Over the past year, banks have moved AI agents into production across fraud triage, loan intake, customer service, and engineering. On November 4, the Office of the Comptroller of the Currency published Bulletin 2026-54 and its Supervisory Framework for Super Intelligence. It's the playbook examiners will use to review that work. Across 22 pages, its message is clear: a policy document alone won't be enough. Banks need to see every agent, control what each one can do, and show examiners the proof. Read on for a breakdown of the framework and steps you can take now to get exam-ready.
What the OCC's AI framework says
The framework provides guidance for examiners, outlining the ways in which they should evaluate national banks and federal savings associations’ use of AI. "Super Intelligence," or SI, is the OCC's term for AI under Executive Order 14434.
The framework aligns AI to the preexisting risk categories banks already manage: operational, compliance, credit, cyber and third-party. Examiners are instructed to evaluate AI systems and agents against 6 primary considerations:
- Purpose: what is the agent allowed to do?
- Risk: what happens if its output or action is wrong?
- Control: what stops unauthorized, inappropriate, or unsafe actions?
- Oversight: who watches it and who’s accountable?
- Resilience: can you detect, contain, and recover from a failure without disrupting critical processes?
- Assurance: can you provide evidence of continuous control health?
Throughout the document, the tone is pro-adoption. The OCC says SI "used with adequate controls" can strengthen risk management and expand access to financial services. The goal is to help banks adopt AI with confidence, not to slow them down.
Tier agent risk by what they can do
The framework's core principle is that risk depends on "consequences, transfer of agency, and the degree of human oversight, rather than the technical sophistication of the SI used”. In the OCC's own example, a simple rules-based agent that can start transactions can carry more risk than an advanced model that drafts text.
Agent scope matters as much as tier. Banks have to define each agent's permitted use "in terms that can be tested". Activity outside that scope "may be treated as a control failure even when the resulting output or action appears reasonable". This is why it’s critical to monitor agent intent drift across every session. If you ask an agent to summarize a loan file, and it references a poisoned document, its tool calls and permissions may look completely benign. Under the framework, however, that drift can count as a control failure.
The real answer to "what can this agent do?" is hidden across OAuth grants, API keys and service accounts in dozens of systems. That's why agent identity and permissions management is quickly becoming its own discipline. The Identity and permissions layer is only one piece of the puzzle, though.
Prepare for the four questions examiners will ask
Most of the framework's control components come down to four questions. Here's how to get ahead of each one.
What is each agent allowed to do? Keep an updated inventory of every agent, with its owner, provider, permissions and deployment status. You can't govern agents you can't see, so discovering shadow AI is the natural first step.
Who owns it, and who approved it? Every agent needs a named, accountable owner. For high-risk actions, human review has to happen before the agent acts.
How do you contain it? Examiners want to see that agent identities are governed like privileged users. The framework calls for least privilege, rate limits, and kill switches. Because intent drift builds over the course of a session, full session traces must be monitored, not just individual tool calls.
Can you prove what it did? Examiners will want to rebuild a decision from its inputs, tool calls, approvals and overrides, along with any changes to versions and permissions. Today that trail is usually split across every vendor the agent touched, if it exists at all. Our guide to AI agent audit trails covers what a useful record looks like.
Make the safe path the golden path
Banks need a way to continue putting agents to work without sacrificing observability, security, and control. Runlayer doesn't make you choose.
Runlayer sits between your agents and your systems, where most of the framework's controls have to run. Copilot, Claude, and the agents your users build all reach core systems through one AI control plane. Every agent gets an identity, deterministic policies, and a thorough audit log of all session traces. With Runlayer, banks get:
- Shadow AI discovery and an agent catalog, so you can see every agent running across the business, including the ones nobody registered.
- Agent IAM and policy conditions, so each agent's permitted use is enforced on every tool call
- Human approval rules, so a person signs off before a sensitive action runs.
- Runtime Security with intent-based detections, so you can catch an agent drifting from its task or falling for prompt injection, and stop the session before it does any damage.
- Sessions and audit logs with SIEM export, so your audit team can show examiners the full trail.
See why leading enterprises like AngelList, Lemonade and Gusto trust Runlayer to put AI to work securely across the business → book a custom demo.
