[Use Case] Verification under collision: AI-drafted client communications in regulated financial services
fg-tida-use-cases-use-case-verification-under-collision-ai-drafted-client-communications-in-regulated-financial-services-79
| Type | FG-TIDA document |
|---|---|
| Group | Trust and Identity for Humans and Agentic AI |
| State | Submitted |
| Authors | Not entered |
| Last updated | 2026-10-23 15:11 UTC |
Formats and resources
Abstract
1. Identification
Title: Verification under collision: AI-drafted client communications in regulated financial services
Submitting organization: CTGT
Contact name: Cyril Gorlla
Contact email: cyril@ctgt.ai
Sector (tick all that apply; a cross-industry case may tick more than one):
- [ ] Education
- [ ] Displaced persons / humanitarian
- [ ] Health
- [x] Financial services
- [ ] Telecom
- [ ] Media and publishing
- [ ] Logistics
- [ ] Energy
- [ ] Critical infrastructure
- [ ] Smart home / IoT
- [ ] Other (specify):
2. The situation
Plain language description (required, 3 sentences max): An agent at a regulated financial institution drafts client communications that must satisfy several obligations at once: conduct rules, firm policy, and product disclosure requirements. The agent passes every identity and authorization check, yet one message can satisfy one obligation while violating another, and two obligations can conflict outright. Nothing today produces a verdict at the moment of sending, or a record of which rules were in force and what was decided.
Actor (every party involved): The drafting agent. The firm, which deploys the agent and sends the communication. The firm's compliance function, which authors the policy set. The engine that evaluates each output. The firm's representative who drafts with the agent. The client who receives the message. The regulator or auditor who reads the record later.
Action: Generate and send a client communication, such as a recommendation, a disclosure, or market commentary.
Decision required (at the moment the agent acts, what does the party on the receiving end have to decide? Write it as a question, e.g. "May this firm's agent be let into the house on the homeowner's authority?"): May this message be sent to the client, given every obligation in force for it, and where two obligations conflict on the same message, which one governs?
Problem encountered (why that decision cannot be made today): Identity and authorization settle who the agent is and what it may do. Neither settles whether this output conformed. Obligations collide: a required disclosure pushes a message past a channel limit; a firm rule prohibits wording a product rule requires; a suitability obligation and a plain-language obligation pull against each other on the same sentence. There is no standard verdict at the moment of action, no adjudication semantics for the collision, and no portable record of which policy set was in force and what was decided.
Current mitigation: Post-send surveillance, which detects after the message has gone out. Sampled human review, which covers a fraction of volume. Keyword and lexicon filters, which cannot represent obligations that are properties of a whole message.
Residual gap: There is no real-time conformance verdict with defined semantics, and no adjudication when obligations collide, so the resolution is whatever an implementation happens to do. Records are not attributed or tamper-evident in a form a party who was not present can verify. And an evaluation that never ran looks the same as one that ran and found nothing, so a suppressed block and an absent engine are indistinguishable to a regulator.
3. Actors and context
Taxonomy roles involved
- [ ] Principal — possesses the authority being exercised; source of the mandate. Here: the firm, for its own client communications.
- [x] Relying party — must decide whether to accept the agent's authority. Here: the client at receipt, and the regulator or auditor reading the record later.
- [x] Builder
- [x] Deployer / Owner
- [x] Agent instance
- [x] User — interacts with the agent; may or may not be the principal. Here: the firm's representative who drafts with the agent.
- [ ] Infra provider
- [x] Attestor: the engine that evaluates each output and issues the verdict. Its relationship to the evaluated party (self, contracted, independent) is itself a declared field.
- [ ] Other (specify):
Mandates in this case (required)
| Grantor | Grantee | What is conferred | Governing regime |
|---|---|---|---|
| Firm | Drafting agent | Authority to draft and send client communications on the firm's behalf, within the firm's authored policy set | Securities and conduct regulation of the firm's jurisdiction (in the United States, FINRA rules and SEC regulation). The firm remains responsible for the communication. |
| Firm (compliance function) | Evaluating engine, self-operated or contracted | Authority to evaluate each communication against the policy set and to permit, remediate, block or escalate it | The same regime, including the firm's supervision obligations, and outsourcing obligations where the engine is contracted |
| Client | Firm | The advisory or account relationship under which communications are sent | The client agreement, under the same regime |
Cross-border?
- [ ] Yes — jurisdictions involved:
- [x] No. The case is stated within a single jurisdiction on purpose, to isolate collision between obligations from collision between legal regimes. The multi-regime variant belongs with the per-link determination in FG-TIDA/themes#5 and FG-TIDA/themes#15.
Embodied (physical actuation or sensing)?
- [ ] Yes — physical context:
- [x] No
Agent action type (required; tick all that apply. Where several apply, the most consequential governs the case)
- [ ] Read-only
- [x] Consequential (reversible)
- [x] Irreversible
Drafting and evaluation before sending are reversible: a blocked or remediated message never leaves. Sending is irreversible: the disclosure obligation is met or breached at that moment, and a message sent to a client cannot be recalled. Sending governs the case, which is the reason to move the check to the moment of action.
Crosses organisational boundary? (required)
- [x] Yes (specify): the message leaves the firm for the client, and the record is later read by a regulator or auditor who was not present and has no relationship to the engine that produced the verdict.
- [ ] No
Risk level (required)
- [ ] Low
- [ ] Medium
- [x] High
4. Theme relevance
| Theme | Yes | Primary | Justification (required if checked) |
|---|---|---|---|
| Dynamic Identity | [ ] | [ ] | |
| Continuous Trust and Attestation | [x] | [ ] | The verdict is a claim by the evaluating engine and needs issuer binding, freshness and tamper evidence. It is a candidate for the behavioral part of an agent attestation; the interface is stated on FG-TIDA/themes#22. |
| Delegation | [x] | [ ] | The policy set the agent is evaluated against is an authored artifact issued under an authority. It carries that authority and the version in force at evaluation time. The parameters that shape a verdict (confidence threshold, precedence between colliding obligations, criticality weights) belong to it and are never the engine's to set. Raised on FG-TIDA/themes#5. |
| Discovery and Cross-Border Trust | [ ] | [ ] | |
| Runtime Enforcement (Control Plane) | [x] | [x] | Everything here is decided at the moment of action: evaluation of each output against the intent-expressed policy set, adjudication when obligations collide, and a five-state verdict (permit, remediate, block, escalate to a human, indeterminate with scope). This is task 3 of FG-TIDA/themes#6, and this case is the pilot it should be built on. |
| Embodied AI Identity and Trust | [ ] | [ ] |
Related theme proposals: FG-TIDA/themes#6 (primary: task 3 verdict semantics), FG-TIDA/themes#5 (the reference and its standing), FG-TIDA/themes#1 (the record), FG-TIDA/themes#7 (appraisal and failure semantics), FG-TIDA/themes#16 (the escalation handoff), FG-TIDA/themes#22 (attestation), FG-TIDA/themes#4 and FG-TIDA/themes#26 (enforcement).
5. Requirements
| # | Type (choose one) | Requirement description | Criticality (choose one) |
|---|---|---|---|
| 1 | Technical | A conformance verdict with defined semantics, produced at the moment of action, in a closed vocabulary: permit, remediate, block, escalate to a human, indeterminate. Indeterminate carries scope: what was examined, over what period, as of when. | Must |
| 2 | Technical | The verdict is a claim by the engine that issued it and carries issuer binding, freshness and tamper evidence. A record must be able to carry a verdict without being required to. Where no engine was in the path, the absence is attested, so a suppressed block is distinguishable from no engine. | Must |
| 3 | Technical | Adjudication semantics when obligations collide: declared precedence and criticality, applied at the moment of action and reviewable afterwards. These parameters are properties of the reference, authored and versioned with the policy set. An engine that declares its own threshold can set it to zero. | Must |
| 4 | Legal | Which obligation prevails when two conflict, and what a required-disclosure obligation means when the channel cannot carry it. The authored policy set carries the authority it was issued under, so the resolution is attributable to a party with standing. | Must |
| 5 | Technical | A party who was not present (regulator, auditor, or the firm's own reviewer) can verify the record without the engine operator's cooperation, and can tell three states apart: a verdict, an attested absence of evaluation, and a record that failed appraisal. | Must |
| 6 | Technical | The engine's relationship to the evaluated party is declared as self, contracted or independent, and silence is non-conforming. Requirements against the field are written per decision class in the reference. | Should |
| 7 | Business | Pre-send evaluation fits the communication workflow's volume and latency without routing every message to human review. Escalation happens only for the states that warrant it. A check that cannot run in the path gets turned off. | Should |
6. Assessment criteria
Success criteria: Independent implementations return the same verdict on the same corpus of communications against the same policy-set version. Collisions resolve by the reference's declared precedence. A party who was not present can verify a verdict and can tell an attested absence from a suppressed one. Escalation happens only for the states that warrant it, so human review is spent where it changes an outcome.
Measurable metric: Cross-implementation verdict agreement on a frozen corpus, with every disagreement traced to a named ambiguity in the reference. Collision cases resolved per declared precedence, pass or fail per case. Appraisal outcomes against the must-reject vectors in AVS-0.2 (FG-TIDA/themes#6), reported by rejection class. The verdict distribution over the corpus, with every indeterminate carrying its scope. Escalation rate, as the operating cost of the check.
7. Duplication check
Existing standards or SDOs (which existing work touches this case): ITU-T SG17: XSTR.magAI-behavior (Q16/17), capabilities for agentic AI security and trust controls, adjacent on the behavior side and raised as FG-TIDA/themes#18; X.1285, the identity layer this case assumes; X.aplm-aia (SG17-C-0676), authorization and privilege lifecycle management for AI agents, raised as FG-TIDA/themes#23. Other SDOs: OASIS XACML 3.0 and NIST SP 800-162 (ABAC) for classical policy expression; IRTF RFC 9315, intent-based networking, as prior standards art on "intent"; IETF RATS (RFC 9334), EAT (RFC 9711) and AR4SI for attestation and the evidence-side result vocabulary; IETF WIMSE for workload identity. Industry: post-send electronic-communications surveillance products in financial services.
Overlap notes (why the work named above does not already solve this): Surveillance products detect after a message has been sent, keep their rules proprietary, and produce no verdict a third party can verify; this case is pre-action and asks for a standard verdict, adjudication semantics and a record. XACML and ABAC bind rights to attributes of the requester; the obligations here are properties of the output and hold whoever produced it, which is the distinction FG-TIDA/themes#4 and FG-TIDA/themes#6 both work. RATS and AR4SI attest a platform and report what a verifier could conclude from evidence. Neither reaches whether an action conformed to an authored obligation, and AR4SI's no-assertion is evidence-side where the indeterminate verdict here is action-side. XSTR.magAI-behavior addresses declared operators and drift at system level; a conformance verdict against a named obligation set is one instance of that measurement. X.aplm-aia covers the lifecycle of an agent's privileges and lists intent-based authorization among its dimensions; it governs what an agent may hold, and this case concerns whether a specific output met a specific obligation. No SDO work identified so far specifies the verdict, its vocabulary, its adjudication semantics under collision, or its carriage.
8. Maturity
Pilot status
- [x] Hypothetical
- [ ] Pilot in progress
- [ ] Deployed in production
Reference implementation: n/a. The case is stated generically and describes no single deployment. It draws on engagement experience in regulated financial services, including a prior blind evaluation of a policy-conformance layer on FINRA-governed wealth-management communications that the evaluator generated independently. Public artifacts: FG-TIDA/themes#6, including the five-state verdict vocabulary, the attested-absence requirement, and the AVS-0.2 appraisal checks and must-reject vectors contributed there by @tyche-dev.
9. IP and confidentiality
Confidentiality level
- [x] Public
- [ ] FG-internal only
- [ ] Redact before publication
IP notes (optional): None. Generic description; no client, product or system is identified. The requirements in Section 5 are stated independently of any implementation and are meant to be satisfiable by any engine.
10. Assets
Link to assets:
- [ ] Dataset
- [ ] Code
- [ ] Protocol
- [x] Other: https://github.com/FG-TIDA/themes/issues/6 (theme text, task 3 verdict semantics, AVS-0.2 appraisal checks and vectors)
IP notes (optional): As Section 9.
Supporting note (outside the template). Expressing a single obligation as intent is tractable: "no performance guarantee present", "required risk disclosure present", "balanced presentation of risk and return" are all properties of the output. The failure in deployment comes when two expressed obligations return opposite verdicts on the same sentence and nothing says which wins. An implementation then resolves it silently, and neither the compliance function that authored both obligations nor the regulator reading afterwards can see how. That is why Section 5 puts precedence and criticality in the reference, and why the record carries which obligations collided along with the verdict.
Relation to use cases #4 and #13. Use case #13 puts a single policy at a fail-closed gate. This case puts several policies in conflict on one output, which is where a gate needs a verdict it can act on, including escalate and indeterminate. Stage 2 of the testbed in use case #4 is a regulated financial profile; this case is offered as that substance, and can be expressed in the UC-4 input package once the UC-6 pilot has run.
Revisions
- No file revisions have been uploaded.