Good Practice Is Not a Control

On October 19, 2026, the United Kingdom's Financial Conduct Authority published AI in financial services: good practice and areas for improvement, a document built from its supervisory work and its own testing, with no new rules and no single governance model prescribed. What satisfies an accountability control for an autonomous agent is a runtime governor, a control that sits in the path every action takes to the world and sets how much authority that action is granted before it runs, against a bound declared before the run. Wayfinder Systems Group builds that governor, which sits above control and below intelligence and observes, assesses, modulates, enforces, and signs the record.

The supervisor described what good and poor practice looks like and declined to name the control. The firm is still accountable for what its agents do, which leaves it holding the question the document left open.

What did the regulator publish?

The Financial Conduct Authority, the United Kingdom's conduct regulator for financial services, published a good and poor practice document drawn from its supervisory engagement and its own testing, with around twenty short case studies. It writes no new rules. The regulator applies the requirements it already holds, its systems and controls rules and its senior manager accountability regime, and says plainly that it prescribes no single governance model. Alongside it the regulator set out where it will work next on agentic finance, naming agent identity, delegated authority, accountability, and execution as the open questions.

The diagnosis is sound and the restraint is deliberate. A regulator that named one architecture would freeze a field still moving, so describing good and poor practice and leaving the firm to choose is the right posture for a supervisor. It also leaves the firm holding the question the supervisor declined to answer. The firm is accountable for what its agents do, and a description of good practice is not the thing that bounds what they do.

What satisfies an accountability control for an autonomous agent?

An accountability control for an autonomous agent is a control that sits in the path every action takes to the actuator and sets how much authority that action is granted before it runs, against a bound declared before the run by someone who is not the agent. Each clause is load-bearing. In the path, so the action cannot reach the world except through it. Before it runs, so the decision is the authority the action carries rather than a note taken after. Against a bound declared before the run, so the thing that sets the limit is not the party under pressure to finish.

A practice is a statement about how a firm intends to behave. A control is a thing in the path that acts. The distinction decides what an accountability question can be answered with. A described practice is tested once, when it is written, and a control in the path is tested on every action, by what it refuses when it is present and what gets through when it is absent.

Can a document discharge the obligation?

No. Accountability for an agent's action is a claim about a specific action, that it carried no more authority than it was allowed to carry. A good practice document answers a different question. It says what a well run firm tends to do. It cannot speak to the action that ran at two in the morning, four hops into a chain nobody watched, because it was written before that action existed and names no bound the action had to clear.

The governor speaks to exactly that action. It reads what the action would do at the actuator, in the units the actuator acts on, and how far the run has diverged from the trajectory it was assured to follow, and it sets the grant from those two readings. A governor can grant less authority on an action whose present trust reads higher, because its forward look caught the run turning before the step landed. That is the move a document cannot make, because a document does not read the run.

What bounds delegated authority in agentic finance?

The regulator named delegated authority as an open question for agentic finance, and it is the right one. An agent calls a tool, hands a step to a sub-agent, and an action reaches an account or a market several hops from where the run began. The authority that action carries is not a grant handed down the chain. A governor sets it at the actuator, on the action's own effect and where the run is heading, no matter who proposed it.

A scope passed from a caller to a callee says the holder may touch a class of resource. It never says how much this action, the one about to land, is allowed to do, given what the run has done so far. Permitted is not granted, and the authority an action carries has to be established fresh at the actuator rather than inherited from the agent that started the run.

Where does the governor sit relative to the regulator?

The regulator names an obligation and describes practice around it. The governor is the thing that discharges the obligation at runtime, before the action, at the one place every action has to pass to become a durable effect. That position is what the current instruments assume and none supplies. SR 26-2 took effect April 17, 2026 with generative and agentic AI placed outside its scope and the interagency request for information it promised still not issued. EU AI Act Article 14 asks that a high-risk system be designed so the people assigned oversight can monitor, override, or interrupt it, with high-risk obligations applying from December 2, 2027 for standalone systems and August 2, 2028 for AI embedded as a safety component under Regulation (EU) 2026/1744. The NAIC exposed version 5.0 of its AI Risk Evaluation Supplement, with a later version targeted for the Fall National Meeting in November.

Each asks a firm to describe the governance it runs. A described capability is tested when the description is read. The question the regulator left open on October 19 is the one these share. What, in the path of the action, actually bounds how much the agent is allowed to do.

What we are building.

Wayfinder Systems Group builds a runtime governor for adaptive AI. It sits above control and below intelligence. It does not retrain the model or redesign the autonomy stack. On every action it observes the run, assesses where the run is heading, modulates how much authority the next action is granted against a declared envelope, and enforces that grant at the actuator, so the system acts only inside what the governor allows through a path it cannot step around. The grant it issues leaves a signed record as its evidence. We call her Velma.