The Governance Layer · Clause Library · Instrument 04

The stressed conditions annex.

Every limit in an agent authority grant is calibrated against conditions that held when it was written. Volatility triples, liquidity thins, correlations converge, and each of those numbers is now measuring something else. A limit sized for an ordinary week may permit catastrophic exposure in a disorderly one, and a halt trigger that fires mid-hedge may create precisely the loss it was drafted to prevent.

Nothing in the published literature on autonomous system governance addresses this. Frameworks specify controls; none of them specifies what happens to those controls when the conditions they assume stop holding. This annex is drafted to close that gap, and it answers a question this library raised against itself: Instrument 02 identified correlated halts as unresolved and firm-level drafting as structurally unable to resolve them. Article 7 below is an attempt.

The two failures this addresses.

Stress produces error in both directions, and an annex that only guards against one is worse than none because it creates confidence.

Authority that is too loose. A maximum position size, an aggregate exposure ceiling, or a rate limit calibrated to ordinary volatility permits far more risk when volatility multiplies. The number has not changed; what it authorizes has.

Authority that is too tight, and halts that cause the harm. A halt is not a neutral act. Stopping a system holding an incomplete hedge, an unbalanced book, or a partially executed program can generate loss no unhalted system would have produced. And where many institutions calibrate against the same public indicators, their halts arrive together — converting a firm-level control into a market-level event, which is the failure Instrument 02 named and did not solve.

What the language derives from.

• Disruption events and stated fallbacks. Section 5(b) of the 2002 ISDA Master Agreement — Illegality at 5(b)(i), Force Majeure Event at 5(b)(ii) — defines disruption events that alter the parties' obligations according to fallbacks agreed in advance rather than negotiated in the moment. It is the closest structural precedent in existence, and this annex is that pattern applied to delegated authority instead of to payment obligations.
• Recalibration to a stress window. The Basel Committee's "Minimum capital requirements for market risk" (BCBS d457, January 2019 — the Fundamental Review of the Trading Book) requires market risk capital to be calculated using Expected Shortfall calibrated to a period of significant financial stress, replacing a measure calibrated on recent history. The supervisory principle — that a measure calibrated on ordinary data understates risk precisely when it matters — transfers directly to authority limits.
• Pre-committed, published, staggered halts. SEC Rule 80B market-wide circuit breakers halt trading at three defined S&P 500 decline thresholds — 7%, 13%, and 20% — with different consequences at each level, rather than at a single point. The drafting lesson is the tiering: a single threshold produces a single simultaneous event, and levels distribute it.
• Escalation indicators in recovery planning. The Financial Stability Board's "Guidance on Recovery Triggers and Stress Scenarios" (July 2013, Annex III to the Key Attributes of Effective Resolution Regimes) requires firms to set recovery indicators with defined escalation levels and pre-agreed actions at each. That is the same instrument as this one — a threshold that changes governance posture rather than triggering a transaction — and the drafting conventions transfer.
• Suspension mechanics in fund documentation. Redemption gates, dealing suspensions, and net asset value triggers establish that a party may stop acting on defined conditions, that the conditions are stated in advance, and that the stopping is disclosed to those affected. Market practice, not a single ruled provision.
• Stress testing of algorithmic systems. Article 10 of RTS 6 (Commission Delegated Regulation (EU) 2017/589) requires investment firms engaged in algorithmic trading to test their systems against high-message-volume and high-trade-volume stress scenarios, not only against ordinary conditions, as part of the annual self-assessment required under Article 9. The requirement to test exists; the requirement to change authority as a result does not.

Form of stressed conditions annex.

Bracketed text indicates a term the parties must supply. This annex is drafted to attach to an agent authority grant, a kill-switch covenant, or both, and to displace their terms while in effect.

Article 1 — Definitions and incorporation.

Capitalized terms used in this Annex and not otherwise defined here have the meanings given in the QIS Canon, version 1.0, as in effect on the Effective Date, and then the meanings given in the Grant or Covenant to which this Annex attaches. Where a term is defined both here and in the Canon, this Annex governs.

Article 2 — Declaration of Stressed Conditions.

Stressed Conditions exist when any entry in the Stressed Conditions Schedule obtains, or when declared under Article 2.3.

2.1 Objective entries. Each entry in the Stressed Conditions Schedule shall state the observable quantity, the threshold expressed as a value, the measurement window, the data source, and the date the entry was set together with the name of the person who set it. An entry stated as a standard of judgment is not an entry for purposes of this Annex.

2.2 Automatic effect. Where an entry obtains, Stressed Conditions take effect without any person acting, and the fact, time, and triggering entry shall be recorded.

2.3 Discretionary declaration. [Name, title] may declare Stressed Conditions where no entry has obtained. A declaration shall state the basis, the time, and the declaring person, and takes effect on record. The System shall have no capability to declare Stressed Conditions, to terminate them, or to influence any quantity by reference to which an entry is measured.

Article 3 — Effect on quantitative limits.

On the effectiveness of Stressed Conditions, each limit in Article 3 of the Grant is replaced by the corresponding entry in the Stressed Limit Schedule. Each stressed limit shall be stated as a value, not as a percentage adjustment to be computed at the time, and shall be enforced at runtime by the same mechanism that enforces the ordinary limit.

Where the Stressed Limit Schedule contains no entry for a limit, that limit is reduced to zero for the duration of Stressed Conditions, and the System shall not take the action to which it relates.

Article 4 — Effect on reserved actions.

On the effectiveness of Stressed Conditions, the actions listed at [reference] become Reserved Actions in addition to those reserved under Article 4 of the Grant, and shall not be taken by the System. The list shall be stated in advance and shall not be composed at the time of declaration.

Article 5 — Effect on halting.

5.1 Manner of halting. The Stressed Conditions Schedule shall state, for each trigger, whether the halt is Immediate or Orderly. An Immediate halt ceases all action. An Orderly halt permits only those actions identified in advance at [reference] as necessary to leave positions, hedges, and dependent processes in a determinate state, and shall complete within [interval], after which the halt becomes Immediate.

5.2 Actions permitted in an Orderly halt shall be enumerated in advance. A provision permitting the System to take such actions as it determines are necessary to wind down is not an Orderly halt; it is an unbounded grant of authority arising at the moment authority should be narrowing.

5.3 Stressed thresholds. Where the Trigger Schedule under the Covenant contains an entry whose threshold is calibrated to ordinary conditions, the corresponding entry in the Stressed Trigger Schedule applies instead for the duration of Stressed Conditions.

Article 6 — Effect on oversight and records.

For the duration of Stressed Conditions, the review interval under the Grant is shortened to [interval], the Accountable Individual or a designated alternate shall be continuously reachable, and the records required under Article 8 of the Grant shall additionally capture, for each action, the value of each quantity by reference to which Stressed Conditions were declared.

Article 7 — Non-correlation.

7.1 No entry in the Stressed Conditions Schedule and no entry in the Stressed Trigger Schedule shall be stated solely as a function of a publicly published market-wide indicator at a value published or widely used by other market participants, without the application of a firm-specific offset or a firm-specific quantity.

7.2 Resumption following a halt during Stressed Conditions shall be subject to a firm-specific delay determined under [reference], and that delay shall not be disclosed in advance to any person other than the Beneficiary and any person required to receive it.

7.3 The Operator shall record, at the time each entry is set or amended, whether the quantity used is one the Operator believes to be in common use.

Article 8 — Termination of Stressed Conditions.

Stressed Conditions do not terminate automatically. Termination requires that: (a) no entry in the Stressed Conditions Schedule has obtained for [interval]; (b) [name, title] has recorded that termination is appropriate, together with the basis; and (c) where any limit was reduced to zero under Article 3, the Accountable Individual has separately authorized the resumption of the affected action.

Termination takes effect on record and not before. Where Stressed Conditions have been in effect for more than [period], termination additionally requires [approval].

Article 9 — Reporting.

The Operator shall notify the Beneficiary within [interval] of the effectiveness of Stressed Conditions and within [interval] of their termination, stating in each case the entry or basis, the time, and the limits and reserved actions affected.

Article 10 — Precedence and review.

While in effect, this Annex displaces any inconsistent term of the Grant and the Covenant. In all other respects those instruments continue in effect. This Annex and each Schedule shall be reviewed no less frequently than [interval], and following each occasion on which Stressed Conditions were in effect, and each review shall record whether the thresholds performed as intended.

This Annex and its Schedules are amended under Article 9 of the Grant or Section 10 of the Covenant, whichever this Annex attaches to, and not under a separate mechanism of their own. Where this Annex attaches to both, the more restrictive of the two amendment procedures governs.

Drafting notes.

On stating stressed limits as values. Article 3 requires the stressed limit to be a number, not a percentage reduction computed at the moment. A formula evaluated during stress depends on inputs that are themselves disturbed, and the point of the Annex is to remove decisions from the moment of pressure. Write the table in advance.

On the default to zero. An omission from the Stressed Limit Schedule reduces the limit to zero rather than leaving the ordinary limit in force. This is deliberate and it is the safer failure: a gap in the schedule produces conservatism rather than the unexamined continuation of an inappropriate limit. It also creates the right incentive to complete the schedule. Instrument 03 defaults an omitted disclosure schedule the opposite way — treated as delivered blank rather than as zero — and the two defaults are consistent rather than contradictory: both resolve against the party who controls the schedule, and Part Three of the schedule set states the reconciling principle in full.

On where these three schedules are actually completed. The Stressed Conditions Schedule, the Stressed Limit Schedule, and the Stressed Trigger Schedule are named throughout this Annex but not given a form here. The schedule set supplies it: the conditions at S-04-A, the limits at S-04-B, and the triggers at S-04-C, each keyed to the ordinary schedule it corresponds to so a missing counterpart is visible rather than silent.

On the asymmetry between entry and exit. Stressed Conditions begin automatically and end only by recorded human decision. Easy in, hard out. A regime that lapses on its own will lapse at the first quiet hour rather than when the condition has actually passed, and the cost of remaining conservative slightly too long is smaller than the cost of exiting slightly too early.

On Article 5.2, which is the provision most likely to be softened in negotiation. A wind-down clause permitting the System to do what it determines is necessary hands it discretionary authority at the exact moment authority should be narrowest, and does so in language that reads like caution. Enumerate the permitted actions or use an Immediate halt. There is no defensible middle.

On Article 7, and its limits. Non-correlation drafting is an attempt at a problem that firm-level instruments cannot fully solve, and it should not be presented as a solution. What it does is remove the most obvious mechanism of synchronization — every firm keying to the same public number at the same value — and introduce dispersion in resumption. What it cannot do is coordinate across firms, because coordination is precisely what a firm-level instrument may not attempt. The residual problem is systemic and requires an instrument at a level above this one, which does not exist.

On recording whether a quantity is in common use. Article 7.3 asks the Operator to record a belief rather than a fact. That is unusual, and it is there because the aggregate of those records — across many firms, over time — is the only visibility anyone would have into whether the market is converging on shared triggers. It costs one line to record and it is the only provision here that could ever produce evidence about the systemic question.

On Article 10 not drafting its own amendment mechanism. Both the Grant and the Covenant have one; this Annex deliberately does not, and the choice was considered rather than an omission left standing. A separate amendment procedure for an instrument whose entire function is to attach to and modify another would produce two amendment histories describing the same authority, each capable of drifting out of step with the other. Routing amendment through the attaching instrument's own procedure keeps a single history, at the cost of the Annex being slightly less self-contained than Instruments 01 and 02 are individually — a cost worth paying here.

The negative space.

• Conflicting obligations to act. A firm with continuous quoting, market making, or best execution obligations may not be free to halt. Where an autonomous system operates within such a mandate, this Annex and the firm's regulatory obligations may point in opposite directions, and no published guidance resolves which prevails.
• Correlated declaration. Article 7 addresses correlated triggers. It does not address the possibility that many firms declare Stressed Conditions on the same day for the same obvious reason, which is likely and which no firm-level drafting reaches.
• Loss on wrongful declaration. Declaring Stressed Conditions costs money — foregone activity, unwound positions, reduced limits. Failing to declare costs money too. Neither this Annex nor any published instrument allocates the loss from either error, and the parties should address it expressly.
• No visibility into counterparties. An operator has no means of knowing whether the autonomous systems it transacts with are themselves halted, constrained, or operating under their own stressed regime. Every provision here assumes the operator can reason about its own system only.
• Whether supervisors regard stressed halting as prudent. Because agentic systems sit outside the scope of current model risk guidance, no supervisor has indicated whether a firm that halts autonomous activity in stress has behaved well or has failed an obligation. This will be established by practice.

Relationship to the framework.

This Annex attaches to Instruments 01 and 02 and displaces their terms while in effect. Its primary counterpart is MARQUE Systemic behavior — Article 7 is drafted specifically against that question rather than against a firm-level one — and it bears on Authority and Drift as well, each already served by the instruments it attaches to. On KYA, it is the operative counterpart to dimension 07: an institution that can produce an executed Annex with a completed Stressed Conditions Schedule, together with the common-use records under Article 7.3, is evidenced on whether it knows what everyone else's agent is doing, rather than merely asserting that it does.

This is an editorial form with commentary, published in the tradition of model agreements and form books. It is not legal advice, not a compliance determination, not a certification, and not a representation that any provision here is enforceable in any jurisdiction. It should be reviewed by counsel and adapted before use.