Skip to content
Promenaut

Promenaut joins forces with HSBC as strategic investor and design partner.Read More

Learn · Perspective

Model risk for AI agents: approved, ran, did, relied on

Model risk management was written for models that score and predict. Agents add tools, authority and a sequence of steps, but the questions a second line asks stay the same: what is the model, was it approved, did it run as approved, did it do what it should, did people rely on it sensibly, and can you show it.

This is how those questions are answered for a workforce of agents, with the evidence produced by the platform that runs them.

Published October 2026

What counts as a model

On Promenaut, each agent is a registered record with its lifecycle, model configuration and cost tier, the platform keeps an inventory of the models it can reach, and each completed agent run records which model and provider answered.

Not every agent is a model call: some are deterministic code and others combine code and a model, so work that should be exact need not be handed to a language model.

Declared and approved

Each agent declares what it reads and writes, its boundary can be drawn as a diagram, and a change to how it behaves is published as a version that can be compared with the last, with each lifecycle change recorded with its reason and who made it.

Ran: did only the approved agents run?

Each agent that ran in a workflow is classified against the roster the run launched with, and each ended workflow run in which an agent ran carries a verdict.

Did: did each agent do what it declared?

After an agent run, what it wrote to knowledge is compared with what it declared, and a conformant, non-conformant or no-baseline verdict is recorded in the audit ledger.

Relied on: what did people accept, change or ignore?

Co-authoring surfaces record when a person accepts, modifies or rejects a suggestion, and the person who ran a workflow can rate it, so reliance is measured per person and per run.

Recorded and reviewed

Model risk events are kept in an append-only, hash-chained ledger, content free, and reads of the evidence are recorded.

Each agent’s run health is tracked, agents are graded on weighted criteria into letter bands, reviews are organised by quarter, and improvement plans name a metric, a target and a deadline.

Can a reviewer reconstruct a run, and take the evidence away?

A reviewer can replay a run step by step, open a diagram of it with its verdict, and export the reliance figures.

How this supports model risk principles

Model risk principles such as the PRA’s ask for an inventory, for controlled change, for monitoring and for evidence a reviewer can test. The platform supplies the records and the monitoring. The judgements stay with the bank.

This differs from model governance tools that document and validate models from the outside: here the evidence is produced by the platform that runs the agents, as each run ends.

Promenaut is running in production with leading industry partners, including a global tier 1 bank.

The platform supplies the records and the monitoring. The judgements stay with the bank.

Common questions

Is an AI agent a model for model risk purposes?

Usually, where it uses a model to make or shape a decision. The useful step is to register each agent with its model configuration, and to record which model answered on each run, so the inventory follows what runs.

How do you monitor AI agents for model risk?

By checking each run against what was approved and what was declared. On Promenaut, each agent that ran is classified against the run’s roster, each ended run carries a verdict, and what an agent wrote is compared with what it declared.

What evidence does a second line need for AI agents?

An inventory, a record of each approved change, a verdict on each run, a check that each agent did what it declared, a measure of what people relied on, and a way to reconstruct a run and take the evidence away.

Does the platform make the model risk judgement?

No. The platform supplies the records and the monitoring; the judgements stay with the bank’s model risk function.

Talk to us about your own work →