Policy Landscape
The institution defines the rules. GRACE enforces the boundaries.
Policy frameworks determine what an institution should permit. GRACE is designed to apply institution-defined rules at runtime before information reaches the AI and before a proposed action executes.
Policy says what.
GRACE enforces when.
GRACE records context authorization in a signed Context PAP, records action authorization in a signed Action PAP, and uses the Chain of Confidence to verify that the two authorization records belong together.
Guidance written for a different kind of model
SR 26-2, issued April 17, 2026 by the Federal Reserve, OCC, and FDIC, superseded SR 11-7. Footnote 3 states that generative AI and agentic AI models are outside the guidance's stated scope and that a banking organization's own risk-management and governance practices should guide appropriate controls for tools, processes, or systems not covered by the guidance.
Primary sources: SR 26-2 · guidance attachment.
What changes with an agent
An agent can assemble context, reason across steps, and propose external actions. GRACE's two-path architecture makes the information authorization and action authorization separate control events.
Policy-to-enforcement sequence.
Defines task, permitted information, and action rules.
Evaluate Context Path and Action Path.
Signed PAPs plus Chain of Confidence verification.