1
Cognitive Orchestrator
Goal-directed reasoning, tool selection across enterprise APIs, confidence scoring per step, and the human-machine interface with a global halt control.
Agentic AI under the AI Act
The layered architecture that replaces frontend + database + manual operations. Each layer carries a specific statutory hook — oversight that is not in the orchestrator cannot stop an executing agent. Everything on this page is assembled from the existing knowledge graph — each layer, threat, pattern and use case links back to the node it came from, so you can audit the claim rather than take it. RAIN does not enforce anything at runtime; it maps which obligation attaches to which execution layer and what evidence that layer owes.
The execution stack
2
Model routing & inference economics
Dynamic routing between small fine-tuned models and frontier models; the routing policy is a documented design decision, not an implementation detail.
3
Local perimeter execution (MCP)
Agents execute inside the corporate perimeter and reach tools over MCP with context scoped to the minimum attributes required, instead of shipping raw records to third-party endpoints.
statutory hookGDPRsource EUR-Lex
4
Guardrails & fail-safe stop
Confidence minima, disbursement and margin caps, variance thresholds. Breaching a limit halts all sub-agents and reverts to a safe state rather than continuing at degraded confidence.
5
Immutable record & attribution
WORM-grade event logs of decision paths, API calls, prompt changes and data access — each bound to a named supervising natural person, never a shared service account.
What a governance function has to do about it
- Maintain a central inventory of AI use cases and agentic workflows, each catalogued by domain, data dependencies, outcome metric and applicable framework — with a named natural person accountable for each deployment.
- Move procurement from per-seat licensing to outcome-aligned, consumption-metered contracts that tie spend to verified results and push evidence duties into the provider contract.
- Mandate oversight infrastructure across every execution layer: accessible HMI, anti-automation-bias safeguards, WORM logging, emergency stop and an unbroken attribution chain.
Agent-specific threats
These are the failure modes that only appear once a system acts rather than answers. Open any node to see which controls and patterns in the graph derive from it.
LLM06 Excessive Agency
Over-broad rights/functions of autonomous agents lead to uncontrolled actions.
Lethal Trifecta
Untrusted external input + privileged access + irreversible external actions in one agent: any successful context manipulation becomes a potentially catastrophic incident. Break at least one leg architecturally.
Cascading Multi-Agent Failure
One agent's erroneous intermediate output (hallucination, goal drift from the assigned objective over multi-step plans, poisoned context) propagates unchecked through downstream agents and triggers automated cascade decisions — emergent behavior no single-agent review ever approved, with unclear liability boundaries between agent operators. Grows with orchestration depth (central orchestrator vs decentralized message bus) and autonomy tier.
Deceptive AI Impersonation
A voice or chat agent is perceived as human, or claims capabilities and commitments it cannot honour, breaching transparency and consumer-protection duties.
Oversight patterns that answer them
MCP Gateway / Proxy
Central chokepoint for agent tool traffic: default-deny tool ACLs (tools/list vs tools/call), schema & argument inspection, credential injection from vault, rate limits, full audit mirror. Regulatory root cause: the base MCP protocol enforces no authentication or authorization at protocol level — Host/Client/Server topology with Tools/Resources/Prompts primitives ships without an identity layer, so a policy-enforcing gateway is not optional hardening but the only place Art. 12/15 duties can be enforced for tool calls.
Agentic Zero Trust
Unique cryptographic identity per agent; short-lived, finely-scoped tokens (OAuth 2.1 + PKCE); On-Behalf-Of flow so an agent can never see more than its triggering user.
Propose-Action Objects
Agents never call target APIs directly: they emit typed proposal objects (endpoint, params, risk estimate, rationale) validated by the governance layer before execution; idempotent execution layer.
Durable Checkpointing (Pause & Resume)
At oversight gates the complete operational state — working memory, conversation history, tool arguments, intermediate artifacts — is serialized into a durable checkpoint (fast KV store for sub-ms lookups, transactional backend as recovery anchor, vector store for semantic caching of past human decisions). On approval the agent deserializes and resumes at the exact step; matched precedents can shortcut re-planning entirely.
Per-Action Autonomy Tiering
Tools tagged read-only / reversible-write / irreversible-write; controls layer routes each action to the matching oversight mode. Mode selection is per action type, never per agent.
Guardian Agents (Runtime Policy Enforcement)
Autonomous supervisory agents outside the supervised agent's reasoning loop: stateful threat engines with graph-based cross-session history (catch multi-turn injection, gradual exfiltration, incremental privilege escalation), event-driven exposure visibility (permission drift, new connectors), and contextual risk correlation into unified issues — interception before execution, not post-hoc logging.
Dual-Gate Validation Pipeline
Input and output validation as two independent gates (MLCommons-hazard-class semantic filters, groundedness checks, structural validators: LLM Guard sub-ms–10 ms, Llama Guard <90 ms, NeMo <50 ms, Guardrails AI 50–200 ms). Latency economics decide the architecture: sequential gate chains add 300–800 ms per agent action; parallel evaluation collapses total added latency to the slowest single check — run independent checks concurrently, reserve sequential ordering for true dependencies.
unverified · verified 2026-08-07open in graph →
Shadow-Mode Execution
Run governance controls in observe-and-score mode before enforcement: the policy engine and guardrails evaluate every agent action and log verdicts without blocking, yielding empirical false-positive/negative rates and calibrated thresholds. De-risks the enforcement cutover, produces baseline evidence for Art. 9 risk estimation, and is the standard migration path when retrofitting controls onto a live workflow.
Human-on-the-Loop Statistical Sampling
For lower-risk batch workflows, agents execute autonomously while auditors review a statistically representative random sample per batch to track accuracy, error classes and drift.
Cognitive Orchestrator
The reasoning and control plane of an agentic workflow: goal decomposition, tool selection across enterprise APIs, confidence scoring per step, and a human-machine interface exposing progress, limitations and a global halt. It is the architectural home of AI Act Art. 14 oversight — oversight that lives only in a downstream UI cannot stop an executing agent.
Local Perimeter Execution (MCP)
Execution agents run inside the corporate perimeter and reach tools through the Model Context Protocol instead of shipping raw records to third-party model endpoints. Context is scoped to the minimum attributes the task needs, which is how data minimisation (GDPR Art. 5(1)(c)) and Art. 25 privacy-by-design survive multi-tool agent orchestration.
Materiality-Threshold Escalation
Autonomy is bounded by pre-configured limits — variance thresholds, disbursement caps, margin floors, confidence minima. Crossing a limit halts execution and routes the case to a named human with the synthesised context, rather than letting the agent proceed at degraded confidence.
Agentic use cases already profiled
Each of these carries a full compliance profile — risk class, triggered regulations, obligations, blueprint and the evidence the deployment owes.
Algorithmic Portfolio Execution & AdvisoryTrade execution against target parameters, automated conflict-of-interest analysis, generated client advisory communications and full attribution logging of every model inference.Automated Financial Forecasting & Audit TrailsCross-ledger aggregation, scenario simulation and draft financial statement assembly with a reviewable audit trail, presented to finance leadership for sign-off.Autonomous Procurement / Ops AgentAgent that negotiates, orders, pays or reconfigures systems autonomously across ERP and supplier APIs.Clinical Imaging Triage & Patient Follow-UpDiagnostic imaging pipelines monitored for critical findings, then follow-up scheduling, lab orders, record updates and draft patient notifications executed in the EHR — held until the supervising physician confirms.Continuous Technical Documentation GenerationCodebase, telemetry and training metadata parsed continuously to auto-generate and maintain Annex IV technical documentation, model cards and change histories for deployed AI systems.Cross-Border Statutory Tax & Wealth FilingERP, custodial and exchange data reconciled across entities and jurisdictions, taxable events categorised, statutory returns drafted and electronically submitted to tax authorities, with variance-triggered human escalation.Developer Code Assistant / Engineering AgentCode generation, review and autonomous engineering agents with filesystem/terminal/API access (CodeBuddy pattern).Dynamic Deal Desk & Quoting EngineCompetitor price detection, margin analysis, proposal generation and direct quote issuance to B2B buyers, bounded by margin guardrails that require manager override.Perpetual KYC & Customer Risk RatingAgentic continuous customer due diligence: document intelligence, beneficial-ownership resolution, adverse-media screening, dynamic risk re-rating.Procurement Variance & Vendor KPI MonitoringPurchase orders and invoices ingested, price trends analysed, anomalies and contract-term breaches flagged, vendor KPI scorecards maintained and alerts routed to the supply-chain owner.Regulatory Change Management & Policy UpdatingContinuous scanning of regulatory feeds, automated mapping of new statutory duties onto internal policies and SOPs, gap analysis and drafted policy amendments routed to a compliance officer for approval.Trade Lifecycle & Settlement ReconciliationAutomated matching of multi-asset trade confirmations, exception-break identification, failed-trade resolution and cash/securities settlement reconciliation.