Separation of Duties

Segregation of duties is one of the oldest controls in the audit book. The party that executes a transaction cannot be the party that records it, and no single party can authorize, execute, and account for the same act alone.

Agent governance is being sold in a form that hands all three duties to one vendor.

The oldest control.

Separation of duties splits custody, authorization, and recording so that no single party can both act and account for the act. Internal audit has enforced it for a century, and statute made it explicit for financial reporting. It is among the first things an examiner tests, because a control one party can execute and document by itself is a control that party can also defeat by itself.

An agent run collapses the split. The platform that runs the agent authorizes the action, executes it, and writes the log of what happened. Three duties the discipline keeps apart, held by one party. The convenience of buying them together is exactly the property the control exists to prevent.

A record the actor writes is a claim.

When the party that acts also produces the record of the act, the record attests to itself. That is not a technicality. It is the same reason an examiner does not accept an employee's own account of whether they followed policy as proof that they did.

The field is starting to say this in the open. A governing layer that defines, enforces, and verifies its own conduct turns its audit trail into part of the thing under question. A signature the actor controls proves the actor emitted the bytes. It does not prove the actor did not shape what those bytes say. A record the actor can shape is a claim about its own conduct, not evidence of it.

What independence requires.

The layer that assesses the action and signs the record has to be one the agent's vendor does not control. It reads the same inputs the agent read, sets the authority of the action before the action runs, and signs the result on a key the agent platform does not hold. The signer is not the actor, and not the actor's supplier.

Independence is checkable, not asserted. A second implementation of the same governing layer, built by a different party, re-derives the record and reaches the same bytes. That is what lets a party who trusts neither build read the record as evidence.

Where the bundling happens.

The convenient purchase is the one that fails the test. Agent platforms are shipping governance modules that run inside the platform, bundled with the agent they are meant to govern. One vendor, one bill, one control plane. It is also the actor grading its own work, and it fails the separation test the moment an examiner pulls a single decision.

The buyer draws this line once, at procurement, or does not draw it at all. After signature the governing layer lives where the agent vendor decides, on a key the agent vendor holds, and the leverage to separate the two is gone.

Why an examiner asks now.

SR 26-2 took effect on April 17, 2026 and placed agentic AI outside its scope, pointing institutions back at their own risk practices while an interagency RFI on AI is still forthcoming. Segregation of duties is one of those practices. It is already enforced on wires above a threshold, on journal entries, on the promotion of a model to production. The examiner who has applied it to every other control for a career applies it to the agent.

The examiner pulls one action that affected a person and asks two questions the agent log rarely answers. Who executed it. Who recorded it. When the answer to both is the same party, the record is an account, not evidence.

What we are building.

Wayfinder Systems Group is the layer between the agent and the record. It does not run your agent, and it does not sit inside the platform that does. It reads each action, sets the authority before the action runs, and signs the result onto a tamper-evident chain on a key the agent platform does not hold. The party that acts and the party that signs are not the same party. Patents held in The Wayfinder Trust. We call her Velma.