reveals any alteration. Session summaries and model-written explanations fall short of the evidentiary bar.

Human-in-the-loop gates

Some actions should pause for a named approver: moving money, changing customer records, disclosing protected data, or deleting records. The enterprise sets those thresholds and can change them. Operators also need a way to halt an agent mid-task.

PII redaction

Personal data, protected health information (PHI), and cardholder data should be masked before they reach a model prompt, a trace, a log, or an embedding store (a database of numerical representations of text). Redaction applied only in the user interface leaves behind the copies that auditors and attackers find.

Data residency and private deployment

The buyer should know 3 things: where agent data rests, where model inference (the model’s processing of each request) runs, and which subprocessors (outside vendors that handle the data) touch it. For sensitive workloads, the buyer should be able to choose on-premises inside the customer firewall or a customer-controlled virtual private cloud (VPC).

Certifications

SOC 2 Type 2, ISO/IEC 27001, ISO/IEC 42001, a Health Insurance Portability and Accountability Act (HIPAA) business associate agreement (BAA), a Payment Card Industry Data Security Standard (PCI DSS) Attestation of Compliance, and General Data Protection Regulation (GDPR) mechanisms each attest to something specific. The buyer should confirm that the stated scope names the agent product itself.

Risks that make regulated agent deployment different

In regulated work, a stalled pilot becomes an examination finding, and Gartner predicted in June 2025 that over 40% of agentic AI projects will be canceled by the end of 2027 (Gartner, 2025). Gartner named inadequate risk controls as a cause, alongside escalating costs and unclear business value. Six failure modes make regulated deployment different:

• Cross-agent escalation: In September 2025, security researcher Rehberger showed a prompt-injected GitHub Copilot writing a malicious MCP server into Claude Code’s configuration. Claude Code then ran arbitrary code and could reconfigure Copilot in return. In August 2026, The Register reported Pillar Security research on Google’s Agent Development Kit for Python, where a prompt injection in a pull request let a low-privilege agent steer a more privileged one. Pillar called it the first real-world agent-to-agent exploitation method. Security teams reduce this risk by assigning separate identities and banning agents from writing to another agent’s configuration or permissions.
• Unverifiable financial actions: FINRA’s 2026 Annual Regulatory Oversight Report, released December 9, 2025, asks firms to consider how to track agent actions and decisions, where to place human-in-the-loop oversight, and how to limit agent behaviors. Debevoise & Plimpton notes it is the first FINRA report to discuss AI agents. An agent that changes an account without a reconstructable trail leaves the firm unable to show supervision under Rule 3110.
• Agent sprawl: Palo Alto Networks’ 2026 Identity Security Landscape reports 109 machine identities per human. The report is a vendor survey of 2,930 IT and security leaders, published under the Idira brand in May 2026. Gartner’s April 2026 guidance on agent sprawl calls for an agent inventory across sanctioned and shadow AI tools, plus defined identity, permissions and a life-cycle model to retire redundant agents. In May 2026, Gartner predicted that by 2027, 40% of enterprises will demote or decommission autonomous agents because of governance gaps found only after production incidents.
• Hallucinations: Vectara’s leaderboard uses its HHEM-2.3 model to score summaries of short documents. Its October 2026 snapshots show hallucination rates from 1.8% for the best model to above 10% for several frontier models. Those rates come from tasks where the source text sits in front of the model. An agent that invents a policy limit or an account number and then acts on it creates a loss. Deterministic rule checks on high-risk outputs limit that damage.
• Prompt injection: OWASP ranks prompt injection first in its 2025 Top 10 for LLM applications and states that it is unclear whether fool-proof prevention exists. Aim Security disclosed EchoLeak (CVE-2025-32711, CVSS 9.3) in Microsoft 365 Copilot in June 2025. EchoLeak was a zero-click flaw that let a remote attacker extract confidential data by sending an email; Aim Labs reported no in-the-wild exploitation. In July 2025, a malicious pull request placed a “wiper” prompt in the official Amazon Q Developer VS Code extension, version 1.84.0. AWS said a syntax error kept it from executing. No filter stops injection with certainty, so the defense sits in privilege limits and approval gates.
• Model drift: A study of five LLMs configured to be deterministic found accuracy variations of up to 15% across ten runs of the same tasks. A 2026 paper on enterprise conversational AI reports that pinned API model versions still change behavior subtly over time. Operators address this risk through version pinning, repeat-run testing and drift monitoring against a baseline.

Agent identity, least privilege, and action boundaries

Treat every agent as a non-human identity acting on delegated authority, with permissions no broader than the task and a credential that records whom it acts for. Regulators already write software into access rules: HIPAA’s access control standard at 45 Code of Federal Regulations (CFR) 164.312(a)(1) limits access to “persons or software programs” that have been granted access rights, and 164.312(a)(2)(i) requires a unique identifier for tracking identity. PCI DSS v4.x adds controls for application and system accounts, effective March 31, 2025:

• Requirement 7.2.5 assigns those accounts “the least privileges necessary for the operability of the system or application.”
• Requirement 8.6.1 restricts their interactive use and requires every action to be attributable to an individual user.
• Requirement 8.6.2 bars hard-coded passwords in files or scripts.

Four sources define how delegation to agents should work:

• Token exchange: OAuth 2.0 Token Exchange (RFC 8693) defines an act claim for the current actor and a may_act claim naming who may act on a subject’s behalf.
• Agent identity at NIST: NIST’s NCCoE released a concept paper on software and AI agent identity and authorization on February 5, 2026, and received over 600 responses. Its planned deliverable is an SP 1800 series practice guide.
• MCP authorization: The Model Context Protocol specification dated 2026-07-28 builds authorization on an OAuth 2.1 draft with resource indicators (RFC 8707) and issuer validation (RFC 9207). It adds an Enterprise-Managed Authorization extension that routes MCP access through the organization’s identity provider.
• Government guidance: The joint guidance “Careful Adoption of Agentic AI Services” from NSA, CISA and Five Eyes partners recommends prohibiting agents from modifying their own privileges or starting unapproved delegation. It also recommends separating “Orchestrator,” “Reader” and “Actuator” roles with delegation expiry.

Gartner’s May 2026 governance release adds the operating point: it links failures to organizations that do not separate an agent’s ability to act from the scope of access it holds.

Skan AI is an agentic AI platform for regulated enterprises that builds a Context Graph of Work from observed process activity, so banks, insurers and health systems can ground agent decisions and execution in how work runs. Before launch, Agent Studio in Skan AI Agents defines the enterprise areas an agent can touch, its permissions, its boundaries, and its escalation paths.

The criteria below are ones a buyer can test:

• Unique identity per agent: Each agent authenticates with its own identity, never a shared service account or a human’s session.
• Delegation recorded in the credential: The token or log entry names both the agent and the human or process it acts for, using RFC 8693-style actor semantics or an equivalent.
• Least privilege enforced downstream: OWASP’s Excessive Agency guidance calls for complete mediation. The target system authorizes each request instead of trusting the model to decide what is allowed.
• Execution in the user’s context: Agents acting for a user carry that user’s scope, with OAuth scopes kept to the minimum, per OWASP LLM06:2025.
• No self-escalation: The platform blocks any attempt by an agent to change its own permissions or another agent’s configuration.
• Credential hygiene: Secrets live in a vault, rotate on schedule, and never appear in prompts, scripts or traces.
• Review and retirement: Agent access is reviewed periodically, as PCI DSS 7.2.5.1 requires for system accounts, and unused agents are retired from the inventory.

Audit trails, explainability, and decision traceability

An examiner accepts an agent log as evidence when it records each action at step level, ties the action to an identity and a rule, and cannot be altered without detection. Two rules set the immutability standard most precisely:

• SEC Rule 17a-4: As amended in 2022, with compliance from May 3, 2023, the rule accepts either WORM storage or an audit-trail system that “permits the recreation of an original record if it is modified or deleted.”
• 21 CFR Part 11, §11.10(e): The rule requires secure, computer-generated, time-stamped audit trails in which changes do not obscure previously recorded information.

An action-level entry for an agent should carry the following fields:

• Agent identity and the delegating user or process
• Input received, including the source document or message
• Tool or system called, with parameters
• Output and the resulting change in the target system
• Rule, policy or procedure step applied
• Approval or rejection, with the approver’s identity
• Timestamp from a synchronized clock
• A cryptographic link to the previous entry

Hash chaining makes tampering visible. Each entry carries the hash of the previous entry, so a change, deletion, or retroactive insertion breaks every later link. Practitioners add a further step: anchor the chain periodically to an external system, because an attacker who controls the logging system can otherwise rewrite the whole chain.

Researchers reported in a NeurIPS 2023 paper that chain-of-thought explanations “can be plausible yet systematically unfaithful,” because models omit the input features that swayed them. A model’s narration of its own reasoning is therefore weak audit evidence. Deterministic components produce a stronger record.

• Logic-LM (EMNLP 2023 Findings): Researchers route reasoning through a symbolic solver in Logic-LM and report a 39.2% average gain over standard prompting. Its authors state that the reasoning is faithful as long as the problem formulation is correct.
• Clinical extraction study (Communications Medicine): A neurosymbolic system that paired GPT-4 with a rule-based expert system scored 1.00 F1 twice and 100% accuracy on PSA value extraction across 206 prostate cancer reports. It also produced an auditable chain of reasoning. GPT-4 alone scored 0.63 F1 on study inclusion.

The clinical extraction study covers a single dataset, and measured comparisons of explainability remain scarce.

Skan AI applies the same principle in its architecture. Its governance layer records inputs, outputs, actions, decisions, and rationales, and it supports case-level playback of what an agent did. Neural perception learns patterns from screen activity, which is observed with privacy by design, and symbolic reasoning applies explicit rules, which supports explainable, auditable process models and recommendations.

Human-in-the-loop gates and guardrails against hallucination and prompt injection

High-risk actions need deterministic gates that a person controls. Model judgment alone should never release them. The joint “Careful Adoption of Agentic AI Services” guidance, dated April 30, 2026 in NSA’s listing, recommends four controls:

• Preventing agents from executing high-impact actions without prior human approval
• Quarantining requests to delete logs or audit records until a person reviews them
• Trigger-action protocols that automatically restrict agent permissions when unexpected behavior appears
• Risk-tiered consensus, with multi-agent approval for moderate stakes and human approval added for high stakes

A reference architecture for a regulated agent places these controls in a fixed order:

1. Input boundary: Untrusted content from emails, documents, tickets and web pages is labeled and segregated from instructions, per OWASP LLM01:2025.
2. Redaction layer: PII, PHI and cardholder data are masked before content reaches the model, traces or logs.
3. Policy engine: A deterministic rule set checks each proposed tool call against permissions, value thresholds and approved procedure steps before execution.
4. Approval gate: The platform pauses calls above a threshold, or in a restricted class, and routes them to a named approver with full context.
5. Execution under scoped identity: The approved action runs with the agent’s least-privilege credential, and the target system re-authorizes it.
6. Monitoring and halt: Anomaly triggers narrow permissions automatically, and operators can stop an agent mid-task.
7. Immutable log: The platform records every step above in the hash-chained audit trail.

Sector guidance describes the kill-switch function without using the term; no NIST or CISA primary text reviewed for this article uses the phrase “kill switch.” The Five Eyes guidance recommends live monitoring with interruption during task execution and reversibility afterward. NIST AI RMF subcategory MANAGE 2.4 calls for mechanisms to “supersede, disengage, or deactivate” systems that perform inconsistently with intended use.

For payments, PCI SSC published additional AI guidance on October 7, 2026. Help Net Security reports that the guidance recommends explicit human approval for any action involving cleartext cardholder data. Where autonomy is monitored, it also recommends defined shutdown triggers and procedures for reversing changes.

A major cloud provider showed the gate in practice: its July 2025 bulletin on prompt injection in two of its developer tools said the language server now requires human-in-the-loop confirmation for the affected commands.

Escalation thresholds belong in machine-readable procedures that the enterprise owns. Skan AI encodes them in agentic operating procedures (AOPs), which are living process definitions generated from observed behavior. AOPs encode steps, decision logic, exceptions, policies, escalation thresholds, and success criteria.

Skan AI simulates agents against human baselines before production promotion, and its drift detection flags later departures from those baselines.

PII redaction has its own regulatory anchors:

• NIST AI 600-1: Action MS-2.2-002 recommends considering anonymizing data and removing PII, and MP-4.1-001 calls for periodic monitoring of AI-generated content for PII exposure.
• HIPAA: The minimum necessary standard at 45 CFR 164.502(b) limits PHI to what the purpose requires.
• PCI DSS: PAN must be rendered unreadable wherever it is stored, logs included.

Skan PRISM (Privacy and Information Security Machine) is an on-premises gateway that redacts sensitive information at pixel level before transmission so raw screen data stays in the customer environment and only anonymized, abstracted metadata reaches analytics. Its privacy by design controls include application allow-listing (limiting capture to approved applications), employee pseudonymization at collection (replacing names with codes), customer-defined retention, and right to erasure. These controls keep analysis on work patterns.

Deployment models: SaaS, VPC, and on-premises

Topology decides who can see sensitive data, so it is a procurement decision before it is an architecture one. The three common models are on-premises inside the customer firewall, a customer VPC or tenant, and software as a service (SaaS), and they trade speed against control:

Vendors implement the middle model differently. One vendor’s standard setup keeps agent state in customer-managed resources in the customer’s own subscription. Another’s hybrid option runs the control plane in the vendor’s cloud and the data plane in the customer’s VPC, and a third offers an on-premises deployment through its own software hub.

Residency rules shape the choice in 3 places.

• EU transfers: The EU-US Data Privacy Framework remains in force as of October 2026. The EU General Court upheld it on September 3, 2025, in Latombe v Commission, and the appeal (Case C-703/25 P) is pending. After the US Supreme Court’s June 29, 2026 ruling in Trump v. Slaughter, noyb wrote to the European Commission questioning the framework. Buyers relying on US processing should hold standard contractual clauses as a fallback.
• EU financial services: DORA has applied since January 2025. Article 30 sets key contractual provisions for ICT providers, and DORA requires financial entities to assess how long subcontracting chains affect their ability to monitor critical functions. The EBA’s outsourcing guidelines (EBA/GL/2019/02) expect agreements to state the country or region where data is kept.
• Model inference: An agent’s model call is a data transfer with its own location rules.

Inference residency differs by provider, based on each provider’s own documentation:

• OpenAI: Eligible API customers can select the US or Europe for GPU inference on supported endpoints. OpenAI’s Help Center notes that for ChatGPT inference residency, authentication, routing and logging without content may still occur outside the region. OpenAI also states that residency stops applying once data is sent to an MCP server.
• Anthropic API: The inference_geo parameter accepts only “us” or “global.”
• Azure: Data Zone deployments process prompts within the US, EU or Asia Pacific zone. Global deployments may process in any Azure region.
• Amazon Bedrock: Geographic cross-Region inference profiles keep requests inside the US, EU or APAC geography. Global profiles can route to any commercial region.
• Google Vertex AI: Jurisdictional multi-region endpoints keep ML processing in the US or EU. The global endpoint guarantees no processing location.

Skan Virtual Assistant (Skan VA) is a lightweight desktop sensor that observes screens, clicks, application switches, and workarounds across mainframe, Citrix, virtual desktop infrastructure (VDI), legacy desktop, web, and office applications. It captures end-to-end process activity with zero integrations, application programming interfaces (APIs), or logs, so observation adds no connectors to backend systems of record. Endpoint deployment and security review still apply, and Skan PRISM keeps raw screen data inside the customer perimeter, as described above, which reflects privacy by design.

Skan AI deploys on-premises inside the customer firewall, private cloud, or Skan AI hosted. The platform is containerized, meaning it is packaged in self-contained units that run the same way in any environment, so each customer’s data boundary depends on the option chosen.

Skan AI holds SOC 2 Type 2 attestation and ISO/IEC 27001 and ISO 42001 certifications, and its materials reference HIPAA, GDPR, and the California Consumer Privacy Act (CCPA). Skan AI also supports EU AI Act readiness.

Which certifications should an AI agent vendor hold before you sign?

A vendor should hold current third-party attestations whose scope names the agent product, and the buyer should read each one for what it attests. The U.S. Department of Health and Human Services (HHS) Office for Civil Rights states that it does not endorse or recognize private organizations’ HIPAA “certifications,” and covered entities remain responsible for their own compliance.

Each credential attests to something specific:

• SOC 2 Type 2: A licensed CPA firm issues an attestation report on whether controls were suitably designed and operated effectively over a period, typically six months to one year. A Type 1 report covers design at a single date only. SOC 2 issues no certificate and no pass or fail.
• ISO/IEC 27001:2022: The 2022 edition is current. The transition from the 2013 edition ended in October 2025, so any valid certificate should reference 2022.
• ISO/IEC 42001:2023: This standard certifies an AI management system for organizations that provide or use AI. Certification bodies are accredited by national bodies such as ANAB and UKAS, and ISO/IEC 42006:2025 sets the audit requirements those bodies must meet.
• HIPAA business associate agreement: A BAA is a contract that must contain the elements at 45 CFR 164.504(e). It obligates the vendor and its subcontractors to safeguard PHI and report security incidents.
• PCI DSS Attestation of Compliance: Ask for an AOC signed by a duly authorized officer of a Qualified Security Assessor company, backed by a Report on Compliance. PCI DSS v4.0.1 is the current published version.
• GDPR: GDPR offers certification under Articles 42 and 43, which is voluntary and limited to criteria approved by a supervisory authority or the EDPB. Under Article 42(4), certification does not reduce the controller’s or processor’s responsibility. A vendor statement of “GDPR compliance” is a claim, and the buyer should ask for the data processing agreement and transfer mechanism.

Scope gaps are common. One hyperscaler’s ISO/IEC 42001 announcement names its model service without naming its agent service. Another’s compliance page excludes one agent product from its ISO and SOC certifications. A third’s documentation pages disagree on an agent runtime’s FedRAMP status.

Request the scope statement, the report period and the bridge letter, and match each against the exact product in the pilot. Skan AI’s security materials also list PCI DSS and TrustArc Enterprise Privacy, alongside the posture stated in the deployment section above.

Requirements matrix: Mapping each control to the regulation it satisfies

Each control below traces to a specific provision, with its status as of October 2026:

No HIPAA, Part 11, FINRA, or SEC rule text names AI agents; FINRA’s “2026 Oversight Report” discusses them as guidance. Each mapping applies an existing technology-neutral provision to agent behavior. FINRA’s “Regulatory Notice 24-09” takes the same position: its rules, which are intended to be technology neutral, continue to apply when firms use generative AI.

Managed platforms versus open-source frameworks in regulated settings

Open-source agent frameworks supply execution scaffolding and, at enterprise tiers, some governance controls, but none supplies the operational context of how a regulated workflow runs. The governance features compare as follows, based on vendor documentation:

One of these frameworks is in maintenance mode. Its maintainers direct new projects to a successor from the same vendor, which reached general availability in April 2026. A regulated program starting today should not build on the framework in maintenance mode.

Teams often ask whether the pause-and-resume features in open-source frameworks satisfy the human-oversight requirement on their own. No. These features pause execution. The enterprise still has to build the approver identity, the threshold policy, the immutable log, and the separation of duties around them. We found no independent assessment of any of these frameworks against regulated-enterprise controls.

Engineers must supply the workflow context:

• Agents built on frameworks inherit whatever business logic engineers encode by hand.
• When engineers derive that logic from SOPs and system logs, they can miss exception paths and cross-application handoffs.
• Engineers repeat that context work for every new agent, and the encoded rules go stale as processes change.

Skan AI addresses this layer with the Context Graph of Work, a continuously updated graph of people, applications, tasks, decisions and policies built from observed work. It feeds the AOPs that govern agent execution in Skan AI Agents.

Named platforms compared against the regulated-enterprise criteria

The table below scores major hyperscaler and enterprise-software agent platforms against the criteria in this article, and “Yes” means the vendor’s own documentation, trust center, or compliance site reviewed for this article shows the capability. “No” means the reviewed material did not show it, which makes it a question for the vendor rather than proof of absence.

Each platform scores as follows:

Several entries carry caveats:

• AWS: AgentCore’s approval gate comes from a Cedar policy pattern described on the AWS Public Sector Blog.
• Microsoft: ISO/IEC 42001 is announced for Azure AI Foundry Models, and Agent Service is not named. Copilot Studio routes agent telemetry to Microsoft Purview audit logging.
• Google: The approval patterns found came from model and framework documentation and a demo. No first-party approval feature appeared. ISO/IEC 42001 scope names Gemini Enterprise and Agent Search on Gemini Enterprise Agent Platform, not the whole platform. Google documents VPC Service Controls but not a customer-VPC deployment.
• IBM: Agent Identity is a public preview announced on an IBM community blog. Its approval feature is described on a product marketing page. IBM documents SaaS on AWS and IBM Cloud, Premium dedicated isolation and on-premises deployment, but not a customer-VPC option.
• Salesforce: Agentforce agents respect standard Salesforce access controls, but the reviewed documentation shows no agent-specific identity model or approval configuration.

How to verify each requirement during a proof of concept

Run each test below against your own workflow data in a pilot environment, and record pass or fail evidence for the security, compliance and audit reviewers:

1. Audit log completeness: Run a scripted set of cases with known outcomes covering reads, writes, approvals, rejections and errors. Reconcile every change in the target systems against the agent log. Pass when every action has an entry carrying agent identity, delegating user, input, tool, parameters, output, rule applied, approval record and a synchronized timestamp.
2. Log immutability: As an administrator, try to edit and delete log entries. Pass when the hash chain flags the change, or the system recreates the original record as SEC Rule 17a-4’s audit-trail alternative requires. Requests to delete logs should be quarantined pending human approval.
3. Permission scoping: Give the agent a read-only task, then instruct it to write, call an unlisted tool and modify its own permissions. Pass when the target system denies each attempt and logs the denial, and when the credential shows both the agent and the delegating principal.
4. Approval gates: Submit actions below and above each threshold, plus actions in restricted classes. Pass when only the above-threshold and restricted actions pause, the approver’s identity is recorded, and a rejection stops execution cleanly.
5. Kill switch: Halt the agent mid-task during a multi-step run. Measure time to stop, confirm that in-flight actions either complete under approval or reverse, and confirm that an anomaly trigger narrows permissions automatically.
6. Prompt injection resistance: Point NVIDIA garak at the agent through its REST generator, using the latentinjection and promptinject probe families. garak’s documentation treats any Tier 1 pass rate below 100% as a possible exploitable vulnerability. Add Promptfoo’s owasp:agentic preset or Microsoft PyRIT orchestration. Plant indirect injections in the documents, emails and tickets the agent reads, and map findings to MITRE ATLAS technique AML.T0051. Pass when no injected instruction triggers a privileged action without approval.
7. PII redaction: Seed the test set with synthetic PII, PHI and card numbers. Measure precision, recall and the F2 score, which Microsoft Presidio’s evaluation guidance recommends because missed PII costs more than over-redaction. Then search prompts, traces, logs and embedding stores for leaked values. Pass when no cleartext PAN appears in any log.
8. Residency: Trace a case end to end and record the region of every storage location, inference endpoint and tool or MCP call. Pass when every hop sits inside the jurisdiction your transfer mechanism covers.
9. Determinism and drift: Run the same case set several times on a pinned model version and compare outputs and actions. Pass when variation stays inside your tolerance and the platform alerts on drift against the baseline.

Apply these standards on your highest-risk workflow before you sign. Request a Skan AI demo to explore how Skan AI uses observed workflows as context for governed AI execution.