The Agent Oversight Framework.
A lifecycle standard for governing autonomous investment systems — from validation before capital is exposed, through runtime constraint, to evidence after the fact. It extends the model-risk discipline institutions already run (independent validation and effective challenge, carried forward into SR 26-2) to systems that act rather than merely predict \u2014 the systems SR 26-2 expressly places outside its own scope. Published openly; adapt it, cite it, improve it.
Scope and premise
An autonomous investment agent here means software that performs financial workflow steps — research, construction, execution, or monitoring — with material discretion inside defined bounds. The framework's premise: autonomy is a privilege granted per capability, per bound, per evidence — never a property of the system as a whole. An agent may be trusted to rebalance within limits and simultaneously untrusted to change its own limits. Governance is the machinery that keeps those grants explicit.
Control 1 — Pre-deployment validation
No agent touches capital until an independent party — independent in substance: real authority to reject, and enough standing to use it \u2014 the test SR 26-2 adopted in place of a reporting-line rule — has performed effective challenge on:
- Conceptual soundness. The economic rationale for what the agent does, stated in writing. "The backtest is good" is not a rationale.
- Overfitting controls. Out-of-sample discipline, purged/embargoed cross-validation where ML is involved, and a record of every variant tested — the denominator that makes the surviving strategy's statistics honest.
- Boundary behavior. Adversarial scenarios: gapped markets, stale or corrupt data, venue outages, and inputs deliberately crafted to elicit out-of-policy behavior.
- Reproducibility. Pinned code, data, and configuration such that the validated artifact is bit-identifiable in production. If production cannot be matched to what was validated, nothing was validated.
Control 2 — Runtime guardrails
Constraints enforced outside the agent's own process — at the execution venue, the risk system, or an independent supervisor — so a failing agent cannot disable its own limits:
- Hard position and loss limits per strategy, per asset, per day — enforced at the brokerage or OMS layer as the final backstop.
- Rate and novelty limits. Order-frequency ceilings and rejection of order types or instruments outside the validated set.
- Data-integrity gates. Inputs are checked for staleness, gaps, and out-of-distribution values before the agent may act on them; a deterministic pipeline that fails loudly rather than publishing partial data is the pattern in miniature.
Control 3 — Kill criteria
Pre-committed, objective halt conditions, written down before deployment so that stopping the system requires no judgment under stress:
- Drawdown beyond the validated envelope over defined windows.
- Live-vs-backtest divergence beyond cost-adjusted tolerance.
- Any data-integrity gate failure the agent attempted to act through.
- Anomalous order behavior — size, frequency, or instruments outside the validated profile.
Each criterion names an owner, a maximum response time, and a re-arm procedure requiring the same independence as initial validation. A kill switch that requires a committee meeting is documentation, not a control.
Control 4 — Drift monitoring
Continuous, quantified comparison of live behavior against the validated baseline: input distributions, decision statistics, turnover, and realized risk. Thresholds trigger graduated responses — flag, de-risk, halt — rather than binary panic. Drift monitoring is what converts "the market changed" from a post-mortem excuse into an operational signal. (See model drift, live-vs-backtest gap.)
Control 5 — Evidence and escalation
Every material agent decision produces a contemporaneous, tamper-evident record: inputs consumed, constraints evaluated, action taken, and the code/config version that took it. Append-only logs with cryptographic integrity (hash-chained or externally anchored) turn a dispute about what happened into a lookup. Escalation paths are staffed and rehearsed — a governance framework that has never run a fire drill is a hypothesis. See this control running against one real decision, not described but executed, in the walkthrough.
Adoption path
Institutions rarely adopt frameworks whole. The pragmatic sequence: (1) kill criteria and brokerage-layer hard limits — days of work, immediate risk reduction; (2) evidence logging; (3) drift dashboards; (4) formal independent validation as the gate to expanded autonomy. Each step is individually defensible to a risk committee, which is precisely the point.
Vocabulary aligned with Federal Reserve SR 26-2 (April 2026, superseding SR 11-7), the Treasury/FBIIC/FSSCC AI Lexicon (February 2026), the NIST AI Risk Management Framework, and public supervisory commentary on AI in trading. This is an editorial reference framework, not legal or compliance advice; institutions should adapt it under qualified counsel.