Governing Delegated Authority in Autonomous Finance: The MARQUE Framework for Institutional Accountability Beyond Model Risk
The identification, before the fact, of the named person who answers for a system's consequences — and who has both the authority and the information to have prevented them.
A catalog of known agents, their identities, declared capabilities, and endpoints, maintained so that agents and operators can discover one another without prior configuration.
A query engine optimized for analytical workloads — scanning and aggregating large columnar datasets — as distinct from transactional processing.
The property that a past decision can be reconstructed exactly — same inputs, same model state, same evidence, same output — rather than merely narrated from a log.
The permission under which an actor may bind a principal. In agentic finance, the specific answer to: what is this agent permitted to commit, who granted that permission, up to what limit, for how long, and how is it revoked.
The demonstrable property of meeting a stated standard — as distinct from claiming alignment with one. Requires a standard specific enough to fail.
Programmable rules applied to what a system may accept or emit, enforced in code rather than stated in policy, and capable of halting execution.
The layer that determines how individual return sources are combined and sized — weighting, risk targeting, rebalancing and constraint application — as distinct from the signals being combined.
The passing of task-relevant state between agents so that a receiving agent can act without re-deriving what the sending agent already established.
The bounded span of tokens a model can attend to in a single inference, containing the prompt, retrieved material, and conversation so far.
The degree to which data is accurate, complete, timely and fit for the specific use being made of it — assessed against declared expectations rather than in the abstract.
The degradation of a system's relationship with its objective over time, as conditions move away from those it was built and tested under. Distinguished from a wrong answer: drift produces gradually less right ones.
Critical analysis of a model by objective, competent parties with sufficient independence to maintain objectivity and enough organizational standing to compel change.
The systematic measurement of whether a system produces acceptable outputs against defined criteria, on a held-out or adversarial set, before and after deployment.
The recording of what was run, with which data, code, parameters and result, so that a past experiment can be identified and reproduced.
Layered safeguards — policies, technical controls and monitoring — applied at the data, model, application and infrastructure levels to keep a system operating within organizational or regulatory boundaries.
What an agent is, as a distinguishable actor and as a legal matter: whether it can be individually named, whether its actions are attributable to it alone, and to whom its outputs belong.
The movement of data from a source system into an environment where it can be used, including extraction, transport and initial landing.
An open protocol connecting AI systems to external data sources and tools through a client-server interface, in which a server exposes a declared set of resources, tools and prompts to a host application's client.
The property that a system's internal state can be understood from the signals it emits — traces, metrics and logs — without modifying it to ask.
The layer that coordinates multiple agents or steps toward an outcome — sequencing, branching, retry, and the handling of partial failure.
An attack exploiting how an application combines untrusted input with a prompt written by a higher-trust party, causing the system to follow the untrusted instructions.
The interface in which analysis is written, executed and iterated — notebooks, IDEs and their execution models.
The selection of relevant material from a corpus and its supply to a model as context, determining what evidence the model sees before it answers.
What happens when many independently governed agents converge on the same action at the same time, and whether individually compliant systems can be collectively destabilizing.
A single call by an agent to a declared tool, with structured arguments and a structured result.
The conversion of raw data into analysis-ready form — cleaning, joining, aggregating, deriving — expressed as code and ideally versioned and tested.
Retrieval by similarity in an embedding space, returning items whose vector representation is closest to a query's.
ACP (Agent Communication Protocol) — superseded
IMDA Model AI Governance Framework for Agentic AI
A protocol for interoperability between autonomous agents built by different vendors on different frameworks — capability discovery, task delegation, and structured message exchange across organizational boundaries.
The persistence layer through which an agent carries state across invocations — prior decisions, retrieved documents, learned preferences — distinct from both the model weights and the context window.
A permission issued by a principal to a named third party to access specified data, for a specified purpose, for a specified duration, revocable at any time by the principal and enforced at the interface.
A strategy that ranks instruments against one another at a point in time and takes offsetting long and short positions across the ranking, rather than comparing an instrument to its own history.
A URI that resolves to a document containing public keys, authentication methods and service endpoints, controlled by its subject rather than issued by a central registry, and designed to be verifiable and persistent across the platforms the subject uses.
A strategy whose return depends on the direction of price movement, taking long or short positions according to an expected path rather than a spread or a differential.
The obligation to exercise the skill, prudence and diligence that a reasonable professional would exercise in the same circumstances — measured against a standard of conduct, not against the outcome.
A store in which relationships between entities are first-class and indexed, so that traversal across connections is efficient rather than a series of joins.
A risk-control approach in which a human is integrated within an AI system's decision-making process.
A strategy whose return accrues from holding a position over time — a yield, a roll, or a spread that converges — rather than from a change in direction.
The recorded history of a data element — where it came from, what was done to it, and by which job — sufficient to trace an output back to its sources.
The coordination of multiple agents or steps toward an outcome, including sequencing, branching, retry, and the handling of partial failure.
The arrangement by which a human remains accountable for a system's behavior in the interval between a decision being taken and that decision being reviewed. The governed quantity is the interval, not the reviewer.
A strategy held for what it does when other holdings fail, accepting a negative expected return in normal conditions as the price of a payoff in dislocation.
The set of preconditions — cause identified or its absence expressly recorded, an accountable individual's written authorization, and, where a capability is owed to a counterparty, advance notice — that must be satisfied before a halted system may resume operation.
The line across which assumptions about trustworthiness change, and at which input must therefore be validated and authority re-established.
Data License — QIS Ecosystem Dual License
Financial Services AI Risk Management Framework (FS AI RMF)
IOSCO Supervisory Toolkit for AI Use in Capital Markets
The process by which one agent learns what another agent or service is able to do, without that knowledge having been configured in advance.
A strategy expressed through instruments whose value derives from an underlying — options, futures, swaps — where the derivative structure is itself essential to the return rather than incidental to it.
The obligation of a person entrusted with another's interests to act in that person's interest rather than their own — comprising, for investment advisers, a duty of care and a duty of loyalty that cannot be waived, though their application varies with the scope of the relationship.
A capability, required to be maintained and exercisable rather than merely described, to immediately cease some or all automated action as an emergency measure — without the cooperation, consent, or continued functioning of the system it stops.
Compensation earned for bearing a risk other participants prefer to avoid. The return is the payment for taking the other side of a structural preference, not for predicting anything.
The declared set of tools, resources and prompts an MCP server exposes to a client — the machine-readable statement of what an agent is able to reach.
A machine-readable document published by an agent that advertises what it is and what it can do — identity, declared capabilities, and the endpoints through which another agent may interact with it.
The machine-enforceable expression of an authority grant — the runtime boundary beyond which an agent halts or escalates rather than proceeds.
The structured record of a single consequential agent action, sufficient to reconstruct it: the authority under which it was taken, the agent and model state that took it, the evidence available at the time, the reasoning trace, the action committed, and the oversight conditions evaluated.
The transfer of responsibility for achieving an outcome from one agent to another, where the receiving agent determines how the outcome is reached.
DORA (Digital Operational Resilience Act)
The exercised ability of a human to ignore, alter, reject or reverse a system output or action.
The 2026 jurisdictional divergence on agentic AI
The sequenced, tamper-evident record of what occurred, sufficient to establish the order and content of events after the fact.
The property that a specific agent is distinguishable as a durable, named actor — with an identifier that persists across sessions, a recorded authority grant, and an action history attributable to it alone.
The explicit, bounded, revocable and recorded instrument by which a principal permits a named agent to commit specified classes of action, up to stated limits, for a stated term.