Agent Security Meets Regulatory Reality -- A Practitioner Systematization of Autonomous-Agent Threats and Controls in Regulated Financial Systems

🕒 Published (v1): 2026-06-28 01:11 UTC · Source: Arxiv · link

Why this paper was selected

Bridges lab security research and regulated deployment; rare practitioner systematization

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

Maps six established agentic threat categories (prompt injection, identity/authorization, action auditability, tool abuse, data residency, boundary policy enforcement) onto specific US and EU financial-regulatory control obligations, showing how legal accountability amplifies each threat. Documents four architectural patterns from a production KYC deployment that moved a multi-day manual process to same-day resolution for ~80% of cases, plus three negative results surfaced only by internal audit.

Problem

The agentic-security literature is overwhelmingly laboratory-based — it characterizes failure modes but does not map them to legally mandated control obligations. Practitioner guidance (vendor playbooks, compliance frameworks) addresses regulated deployment but is neither peer-reviewed nor grounded in a formal threat model. No prior work bridges the two with production empirical validation. Even the revised US interagency model risk management guidance (SR 26-2, April 2026) explicitly excludes generative and agentic AI from its scope, deferring governance to general risk management.

Method

Experience-grounded systematization from a production MCP/RAG/A2A KYC onboarding deployment for a consumer credit product under formal internal audit. The approach has three components: (i) mapping six established threat categories to specific regulatory obligations (ECOA §1691(d)(2)–(3) / Regulation B §1002.9(b)(2), GDPR Article 22, CJEU SCHUFA judgment C-634/21, EU AI Act Articles 12/14/26, FINRA 2026 agent guidance); (ii) documenting four architectural patterns that emerged from those constraints; (iii) reporting which patterns held under audit and operational load and which did not.

Key Contributions

• Regulatory amplification analysis: shows how each of six threat categories changes in severity/priority under financial-regulation obligations — e.g., prompt injection becomes a per-applicant ECOA accuracy violation, not just a security incident; action auditability becomes a statutory design requirement (EU AI Act Art. 12) independently actionable regardless of security events.
• Four production architectural patterns: (1) A2A compliance choreography, (2) grounded-RAG-for-audit, (3) case-ID propagation across all logs, (4) inference-boundary redaction proxy that never sends raw customer documents or PII to the model endpoint.
• Three negative results including two control failures surfaced only by internal audit: a stale policy in the RAG retrieval store causing systematic over-verification, and tool-call logs that existed but could not be tied back to the case they decided.
• Demonstrates that the hardest problems under regulation are auditability, least-privilege authorization, and boundary policy enforcement at production scale — not novel attack classes.

Results

• Multi-day manual KYC onboarding process reduced to same-day automated resolution for "roughly four in five cases."
• Stale policy in the retrieval store caused systematic over-verification of customers who no longer required it — surfaced by internal audit, not by adversaries.
• Tool-call logs existed but could not be linked to the case they decided, a control failure invisible to the academic threat models.
• Production service accounts carried permissions far exceeding any single agent's task scope; access reviews found grants for which no role justification existed, producing adverse audit findings independent of any attack.
• The indirect-injection surface was narrowed (but not closed) by a structured-extraction stage; the bounded residual remains consequential under ECOA because any shifted decision path creates a compliance breach independent of downstream harm.

Limitations

• Single deployment context: a KYC pipeline for one consumer credit product; transferability to other domains (payments, fraud detection, account servicing) is argued but not empirically validated.
• Threat categories are drawn from established literature rather than independently discovered; the contribution is the amplification analysis, not new attack classes.
• The redaction-proxy pattern reduces but does not eliminate the data-residency surface at the inference boundary (the "bounded residual" of surviving injection surface).
• The paper itself acknowledges a population of legitimate applicants the automated pipeline cannot serve (third negative result), which is reported but not deeply characterized.

Relevance to Harnesses / Meta-Harnesses

This paper demonstrates that lab-based evaluation frameworks miss the binding constraints of regulated production — the most consequential failures were surfaced by internal audit, not by security testing. The methodology of systematically mapping architectural capabilities to externally imposed compliance obligations offers a template for how harnesses should evaluate agents beyond accuracy/security metrics. For the harnesses topic, the key takeaway is that a production harness for regulated domains must instrument inter-agent message boundaries (not just model calls) as the primary unit of audit evidence, and must include compliance-attributability checks alongside traditional security testing.