AI agents need a mandate before they need a better model

On 13 October, Taiwan's Financial Supervisory Commission (FSC) published a consultation paper on the security of agentic AI in financial institutions. Agentic AI here means systems that plan their own steps, call tools and reach across systems, rather than chatbots that only answer.

The grading is the interesting part. Risk is scored on three axes: how sensitive the data is, how much impact an action has, and how far the agent's capabilities can spread. Whichever axis scores highest sets the level. There are 4 levels, and the examples at the top include payments, changes to credit limits or permissions, irreversible actions and edits to customer records.

That middle axis is the shift. For two years the debate about generative AI risk asked whether a model might say something wrong. Action impact asks whether an agent might do something wrong, and how badly.

FDE AI reads the FSC's choice of unit as the more consequential detail. Governance is organised by use case, and for each one the firm must state the purpose, who is responsible, which data the agent may read, which tools it may call, which actions it may take, where its outputs land, and how it is stopped and traced. None of those answers lives inside a model. They live in the firm's own processes and access tables, which is why model selection can no longer be the first step of an agent project.

The FSC treats an agent as a non-human identity with the capacity to act, managed under zero-trust principles. In practice the draft proposes authorisation scoped to a task and limited in time, and an agent that never inherits the full permissions of the person who triggered it. Under the draft, irreversible or high-impact actions must not be executed by the agent alone; they would need a policy check, a human confirmation or a second reviewer first.

The draft treats logging and shutdown the same way. Records should be linked by common identifiers, and where the logging has gaps the process should not be automated at all. An agent must also be something that can be switched off, have its tokens revoked and be rolled back.

Tokyo's proposals look similar, though they are at an earlier stage and aimed at ministries. A list of draft issues tabled at a Digital Agency advisory board on 29 September proposes least privilege as the base principle for government agents and asks for human judgement, or monitoring that can halt the task, before money moves or data leaves the building. It also proposes a unique ID for every agent and a register of the tools and servers agents connect to. In Washington, the National Institute of Standards and Technology (NIST) is standing up a project on agent identity and authorisation after its February concept paper drew more than 600 responses.

The vocabulary differs, but the document they point to is much the same in all three: a map, for each agent, of what it may touch, what it may press and where it must stop and wait for a person. In FDE AI's reading, the model, the accounts and the process typically sit with three different teams. The vendor owns the model, security owns the accounts and the business unit wants speed, so the boundary often has no clear owner.

Japan is approaching the problem from the other end. From 19 to 30 October, the Cabinet Office, the Digital Agency and the Ministry of Economy, Trade and Industry are collecting examples of rules that block AI deployment, and the call names agentic AI and physical AI among its targets. The government says it intends to draw on the results in the Regulatory Reform Promotion Council's deliberations and the revision of Japan's AI Basic Plan.

Taiwan is asking which new rules agents must follow; this Japanese call asks which old rules stop AI. FDE AI reads both as pointing to the same artefact. A firm that can already say what its agents are allowed to do will find it easier to answer either government, and easier to sell into either market.

For buyers that operate across borders, the practical consequence is that one authority map per agent can serve several regulators. A bank in Taipei would, under the FSC draft, have to show use case by use case which data an agent reads and which actions it may take on its own. Among the documents cited here there is no equivalent draft for private firms in Japan, but if Japan's government guidelines adopt the Digital Agency's proposals, vendors selling agents to ministries are likely to be asked a similar question. FDE AI reads that as the likely first channel. Writing that record once, at design time, costs far less than reconstructing it for every audit or every new market.