On September 16, 2026, the Conference of State Bank Supervisors released its Artificial Intelligence Supervisory Framework. While discretionary, it establishes a standardized baseline for how examiners evaluate AI deployment, assess risk and escalate edge cases for deeper scrutiny.
For security, Risk and Compliance leaders, it acts as an advance blueprint for upcoming examinations. The core expectations are straightforward: map your AI footprint, tier systems by risk, safeguard sensitive data, oversee model outputs and establish firm guardrails around autonomous, high-agency AI.
Ultimately, these requirements converge at a single critical operational point: runtime enforcement inside live workflows.
What the CSBS Framework Asks Financial Institutions to Demonstrate
The CSBS framework is an overlay designed to integrate AI risks into the core operational disciplines your organization already relies on, from model risk and cybersecurity to consumer protection and third-party management.
The framework structures examination around six foundational pillars: initial scoping, document requests, governance and oversight, AI inventory and use cases, generative/emerging AI, and existing supervisory resources.
Scope is critical here. While the framework targets state-chartered banks and state-licensed non-banks (excluding OCC-regulated national banks) state regulators oversee roughly 79% of U.S. banks. Its practical reach across the industry is substantial, regardless of explicit legal obligation.
Crucially, this fills an immediate regulatory void. When federal regulators updated model risk guidance (SR 26-2), they left generative and Agentic AI outside its scope. The CSBS framework steps directly into that gap.
For senior leaders, the mandate is clear: build demonstrable governance and controls that connect AI initiatives to established risk frameworks. Examiners want to see actionable, testable execution.
PlainID directly maps to these supervisory expectations at the operational level:
| CSBS Supervisory Objective | How PlainID Contributes | Business Outcome |
|---|---|---|
| Know where AI is used | Automated discovery across agents, tools, RAG architectures, and data sources, tied to clear ownership and inventory context. | Establishes a complete, audit-ready scoping foundation and real-time evidence base. |
| Govern AI consistently | Centralized policy lifecycle management featuring reusable access models, multi-stage approvals, version control, and strict separation of duties. | Translates high-level policy intent into active, enforceable operational controls rather than passive guidance. |
| Define permission boundaries | Dynamic runtime authorization evaluating human identity, agent identity, intent, data sensitivity, requested action, and environmental context. | Enforces true least privilege and Zero Standing Privileges (ZSP) precisely at execution time. |
| Control sensitive data | Granular pre-retrieval filtering, row/column access controls, dynamic field masking, and post-retrieval output filtering. | Prevents unauthorized, sensitive data from entering or leaving the AI pipeline. |
Governance Sets the Boundary, Runtime Authorization Enforces It
A written policy simply documents intent. During an audit, however, examiners are asking whether the control actually operated on a specific, live transaction.
PlainID serves as the authorization control plane. While the institution retains full accountability for AI governance and risk, PlainID delivers centralized policy management, distributed enforcement and continuous evidence generation at the exact moments AI requests data, invokes a tool, calls an API, executes an action or surfaces output.
Timing is everything. AI agents operate at machine speed, traversing tools, APIs and sensitive data long before a human ever intervenes. Relying on standing or inherited privileges creates quiet, unmonitored risk that far exceeds the intended scope of a task.
Runtime authorization is where policy intent transforms into a real-time, preventive decision, whether that means permitting access, denying execution, applying dynamic masking and filtering, constraining parameters, or forcing a step-up for human approval.
For a bank, this bridges the gap between written AI policy and what an agent can actually access, execute, and expose in production.
Discover, Manage, Authorize, Audit: An Operational AI Governance Model for Banks
PlainID executes the control layer across four distinct, repeatable stages:
- Discover: Surface agents, MCP servers, tools, RAG architectures, knowledge sources, access pathways and observed activity—then classify and enrich that footprint. This establishes the clean inventory foundation required for initial examination scoping.
- Manage: Centralize policies and operational guardrails. Encode clear ownership, business purpose, risk tiering, allowed datasets, tool access, parameter limits, contextual conditions, multi-stage approvals and lifecycle controls.
- Authorize: Dynamically evaluate every transaction against human identity, agent identity, intent, target resource, action, data classification, and environmental conditions, enforcing decisions in real time via prebuilt Authorizers.
- Audit: Capture rich, immutable decision records, including policy versioning, the full identity chain, requested actions, decision logic and enforcement points, to directly feed SIEM systems and forensic investigation workflows.
This four-stage operational model directly mirrors the CSBS’s supervisory arc: scope the environment, establish governance, enforce at runtime and produce audit-ready evidence.
Ultimately, the authorization stage is where your toughest supervisory questions are answered.
What a Defensible AI Authorization Decision Looks Like
Evaluating an Agent’s service identity in isolation is a critical vulnerability. Authorizing the Agent alone isn't enough though, and authorizing only the human leaves the exact same exposure.
PlainID evaluates the entire composite identity and authority chain in real time. Every decision synthesizes the human, the acting Agent, delegated authority, declared intent and the specific resource and action in play.
A truly defensible control layer also factors in dynamic context: environmental risk signals, session state, anomalous behavior patterns, time, location and transaction sensitivity. An Engineer shouldn't be able to query an internal Agent for restricted financial reports outside their role. Likewise, an Agent must never leverage broad background technical privileges to bypass the authority limits of the user it serves.
This dynamic evaluation of access policy at the moment of request enforces true least privilege while adhering to Zero Standing Privileges (ZSP) principles. Access is granted only when real-time context and intent justify it, and adapts immediately as those parameters shift.
Ultimately, this approach transitions least-privilege from a static control into a continuous, end-to-end trust-cycle across the entire Agentic workflow.
Mapping Controls Across the Agentic Workflow
To pull this together, PlainID applies active guardrails across every stage of the agentic execution path, mapping directly to specific CSBS framework references:
| Control Point | Operational Enforcement | CSBS Reference |
|---|---|---|
| Input | Validates composite user and agent identity, channel, intent, and session risk before permitting the agent request to initiate. | GE-4, GE-6, GE-7 |
| Data Retrieval | Enforces pre-retrieval scope filtering to restrict record access, applying dynamic field masking before data ever enters the model context. | IS-8, GE-4 |
| Tools & MCP | Restricts tool exposure to approved capabilities—for instance, allowing "view dispute" while dynamically blocking "issue refund" based on threshold, state, or delegated authority limits. | GE-8 |
| API & Parameters | Enforces strict boundaries around target accounts, amounts, regions, and downstream endpoints, actively rejecting parameter manipulation or scope drift. | GE-8 |
Runtime Authorization in Action: The Billing-Dispute Agent
While internal role boundaries, like keeping an Engineer from querying sensitive financial data, are vital, the highest operational risk sits in live, high-velocity workflows where Agents interact with external data and take financial actions.
To see how these control points operate together in practice, consider a common high-touch deployment: a Customer Service Representative using a generative AI agent to resolve billing disputes. In this environment, the Agent leverages a third-party LLM, queries customer financial records and invokes internal APIs to open cases or issue credits.
Here is how PlainID enforces controls and captures evidence across all seven steps of that live execution flow:
| Flow Step | Operational Risk | PlainID Control Enforcement | Audit Evidence Generated |
|---|---|---|---|
| 1. Request | Prompt injection attacks or requests originating outside approved operational scope. | Validates user identity, agent identity, channel, declared intent, and session risk, automatically blocking unsupported intents. | Input decision log and policy rationale. |
| 2. Retrieval | Unrestricted agent queries reaching unauthorized customer records or excessive PII. | Applies strict relationship, product, geographic, and purpose filters, dynamically masking identifiers prior to model retrieval. | Explicit data scope parameters and applied filter rules. |
| 3. Tool Selection | Unsanctioned execution of high-impact action tools (e.g., initiating refunds). | Exposes only approved capabilities, strictly decoupling view, recommendation, and execution functions. | Permitted tool availability matrix and invocation logs. |
| 4. Parameters | Parameter manipulation shifting transaction target, amount, or routing endpoint. | Restricts accounts to active relationships, caps amounts at policy thresholds, and enforces approved endpoints. | Comparative log of requested vs. permitted parameters. |
| 5. Human checkpoint | Proposed credit exceeds delegated authority or impacts consumer protection rights. | Forces a step-up workflow requiring explicit supervisor approval before execution can proceed. | Approval request, authorizing identity, decision outcome, and defined scope limits. |
| 6. Output | Model output surfacing unnecessary confidential, proprietary, or personal data. | Validates response payload against policy and applies real-time dynamic masking before release. | Output policy compliance log and dynamic masking outcome. |
| 7. Response / Halt | Detection of anomalous agent behavior, scope drift, or vendor-side security incidents. | Instantly revokes authorization via runtime kill-switches to isolate agents, tools, or endpoints while preserving evidence. | System restriction event record and subsequent blocked transaction logs. |
This single operational flow delivers the precise evidence required for sensitive data controls, output oversight, risk containment and the agentic expectations outlined in GE-8.
Equally important, every transaction automatically writes the exact audit record examiners expect to see during a review.
Audit-Ready Evidence for AI Governance, and Where PlainID Stops
Institutions must be able to prove which policy applied and precisely why an action was permitted or denied. PlainID generates business-readable, immutable decision logs designed specifically for that purpose.
At a minimum, every decision record delivers explicit answers to a key set of operational questions:
- Identity: Who initiated the task, and which specific agent executed it?
- Scope: What intent, resource, dataset, tool, and parameters were requested?
- Logic: Which policy, —and specific version, evaluated the request?
- Decision: Was the outcome permit, deny, filter, mask, constrain, or step-up approval, and what was the underlying policy rationale?
- Enforcement: Exactly where in the execution path was the decision enforced?
Together, these records form an audit-ready evidence package: a real-time AI access inventory, control coverage map, policy register, transaction evidence log, sensitive-data control record, agentic action log and exception-monitoring stream.
However, clear boundaries are critical. PlainID delivers preventive authorization controls and the necessary evidence to prove they operated. t does not certify that an underlying model is accurate, fair, explainable, or legally compliant.
PlainID provides the foundational technical control plane for CSBS alignment; governance still defines the boundary. Meanwhile, model risk management, consumer protection compliance, legal interpretation, and overall risk oversight remain fully with the institution.
Map Your AI Controls Directly to the CSBS Framework
Preparing for an examiner doesn't require building another isolated compliance silo. It requires connecting your AI use cases to operational controls that execute in real time and generate clear, verifiable evidence.
PlainID maps your agentic AI workflows directly to the framework's scoping, governance, and generative-AI expectations, pinpointing exactly where controls are active and where critical gaps remain.
Book a targeted CSBS Mapping Discovery Session with our team and bring a single live or planned agent use case. We’ll walk it step-by-step through Discover, Manage, Authorize, and Audit, leaving you with an audit-ready coverage map you can bring to your Risk Committee or Board of Directors.
