The Handoff Problem

RBI's draft model risk guidance, released for consultation in June 2026, asks a lender's inventory to record which models depend on which. It says little about what the second model should do when the first one is wrong.

Consider a lender with an agent at each of three steps. The first verifies identity at onboarding. The second makes the credit decision. The third disburses. This is an illustrative scenario, not a reported incident.

A synthetic identity, built from fabricated credentials, clears verification. The credit agent receives a verified applicant and approves a line. The disbursement agent receives an approved line and pays out. Each agent behaved correctly on the input it was given, and each would pass its own validation. The money is gone anyway.

Nothing was defective at any single point. The failure sits in the handoffs, in the assumption that each upstream verdict was true. Nobody chose that assumption deliberately, and it appears in no model card.

The draft asks that the inventory help identify model inter-dependencies and record dependencies with upstream and downstream models (paragraphs 21 and 22). For AI models, it asks lenders to weigh the extent of reliance and the level of autonomy placed on model outputs when assigning a tier (paragraph 52). Where full explainability is not achievable, it asks for mechanisms to verify and corroborate outputs before they are used (paragraph 54). And it makes the lender accountable for the outcomes of every model, however sourced (paragraph 8). RBI's FREE-AI committee report of August 2025 says the same from the other side: deploying entities remain accountable "regardless of their level of automation or autonomous functioning" (Sutra 5), and must "clearly define the tasks AI can perform autonomously and instances when human oversight is required" (paragraph 4.4.49).

That is a sound foundation. It describes what to record and where the concern lies. It does not design the boundary. An inventory entry can say the credit agent depends on the onboarding agent. It does not say what the credit agent does when that dependency fails, who owns the answer, or what evidence the exchange leaves.

The same gap exists whether the three agents come from three vendors or run on one platform. With three vendors, the lender must validate each third-party model independently, whatever certificates the vendor holds (paragraph 46), and no vendor sees the whole chain. On a single platform the failure can travel further, because agents often share credentials, memory and context, and a handoff may be a message inside one runtime with no interface where a control could sit. Even within a single agent, step three inherits whatever step one produced. What matters is unverified inheritance, not the number of vendors.

In most lenders today, a person sits between the steps. That person is the boundary control. They notice the odd application, ask a question, hold a file back. Nobody wrote this down as a control, and nothing logs it.

The draft expects human oversight of AI models, including override, suspension and kill-switch arrangements (paragraph 60), and warns about automation bias and decision fatigue (paragraph 61). In practice the person moves from between the steps to watching the chain. A person on the loop cannot catch a chain that completes in seconds, and a kill switch on one model does not recall decisions the chain has already taken. Oversight needs something at machine speed that calls the human in.

A boundary control that lives in a policy document is not a control. Enforcement means it runs in the execution path, is evaluated outside the agent, and denies by default. Seven mechanisms do the work.

A structured assertion at each handoff. The upstream agent passes a defined record, not free text: what it asserts, the evidence it used, the version of the agent and policy that produced it, and a timestamp. The downstream agent consumes only that record.

Policy evaluated outside the agent. A deterministic gate at the handoff checks the assertion against written rules. An instruction in a prompt is advice an agent can be talked out of. A gate in the execution path is not.

Corroboration from an independent route. Above a defined exposure, the downstream step verifies the inputs that matter against a separate source or a separate check, not by asking another model whether the first one looks right. The draft asks for mechanisms of this kind where explainability is limited (paragraph 54).

Routing by exposure. Below a threshold the chain proceeds. Above it, fresh corroboration is required. Above a higher one, a named person approves. This is reliance and autonomy made operational (paragraph 52).

Limits at the action layer. The disbursement agent holds scoped, short-lived credentials, and caps on exposure per customer, value per time window and new-customer velocity are enforced where money moves. The agent cannot exceed them by reasoning its way there.

A chain-level circuit breaker. When the failure rate at a boundary, or the approval rate downstream of it, moves outside a set band, the chain halts and the human queue is alerted. Suspending the chain, and quarantining everything derived from one upstream version, does what a per-model kill switch cannot.

Lineage as evidence. A correlation identifier runs through the chain, and each boundary writes an append-only record: the assertion, the checks run, the policy version, the outcome and the downstream action. An examiner can reconstruct any decision. The lender can also ask which downstream approvals relied on a given upstream verdict, and remediate them.

The thresholds belong to the lender's risk function. What matters is that they exist, that each one has an owner, and that they operate without anyone remembering to apply them.

Each boundary becomes an object in the inventory, with a named owner, its rules and thresholds, and a review date. Changing a threshold is a change to the model estate, and it should follow change management, including the draft's requirement to define what counts as a material change (paragraphs 38 to 42).

The draft places model owners in the first line and independent validation in the second (paragraph 15). Boundary controls belong to the first line, which builds and operates them. The second line validates them independently, including by attacking them: synthetic identities fed into the chain, stressed inputs, adversarial cases (paragraphs 54 and 55).

FREE-AI also keeps the lender liable for any loss suffered by customers, while recommending a lighter supervisory response to first-time, one-off failures where the lender has safeguards such as incident reporting, audits and red teaming. That leniency is denied for repeated breaches, gross negligence or failure to remediate (Recommendation 8). A boundary that is owned, tested and logged is evidence of exactly that kind of safeguard.

Your inventory will soon have to record that the credit agent depends on the onboarding agent. Does it also record what the credit agent does when that dependency is wrong, who owns that rule, and where the evidence sits? If not, the handoffs are unowned. Settle that before the person between the steps becomes a person watching the chain.

Sources

• Guidance on Regulatory Principles for Model Risk Management, 2026 (draft), RBI
• Report of the Committee on Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI), RBI, August 2025
• Amlan Mohanty, Governing AI Agents: Cascading Risks, Coordinated Action, Centre for Responsible AI, IIT Madras, March 2026 (source of the three-agent scenario, adapted)