Three weeks after the Acme.ServiceAgent v2 cascade incident (the post-mortem in lesson 088), your Chief AI Officer presented to the Acme Board Risk Committee. The board did not dwell on the EUR 47K refund leakage. The board asked one question: "We have an AI Governance Committee that ratifies high-risk systems under Article 27. We have an internal AI audit function (lesson 093). We have a system-card lesson (027). We have an agentic FRIA lesson (047) and an autonomy-tier matrix (049). Why did none of that catch the cascade?" The answer the CAIO gave is the subject of this lesson. The AIGC charter ratifies systems; the FRIA assesses deployments; the autonomy-tier matrix scopes actions: none of those artifacts, on their own, is the operating standard that governs the runtime properties of an agent at production tier-1 scale. Acme has Acme.ServiceAgent, Acme.ProcurementBot, Acme.CodeReviewer, Acme.ResearchSwarm, Acme.LoanOutreach, Acme.TriageHealth, and 14 more agents either in production or in pilot. Each of them has tools, memory, an autonomy tier, an inter-agent communication path, and a notional kill-switch. None of them has a single document that codifies all five together and binds the AIGC to ratify, the auditor to test, and the operator to drill. The CAIO committed to a 90-day buildout: an Agentic AI Standard, 12 elements, applicable to every Acme agent above autonomy Tier 2, ratified by an AIGC Agentic Subcommittee chartered for technical depth, drilled quarterly via kill-switch exercise, audited annually under the lesson 093 plan, and surfaced to deployer-side customers via Annex XII pass-through. This lesson is the L4 leadership view of that buildout. By the end you can charter the subcommittee, draft the standard, run the drill, and defend the governance design under Articles 14, 15, 26, 72, and 73 of Regulation (EU) 2024/1689 with full OWASP Agentic Top 10, NIST AI RMF, ISO 42001, MITRE ATLAS, and CAISI Agent Standards Initiative cross-coverage.

Why a Dedicated Agentic Governance Standard at L4 in 2026

The 2026 production posture of agentic AI is materially different from the 2025 posture in three measurable ways, and each delta has a governance consequence. First, agents have moved from proof-of-concept to tier-1 production at enterprise scale. The internal Acme inventory above is representative; the State of Agentic AI 2026 industry survey (CAISI / OWASP joint publication, March 2026) confirmed that 41% of Fortune-500 enterprises have at least one tier-3+ agent in production with five-figure monthly action counts, up from 6% in mid-2025. The governance consequence is that the agent is no longer the "interesting experiment" the AI Officer toured the audit committee through once a year. It is a tier-1 service whose failure mode produces customer-visible incidents at the scale the cascade lesson (088) demonstrated. The L3 agentic-FRIA artifact (lesson 047) and the L3 autonomy-tier matrix (lesson 049) are the building blocks; the L4 deliverable is the standing operating standard that codifies the building blocks into a single ratified, audited, drilled document.

Second, the threat surface has crystallized. The OWASP Agentic Top 10 (ASI01-ASI10) was published December 9, 2025 (lesson 066 covers the technique-by-technique mapping). MITRE ATLAS v5.4.0 added a new agentic-technique tranche in February 2026 covering inter-agent spoofing, agent memory tampering, and tool-publication poisoning. The CAISI Agent Standards Initiative launched February 17, 2026 with the explicit charter to harmonise agent oversight, identity, memory, and tool-allowlist vocabularies across NIST, ISO, OECD, and the EU AI Office. The Article 5 prohibition list does not address agent-specific behaviours directly, but Article 14 (human oversight), Article 15 (accuracy, robustness, cybersecurity), and Article 26 (deployer obligations) have all been interpreted by AI Office guidance Q2 2026 to apply to multi-step agentic systems with explicit reference to the OWASP and CAISI vocabularies. A 2026 AIGC that ratifies a tier-3+ agent without OWASP Agentic Top 10 exposure mapping, without CAISI-aligned identity attestation, and without an Article 14-compliant kill-switch design is ratifying a system that the regulator's playbook has already named as non-conforming.

Third, the enforcement window is open. Annex III high-risk classifications now apply to agentic deployments in §3 employment (agentic resume screening, agentic performance management), §5(b) creditworthiness (agentic loan-outreach), §5(c) life-and-health insurance pricing, §6 law enforcement, §7 migration/asylum, and §8 administration of justice, and the August 2, 2026 Article 99 penalty regime is in force. Article 99(3) (EUR 15 million / 3% of worldwide annual turnover) covers Article 14, 15, and 26 failures, which is the category most agentic incidents will surface under. Article 99(2) (EUR 35 million / 7%) is reserved for Article 5 prohibition surfacing, possible if an agent's autonomous action breaches a prohibition (e.g., social-scoring, untargeted facial-image scraping). The L4 leadership question is not whether the firm has an "agentic strategy" but whether the firm has an Agentic AI Standard that the regulator can audit and the operator can drill against. The remainder of this lesson builds that standard.

The Five-Dimension Agentic Governance Architecture

An agent is not a model. The system-card lesson (027) decomposed it into five composable layers, model, tools, memory, identity, guardrails, and the agentic FRIA (047) demonstrated that each layer carries its own Charter exposure. The L4 governance question is whether the standing operating standard addresses each layer with named accountable, time-to-action SLA, and drill cadence. The five governance dimensions below are the architectural anchor for the 12-element standard in the next section and for the production-pattern scenarios in the section after.

Dimension 1 - Autonomy. Four tiers (Tier 1 SUGGEST, Tier 2 CONFIRM, Tier 3 ACT, Tier 4 AUTONOMOUS PLANNING. Note the L4 framing extends Tier 4 to include multi-step planning, not merely single-action autonomy). Each tier triggers different governance gates: Tier 1 and Tier 2 may be ratified by the AI Officer with AIGC notification; Tier 3 requires AIGC ratification with FRIA (if Annex III) and IMV at the Standard depth; Tier 4 requires AIGC Agentic Subcommittee ratification (see governance committee sub-pattern below) with FRIA, IMV at the Critical depth, Article 26(7) worker-representative consultation if employment-related, and Article 27 stakeholder consultation if Annex III §5/§7/§8. The autonomy-tier-gate matrix is the entry point of the standard; everything downstream calibrates to the tier.

Dimension 2 - Tools. The tool layer is governed by four binding controls. Allowlist with per-call schema validation, every tool the agent can invoke is enumerated; every call is validated against the tool's published JSON schema before execution; calls failing validation are refused with structured error rather than silently retried. Per-tool authorization (RBAC), each tool is bound to a specific role; the agent's service-account identity must hold the role; calls outside the role envelope are refused at the platform layer (defense-in-depth against runtime bypass). Per-tool budget, three sub-components: rate limit (calls per unit time per user / per agent / aggregate); cost cap (monetary cap on cost-bearing tools, e.g., procurement, refund, outreach; cascade incident root cause was the absence of this cap); irreversibility budget (count of irreversible actions per session, per day, per agent; reset on confirmation gate). Per-tool audit trail, every call logged with (agent identity) × (user identity) × (tool) × (parameters) × (result) × (timestamp); logs cryptographically signed (DSSE-style attestation) and stored in append-only WORM for the Article 18 ten-year window. The four tool controls are the binding implementation of Article 14 oversight at the tool layer; missing any one is an Article 99(3)-graded gap.

Dimension 3 - Memory. The memory layer is governed by four binding controls. Write-gate with provenance tags, every memory write must pass a write-gate that attaches (source interaction ID) × (writing agent) × (write timestamp) × (PII filter outcome); writes failing the gate are refused. Retention TTL, every memory entry has a published time-to-live; expired entries are purged on a nightly batch with attestation log. PII filter on write: the write-gate includes a PII-detection filter (named-entity recognition + regex + LLM-classifier ensemble); detected PII is either redacted, gated on explicit Article 6 GDPR legal basis, or refused; the filter outcome is logged for GDPR Article 30 records-of-processing-activities evidence. Memory-poisoning detection, nightly cross-user-pattern detector; integrity hash comparison vs source-of-truth; alert thresholds with named on-call; memory-wipe capability as the remediation primitive (full partition wipe within 5 minutes; partial entry wipe within 1 minute; both with immutable snapshot capture for forensic analysis). Memory is the new Charter Article 8 + Article 47 surface; the OWASP ASI06 Memory Poisoning technique is the most-likely-to-surface incident category in 2026 per the CAISI Q1 2026 incident telemetry summary.

Dimension 4 - Inter-agent communication. The shift from single-agent to multi-agent deployments is the 2026 step-change. The CAISI Agent Standards Initiative (February 17, 2026) explicitly prioritised inter-agent identity attestation as a Q1 2026 vocabulary deliverable. The four binding controls: message signing, every inter-agent message signed with Sigstore-issued ephemeral certificate using DSSE (Dead Simple Signing Envelope) payload format, or where Sigstore is operationally infeasible, JWS with HSM-protected agent identity keys rotated daily; receiving-agent validation, the receiving agent validates signature, certificate chain, and message-schema before processing; messages failing validation are dropped and logged; identity-bound roles, the sending agent's signed identity must hold the role authorising the requested action on the receiving agent; anti-replay, nonce + monotonic timestamp + receive-side replay-window cache. The four controls together mitigate OWASP ASI07 Inter-Agent Spoofing and ASI06's inter-agent attack vector ("sibling-agent poisoning"). Acme's multi-agent research swarm (production pattern 4 below) is the binding test case for the inter-agent stack.

Dimension 5 - Kill-switches. The kill-switch is the Article 14(4)(e) "stop button" capability the regulator will ask for operational evidence of. The agentic kill-switch is not one button; it is a layered set of five capabilities each with named accountable, time-to-action SLA, and drill cadence. Circuit-breaker disable, agent runtime stopped accepting new sessions and gracefully drains in-progress (CAIO or designated on-call; <5 minutes; quarterly drill). Tool-allowlist revocation, specific tool removed from allowlist or all tools revoked (Agent Engineering Lead; <2 minutes per tool; quarterly drill with rotating tool selection). Memory wipe: full or partial memory partition wipe with immutable snapshot (CISO + DPO joint authorisation for full wipe, Agent Engineering Lead for partial; <5 minutes for partition, <1 minute for entry; semi-annual drill). Version rollback, agent prompt + tool catalog + memory schema + base-model pinned version reverted to last-known-good (Agent Engineering Lead; <15 minutes; quarterly drill). Traffic-shed, load-balancer routes user traffic to fallback non-agentic flow (e.g., standard ServiceNow self-service); the agent is offline for users but operators retain investigation access (Platform SRE; <2 minutes; quarterly drill in conjunction with circuit-breaker). The drill evidence is the Article 14 + Article 72 demonstrable-monitoring artifact and the ISO 42001 A.6.2.7 control evidence.

The 12-Element Agentic AI Standard

The five-dimension architecture is the conceptual anchor; the 12-element Agentic AI Standard is the document the AIGC Agentic Subcommittee ratifies, the auditor tests, and the operator drills against. The 12 elements are not a checklist: each element is a chartered subsection with named accountable, mandatory artefacts, and a defined refresh cadence. Acme's full Agentic AI Standard document is ~70 pages; the structural outline is below.

Element 1 - Scope and applicability. What systems the standard governs (every agent at Tier 3 or above; every multi-agent system regardless of tier; every agent invoking Tier W-Br or Tier R-X tools); what systems are out-of-scope (single-turn chat without tool invocation, governed by Article 50 disclosure standard); the test for "agentic" (system that maintains state across turns + invokes ≥1 tool + has identity-attributable side effects). Accountable: AI Officer. Refresh: annual or on architecture change.

Element 2 - Autonomy tier definitions and governance gate matrix. Tier 1-4 definitions per the autonomy lesson (049) plus the Tier 4 PLANNING extension; the gate matrix (who ratifies, what artefacts, what cadence) per the dimension-1 section above. Accountable: AI Officer + AIGC Chair. Refresh: annual.

Element 3 - Tool inventory, allowlist, and revocation procedures. The full tool inventory with sensitivity tier (R / W-B / W-Br / R-X per lesson 047), the per-tool budget (rate, cost, irreversibility), the per-tool authorization mapping (which agent identity may invoke), the revocation procedure (operator action + platform-layer enforcement + audit). Accountable: Agent Engineering Lead. Refresh: on tool add/remove, minimum quarterly.

Element 4 - Memory architecture, retention, and provenance. The memory-layer enumeration (short-term, persistent per-user, organisation-wide cache, vector store); per-layer retention TTL; write-gate specification with PII filter outcome handling; provenance-tag schema; memory-wipe procedures; GDPR Article 15/16/17 fulfilment pathways. Accountable: DPO + Agent Engineering Lead jointly. Refresh: quarterly.

Element 5 - Inter-agent communication protocol and signing. The signing primitive (Sigstore-DSSE preferred, JWS fallback); the receiving-agent validation procedure; identity-bound role attestation; anti-replay design. Accountable: CISO + Agent Engineering Lead jointly. Refresh: on protocol change, minimum annually.

Element 6 - Kill-switch inventory and drill cadence. The five kill-switch capabilities (circuit-breaker, tool-revocation, memory-wipe, version-rollback, traffic-shed) per dimension-5 above; per-capability named accountable, time-to-action SLA, drill cadence, evidence retention. Accountable: CAIO + Platform SRE Lead jointly. Refresh: quarterly drill cycle.

Element 7 - Human-in-the-loop oversight (Article 14). The Article 14(4)(a)-(e) capabilities mapped to the agent's specific design. Understand capacities/limitations (operator training); avoid automation bias (post-action sample review); correctly interpret output (audit dashboard); disregard, override, reverse (user/operator override capability); stop button (the kill-switch above). Accountable: AI Officer + AIGC Chair. Refresh: annual.

Element 8 - Article 26 deployer-side responsibilities. Article 26(1) use in accordance with instructions for use; 26(3) competence assignment of named oversight officers; 26(4) ongoing effectiveness monitoring; 26(5) serious-incident reporting; 26(6) input-data quality control; 26(7) worker-representative consultation if employment-related; 26(8) registration in EU database if applicable. Accountable: AI Officer. Refresh: annual or on regulator guidance update.

Element 9 - Monitoring and telemetry (Article 72). Per-tool call rate / error rate / latency / cost; per-user session length / tool-chain depth / refusal rate; per-agent uptime / version / drift signals; memory growth rate / poisoning-detector alerts; inter-agent message volume / signature-validation failure rate; kill-switch trigger frequency. SIEM integration; alert thresholds; on-call rotation. Accountable: Platform SRE Lead + CISO jointly. Refresh: quarterly review of thresholds.

Element 10 - Incident response (Article 73). Detection (telemetry alerts + complaint channels + red-team findings); triage (incident classification per agent-specific classes from lesson 027 §12); contain (kill-switch invocation); investigate (forensic snapshot retrieval); report (Article 73 15-day / Article 26(5) deployer-side / Article 33-34 GDPR breach if personal data + regulator-specific notifications). Accountable: CISO + AI Officer + General Counsel triumvirate. Refresh: post-incident plus annual tabletop.

Element 11 - Substantial-modification triggers (Article 43(4)). The catalogue of changes that re-trigger conformity assessment for high-risk agents: tool catalog change beyond minor; memory architecture change; base-model major-version change; autonomy-tier upgrade; multi-agent expansion; new high-risk category onboarding. Accountable: AI Officer + Notified Body liaison if Module H. Refresh: on regulator guidance update.

Element 12 - Annex XII downstream information. When Acme is the agentic provider (e.g., we ship Acme.ServiceAgent to a customer for their internal deployment), the deployer-side customer needs agentic-specific information that goes beyond Annex XII's GPAI-model focus, tool inventory and revocation interface; memory architecture and retention controls; autonomy tier capabilities and configuration surfaces; kill-switch interfaces (API + dashboard); incident-notification channel; refresh cadence. Acme's Annex XII pass-through pack for agentic systems is a separate ~30-page document referenced by every commercial agent contract. Accountable: AI Officer + General Counsel. Refresh: on standard update.

Six Production-Pattern Scenarios with Governance Overlays

The 12-element standard is necessary but not sufficient; the L4 leadership artefact is the demonstration that the standard governs the specific agent patterns the firm actually runs. Acme's six representative patterns and the governance overlay each requires:

Pattern 1 - Customer-service agent (multi-turn + tool use + RAG). Acme.ServiceAgent is the worked example throughout this program (lessons 027, 047, 066, 088). Tier 2 CONFIRM for refund and ticket-escalation actions; Tier 3 ACT for KB lookup and informational responses. AIGC ratification required (Tier 3 threshold). Lesson 027 system-card maintained and refreshed quarterly. FRIA optional in current Annex-III-non-triggering scope but produced anyway per the lesson 047 voluntary-policy. Kill-switch quarterly drill with full revocation-and-restore. Annex XII pass-through pack provided to enterprise B2B customers deploying Acme.ServiceAgent in their helpdesks. Penalty exposure: Article 99(3) EUR 15M/3% for Article 14/15/26 failures (the cascade incident lesson 088 is the canonical example).

Pattern 2 - Procurement agent (multi-step + irreversible purchases). Acme.ProcurementBot autonomously orders office supplies under board-approved budget envelopes. Tier 4 AUTONOMOUS PLANNING: but with a hard EUR 500/order budget cap, an aggregate EUR 5,000/day cap, a per-vendor allowlist, and an irreversibility-budget of 1 (any irreversible action triggers immediate confirmation gate before execution). Annex III §5(b) is creditworthiness-adjacent but Acme.ProcurementBot operates with Acme as the payer, not the credit subject, so Annex III §5(b) does not strictly apply; however, Acme adopts §5(b)-style controls voluntarily because the financial-irreversibility surface is parallel. FRIA required per the lesson 047 internal policy. AIGC Agentic Subcommittee ratification (Tier 4 threshold). Kill-switch quarterly drill includes vendor-API revocation in addition to standard layers. Penalty exposure: Article 99(3) for Article 14/26 failures; voluntary FRIA reduces effective exposure.

Pattern 3 - Software-engineering agent (Claude Code-style + tool use + code generation). Acme.CodeReviewer assists engineers with code review and generation against a sensitive-repository allowlist. Tier 3 ACT, agent may open pull requests but human must merge; agent may run tests in sandboxed CI but cannot deploy to production. Tool allowlist scoped to: repository read; pull-request create; CI invoke; code-search read. Explicitly excluded: production deployment; secrets read; arbitrary shell execution. Review gates per change: mandatory two-human review for any PR the agent authored, mandatory CI green, mandatory security-scan pass. No persistent memory across user sessions (per-session ephemeral context only), explicit design choice to avoid OWASP ASI06 Memory Poisoning surface in a high-trust code context. AIGC ratification (Tier 3). Annex III applicability: not directly (engineering productivity tool, not Annex III category), but if the agent generates code that ends up in Annex III high-risk systems, the lesson 027 system-card discipline carries through to the downstream deployment.

Pattern 4 - Multi-agent research swarm. Acme.ResearchSwarm coordinates 3-12 specialist agents (literature-search, data-extraction, analysis, synthesis, critique) on long-horizon research tasks. Tier 4 AUTONOMOUS PLANNING for the orchestrator; Tier 3 ACT for the specialists. Safety supervisor agent: a separate non-operational agent monitors all inter-agent messages for OWASP ASI05/06/07 signatures (sibling-agent poisoning, instruction laundering, identity spoofing); supervisor has authority to invoke kill-switch on the swarm. Inter-agent signing per dimension 4 above (Sigstore-DSSE in production; quarterly key rotation; receiving-agent validation). AIGC Agentic Subcommittee ratification. FRIA produced (research outputs are not direct Annex III but may feed into downstream Annex III decisions; voluntary policy applies). Penalty exposure: Article 99(3) primary; Article 99(2) if a swarm action surfaces an Article 5 prohibition (e.g., untargeted scraping for facial-recognition database, explicitly forbidden in supervisor policy).

Pattern 5 - Autonomous loan-default outreach. Acme.LoanOutreach contacts customers whose loans are approaching default with restructuring options. Annex III §5(b) high-risk, creditworthiness adjacency means full Annex III obligations apply. Tier 4 AUTONOMOUS PLANNING for outreach sequencing and channel selection, BUT with mandatory human approval per individual outreach (Tier 2 CONFIRM gate per outreach action). FRIA mandatory (Article 27); IMV at Critical depth; Article 27 stakeholder consultation (consumer-protection bodies + worker-representative + customer-advocacy group). Article 86 right-to-explanation pathway documented for every contacted customer. Article 26(7) worker-representative consultation for the collections team whose work is augmented. Kill-switch quarterly drill includes customer-facing-message graceful-shutdown sequence. Penalty exposure: Article 99(3) for Article 14/15/26/27 failures; Article 99(2) only if Article 5(1)(a) "exploitation of vulnerabilities" prohibition surfaces (the FRIA explicitly forbids targeting outreach by vulnerability inference, and the supervisor enforces).

Pattern 6 - Healthcare triage agent. Acme.TriageHealth assists clinicians with patient-symptom triage in Acme-operated occupational-health clinics. Annex III §5(a) high-risk (essential private services, healthcare access) + Annex I Medical Device Regulation overlay (the system makes diagnostic-adjacent recommendations). Module H notified-body conformity assessment required. Tier 2 CONFIRM maximum: no autonomous treatment, no autonomous prescription, no autonomous referral. Tool allowlist: patient-record read; symptom-database read; recommendation-draft to clinician. Explicitly excluded: prescription write; lab-order write; specialist-referral write. Memory: ephemeral session-only (no persistent per-patient memory in the agent layer; EHR is the system of record). FRIA mandatory + DPIA mandatory + MDR clinical-evaluation mandatory. Article 26(7) worker consultation with clinicians (medical staff representatives, not Works Council). Kill-switch drilled quarterly with clinical-safety-officer involvement. Penalty exposure: Article 99(3) AI Act + MDR penalty regime + Member State medical-device law + Member State patient-safety law (cumulative liability, the L4 board briefing emphasises the multiplier).

AIGC Agentic Subcommittee, Kill-Switch Drill Cadence, and Common 2026 Failures

AIGC Agentic Subcommittee charter. The standing AI Governance Committee (lesson 014) is broad. It ratifies high-risk systems across all Annex III categories, sets policy, briefs the board. The L4 step is to charter an Agentic Subcommittee that owns the technical depth the full AIGC cannot afford to develop. Membership (Acme's design, representative of the 2026 maturity curve): Subcommittee Chair (the AI Officer reporting to the AIGC Chair); Agent Engineering Lead; CISO delegate; DPO delegate; SRE Platform Lead; external agent-security advisor (rotating annual contract); rotating-seat for the business owner of the agent under review. Cadence: standing monthly meeting; ad hoc on incident or new agent onboarding; quarterly summary to full AIGC; semi-annual brief to Board Risk Committee. Authority: ratifies Tier 3 and Tier 4 agents subject to AIGC notification; recommends to AIGC on substantial-modification reviews; approves the kill-switch drill calendar; receives the quarterly drill evidence and the annual audit findings. The subcommittee charter is the L4 governance pattern. It does not replace the AIGC, it gives the AIGC the technical capacity to govern agents at production scale.

Kill-switch drill cadence. Tier 3 agents drilled at minimum quarterly; Tier 4 agents drilled at minimum quarterly with additional table-top exercise semi-annually. The drill protocol covers all five kill-switch capabilities (circuit-breaker, tool-revocation, memory-wipe, version-rollback, traffic-shed) on a rotating schedule so each capability is exercised at least annually. Mean-time-to-kill SLA, Tier 4 agents must achieve full circuit-breaker invocation within 60 seconds of operator decision; tool-revocation within 2 minutes per tool; memory-wipe within 5 minutes for partition. Acme's post-cascade Q2 2026 drill demonstrated 47-second median time-to-kill for Acme.ServiceAgent, under the 60-second target with adequate margin. Evidence: drill plan, operator log, telemetry timeline, retrospective notes, AIGC subcommittee acknowledgment. Retention: 10 years per Article 18. The drill evidence is the ISO 42001 A.6.2.7 (incident response readiness) and the EU AI Act Article 72 (monitoring) operational evidence; the annual internal audit (lesson 093) selects drill evidence as a standard test object.

Common 2026 agentic governance failures. Seven patterns the CAISI Q1 2026 incident summary and Acme's own post-cascade lessons learned identify:

• (1) Treating an agent as a standard LLM. The single most common failure. The system is governed under the LLM-disclosure standard (Article 50) and the lesson 027 system-card is sized for a model, not an agent. The tool/memory/inter-agent dimensions are absent from the governance pack; when an incident surfaces a tool-misuse or memory-poisoning vector, the firm has no operating standard against which to remediate. Mitigation: the 12-element Agentic Standard adopted as a separate document from the model-disclosure standard.
• (2) No kill-switch drill. The kill-switch is documented as a capability but never exercised. When a fire occurs, the operator discovers the runbook is out of date, the revocation interface requires three sign-offs that take 90 minutes, or the platform-layer revocation does not actually disable downstream tool authorisation. The cascade incident (lesson 088) Acme post-mortem identified a 4-hour mean-time-to-kill in the absence of drill; the post-remediation drill cycle achieved 47 seconds. Mitigation: quarterly drill cadence with documented evidence; Article 14 + Article 72 evidence.
• (3) No inter-agent message signing. Multi-agent systems where agents communicate via unsigned messages are vulnerable to OWASP ASI07 Inter-Agent Spoofing, a compromised agent or an injected message can impersonate a sibling and trigger unauthorised actions. Mitigation: Sigstore-DSSE in production, JWS fallback; receiving-agent validation; identity-bound roles; anti-replay.
• (4) Memory without TTL or PII filter. Persistent memory accumulates indefinitely; PII enters memory without explicit Article 6 GDPR legal basis; the memory becomes a covert personal-data store outside the GDPR records-of-processing. When a regulator examines, the firm has no defensible retention schedule and no Article 15 access mechanism. Mitigation: TTL on every memory entry; PII filter on write; GDPR Article 15/16/17 fulfilment pathways documented.
• (5) Tool allowlist too broad. The "least-privilege violated" failure. The agent is granted tool authorisations broader than its tasks require, typically because the engineering team wanted flexibility or because the tool was provisioned for an earlier use case and never narrowed. The broad allowlist is the attack-surface multiplier; a hijack or memory-poisoning incident pivots into broader damage. Mitigation: per-tool authorisation review at minimum quarterly; principle-vs-practice gap documentation; sensitivity-tier enforcement.
• (6) AIGC ratifies Tier 4 without budget cap. The procurement-agent failure mode. The AIGC ratifies a Tier 4 autonomous agent because the business case is compelling; the budget cap is left to "engineering operational discretion"; the agent's first-month cost overruns the business case by 8x because no hard cap is enforced. Mitigation: budget cap is a mandatory element of Tier 4 ratification at the AIGC subcommittee; cap is in the standard, enforced at platform layer, surfaced in monitoring.
• (7) No Annex XII pass-through for deployer-side agentic use. The firm provides an agent to a B2B customer for the customer's internal deployment; the customer is the deployer; the customer needs agentic-specific information to discharge their Article 26 obligations; the firm provides only the GPAI-model-focused Annex XII pack. The customer cannot demonstrate Article 26 compliance because they lack the agentic information; the firm faces breach-of-contract exposure and the customer faces regulator exposure. Mitigation: agentic-specific Annex XII pass-through pack covering tool inventory, memory architecture, autonomy tier, kill-switch interfaces, incident notification, refresh cadence.

Worked Acme.ServiceAgent v2 example. The post-cascade remediation in lesson 088 left Acme.ServiceAgent operational but governance-deficient. The Q2 2026 buildout closed the gap: full 12-element Agentic AI Standard adopted with v2 of Acme.ServiceAgent as the first fully-conformant instance; Tier 2 CONFIRM confirmed as the operating tier for refund and escalation actions (no Tier 3 ACT for cost-bearing tools); tool budget caps added (refund tool capped at EUR 50/call without human approval, EUR 500/day aggregate per user, EUR 5,000/day aggregate per agent); memory write-gate with PII filter operational (GDPR Article 6(1)(b) contract-execution basis documented for retained customer-context entries; Article 17 erasure pathway live); kill-switch drilled in Q2 2026 at 47-second median time-to-kill; AIGC Agentic Subcommittee chartered with first meeting March 15, 2026 and v2 ratification June 1, 2026; Annex XII pass-through pack delivered to the top-10 B2B customers of Acme.ServiceAgent for their own deployer-side compliance. The Q3 2026 internal audit (under the lesson 093 annual plan) selected the v2 kill-switch drill evidence and the AIGC subcommittee minutes as primary test objects; no findings issued.

Cross-Walks Across Frameworks

The 12-element Agentic AI Standard serves multiple frameworks simultaneously:

• EU AI Act (Regulation 2024/1689): Article 14 (oversight; elements 6, 7); Article 15 (robustness/cybersecurity; elements 2, 3, 4, 5, 6); Article 26 + 26(5) + 26(7) (deployer obligations; element 8); Article 27 + Annex III categories (FRIA gate; elements 1, 2); Article 43(4) (substantial modification; element 11); Article 50 (transparency; out-of-scope here, covered in disclosure standard); Article 72 (monitoring; element 9); Article 73 (serious incident; element 10); Article 86 (right to explanation; element 7); Annex XII (downstream information; element 12); Article 99(3) penalty regime EUR 15M/3% as primary exposure for Article 14/15/26 failures.
• NIST AI RMF 1.0 + Generative AI Profile (NIST AI 600-1), Govern 1.1 (policy; elements 1, 11) + Govern 5.1 (third-party risk; elements 3, 12); Map 5.1 + 5.2 (risk identification; elements 3, 4); Manage 1.3 (risk treatment; elements 6, 7) + Manage 4.3 (continuous improvement; element 9); Measure 2.7 + 2.8 (monitoring + safety; element 9, 10); Risks 6 (information integrity, relevant to memory poisoning) + 10 (value chain, relevant to inter-agent + Annex XII pass-through).
• ISO/IEC 42001:2023, A.6.2.6 (impact assessment; element 1); A.6.2.7 (incident response readiness; element 10 + kill-switch drill evidence); A.10 (third-party relationships; element 12).
• OWASP Agentic Top 10 (December 9, 2025), ASI01 Goal Hijack (element 7 + element 6 kill-switch); ASI02 Tool/Function Abuse (element 3); ASI03 Identity/Privilege Abuse (element 5 + element 8); ASI04 Resource Manipulation (element 3 budget); ASI05 Supply-Chain Compromise (element 12 + standard CycloneDX 1.7); ASI06 Memory Poisoning (element 4); ASI07 Inter-Agent Spoofing (element 5); ASI08 Repudiation/Untraceability (element 3 signed audit + element 9); ASI09 Human-Agent Trust Exploitation (element 7); ASI10 Rogue Agent (element 1 scope + element 6 kill-switch).
• MITRE ATLAS v5.4.0 (February 2026 agentic additions), AI Agent Context Poisoning (element 4); Memory Manipulation (element 4); Thread Injection (element 7 input validation); Modify AI Agent Configuration (element 3 + element 6 version rollback); RAG Credential Harvesting (element 3 tool scope); Publish Poisoned AI Agent Tool (element 3 allowlist + element 12 supply chain); Escape to Host (element 3 sandboxing); Inter-Agent Spoofing (element 5).
• CAISI Agent Standards Initiative (February 17, 2026), agent-identity attestation (element 5); agent-oversight common vocabulary (element 7); tool-allowlist common standard (element 3); memory-governance vocabulary (element 4); inter-agent signing primitives Sigstore + DSSE (element 5).
• GDPR, Article 6 (legal basis; element 4 PII handling); Article 15-17 (access/rectification/erasure; element 4); Article 30 (records of processing; element 4 + element 9); Article 33-34 (breach notification; element 10).

Key Takeaways

• The L4 deliverable is the standing operating standard. The L3 building blocks (lesson 047 agentic FRIA, lesson 049 autonomy-tier matrix, lesson 066 OWASP Agentic Top 10 mapping, lesson 027 system card) are necessary but not sufficient. The L4 question is whether the firm has a single ratified, audited, drilled Agentic AI Standard that binds the AIGC to ratify, the auditor to test, and the operator to drill.
• Five governance dimensions anchor the standard. Autonomy (4 tiers with gate matrix); Tools (allowlist + RBAC + budget + signed audit); Memory (write-gate + TTL + PII filter + poisoning detection + wipe); Inter-agent (Sigstore-DSSE signing + validation + identity-bound roles + anti-replay); Kill-switches (circuit-breaker + tool revocation + memory wipe + version rollback + traffic-shed, each with named accountable + SLA + drill).
• The 12-element Agentic AI Standard is the operating document. Scope, autonomy gate matrix, tool inventory, memory architecture, inter-agent protocol, kill-switch inventory, Article 14 oversight, Article 26 deployer obligations, Article 72 monitoring, Article 73 incident response, Article 43(4) substantial-modification triggers, Annex XII downstream pass-through.
• AIGC Agentic Subcommittee provides the technical depth. Ratifies Tier 3 and Tier 4 agents; reports to full AIGC; owns the kill-switch drill calendar and the quarterly evidence pack; the L4 governance pattern that scales the AIGC without diluting its standing authority.
• Kill-switch drill cadence is the auditable Article 14 + Article 72 evidence. Quarterly minimum for Tier 3+ agents; Tier 4 mean-time-to-kill SLA <60 seconds; rotate the five capabilities so each is exercised annually; evidence retained 10 years per Article 18; the internal audit (lesson 093) tests the drill evidence as a standard object.
• Six production patterns each need a specific overlay. Customer service (Tier 2-3, AIGC ratification, system-card maintained); procurement (Tier 4 with hard budget cap); software-engineering (Tier 3, no persistent memory, sensitive-tool allowlist); multi-agent swarm (Tier 4 with safety-supervisor agent and inter-agent signing); loan outreach (Annex III §5(b), Tier 4 with per-action approval, full FRIA + IMV + Article 27 consultation); healthcare triage (Annex III §5(a) + MDR, Module H, Tier 2 maximum, no autonomous treatment).
• Seven common 2026 failures map to specific elements. Treating agent as LLM (element 1 scope); no kill-switch drill (element 6); no inter-agent signing (element 5); memory without TTL/PII filter (element 4); broad tool allowlist (element 3); Tier 4 without budget cap (element 2 + element 3); no Annex XII pass-through (element 12).
• Penalty exposure is Article 99(3) primary. EUR 15M / 3% of worldwide annual turnover for Article 14, 15, 26 failures, which is where most agentic incidents surface. Article 99(2) EUR 35M / 7% only if an agent action surfaces an Article 5 prohibition (rare but possible in autonomous-planning contexts; the supervisor pattern in scenario 4 is the mitigation).