What an agent write should leave behind
A governance review usually asks for the story of one transaction. This map lists, for each stage of an agent write into an ERP or CRM, the evidence worth keeping — and the NIST AI RMF subcategories and EU AI Act articles that evidence supports.
Read this first
- This is a conceptual map, not a certification, a control-by-control audit mapping, or legal advice. Keeping this evidence supports the referenced requirements; it does not by itself satisfy them.
- The EU AI Act articles apply to high-risk AI systems and their deployers. Whether a given agent is high-risk depends on its use, and many finance-operations workflows are not. The articles are shown for teams that are in scope.
- NIST AI RMF is a voluntary framework; subcategory wording is paraphrased from NIST AI RMF 1.0. ISO/IEC 42001 is cited by control theme only: control numbers should be confirmed against the licensed standard.
- Tioga AI is not ISO 42001 certified.
Read
Evidence to keep: What the agent was allowed to see and what it actually retrieved: sources, the fields included and excluded, the identity used, and the time.
NIST AI RMF
- MEASURE 2.4Functionality and behavior of the AI system are monitored when in production.
EU AI Act (high-risk scope)
- Art. 12(1)High-risk AI systems technically allow automatic recording of events (logs) over the system's lifetime.
ISO/IEC 42001
Control theme: data used by the AI system, and event logging.
Propose
Evidence to keep: The proposed action, the inputs behind it, the policy or rule it cited, the model and version, and the confidence or uncertainty the agent reported.
NIST AI RMF
- MEASURE 2.8Risks associated with transparency and accountability are examined and documented.
EU AI Act (high-risk scope)
- Art. 12(2)Logging enables recording of events relevant to risk situations, post-market monitoring, and monitoring the system's operation.
ISO/IEC 42001
Control theme: system documentation and transparency to the people who use the output.
Approve or deny
Evidence to keep: The named approver, the threshold that triggered the gate, the decision, the time, and what happened on denial or timeout — including that nothing was silently retried.
NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented.
- GOVERN 2.1Roles, responsibilities and lines of communication for managing AI risks are documented and clear.
EU AI Act (high-risk scope)
- Art. 14(4)(d)Oversight persons can decide not to use the system, or disregard, override or reverse its output.
- Art. 26(2)Deployers assign human oversight to natural persons with the necessary competence, training and authority.
ISO/IEC 42001
Control theme: roles and responsibilities, and human oversight in the use of the system.
Commit (the write)
Evidence to keep: The system's own audit entry attributing the write to the agent's identity and on whose behalf, the policy check that ran before it, and a read-back confirming the resulting state matches the intent.
NIST AI RMF
- MEASURE 2.4Behavior is monitored when in production.
- GOVERN 1.4The risk management process and outcomes are established through transparent policies, procedures, and other controls.
EU AI Act (high-risk scope)
- Art. 12(1)Automatic recording of events (logs).
- Art. 26(6)Deployers keep automatically generated logs under their control for at least six months, unless other law provides otherwise.
ISO/IEC 42001
Control theme: operation and monitoring, and event logs.
Roll back
Evidence to keep: The reversal entry linked to the original write, who authorized the reversal, the time, and confirmation the reversal itself landed correctly.
NIST AI RMF
- MANAGE 2.4Mechanisms exist to supersede, disengage, or deactivate AI systems whose outcomes are inconsistent with intended use.
- MANAGE 4.1Post-deployment monitoring plans include appeal and override, incident response, recovery, and change management.
EU AI Act (high-risk scope)
- Art. 14(4)(d)–(e)Oversight persons can override or reverse output, and interrupt the system through a stop procedure that brings it to a safe halt.
ISO/IEC 42001
Control theme: incident and nonconformity handling.
Change the agent
Evidence to keep: A review record for any change to the agent's instructions, tools, or model that could alter what it is allowed to write: who reviewed it, when, and what was compared.
NIST AI RMF
- MANAGE 4.1Post-deployment monitoring plans include change management.
- GOVERN 1.4Controls are established through transparent policies and procedures.
EU AI Act (high-risk scope)
No single article cited for this stage here.
ISO/IEC 42001
Control theme: change management across the AI system lifecycle.
See a record like this
The governed AP exception demo runs this loop on synthetic data — propose, policy decision, approval or block, simulated write, audit, rollback — and the composed-evidence demo shows one attributable record joining an assistant's request to what the ERP actually did. Both are browser simulations, not client systems.