SMCR already makes you accountable for how agents operate in your domain. Treat that accountability as your mandate to lead — and build the evidence before you need the defence.

You are already personally accountable for how agents are governed in your domain. The FCA's Mills Review and the Treasury Committee confirm it: you cannot wait for a new rulebook, because the existing Conduct Rules apply to agents today. That accountability is not a burden to delegate to your technology teams — it is your mandate to lead them. In the SMCR frame, the regulator has named you, not your engineers. The operations leaders who act on that will own how agents enter their processes: triggers that force evaluation rather than wait for suspicion, judgment concentrated on exceptions rather than diluted across the routine, and a continuous evidence pack that answers the regulator before they ask — even when the model you tested changes beneath you without notice. The firms whose boards say yes to the next deployment will be the ones whose operations leaders can prove control of the last one. Speed follows defensibility.

The EU delayed its AI Act deadlines but kept core obligations live. The US has no federal AI law but is governing through existing authorities — including an export control directive that disabled Anthropic's Fable 5 and Mythos 5 for all customers globally. China continues layering binding standards with active enforcement. All three trajectories converge on the same outcome: insurance is retreating from AI liability, and model access is now subject to sovereign risk. Under DORA, EU firms should assess inference providers as part of their ICT third-party dependency landscape, test model-switching continuity, and treat provider lock-in as a potential compliance risk.

A comparative analysis of the three dominant AI regulatory models as they stood in June 2026 — the EU's comprehensive law, the US's fragmented patchwork governed through existing authorities, and China's layered standards stack. All three trajectories converge on the same structural gap: compliance obligations are expanding while insurance coverage contracts, and model access has become subject to sovereign risk. Anchored by the 12 June 2026 US export-control directive that disabled Anthropic's Fable 5 and Mythos 5 for all customers globally, the brief argues that organisations — particularly firms subject to DORA — must treat inference as a switchable commodity, map AI providers as ICT third-party dependencies, and build multi-engine resilience against nationality-based access revocation.

Important work ages in the background while urgent noise fills every hour. To stop this, organisations must move beyond static frameworks—the 'pillars'—and adopt a kinetic operating system that governs how work is filtered, orchestrated, and dispatched across a hybrid workforce of humans and autonomous agents.

Agents can hold wallets, execute payments, and submit documents - they just can't prove who they are. W3C DIDs and Verifiable Credentials fill the gap. The window to build this layer openly, before platform-specific alternatives calcify, is now.

Published agentic AI stack architectures — five-layer, seven-layer, and nine-layer frameworks in common circulation, alongside Microsoft's own agentic AI roadmap reviewed as of April 2026 — cover compute, models, orchestration, tooling, and observability. None include trust as a named layer. Agents can hold wallets, execute payments, and submit documents - they just can't prove who they are. This paper examines why the identity layer is missing from agent runtimes, how existing standards (W3C DIDs, Verifiable Credentials) can fill the gap, and why the window to build it openly is now.

Risk management is a mature discipline. Trust has been implicit - embedded in qualifications, regulation, and human accountability. Agents break every one of those assumptions. Trust management makes the implicit explicit: what signals does this interaction require, what signals are present, and is the gap acceptable for the risk level of the action?

Every governance framework in use today embeds trust assumptions calibrated on decades of human behaviour. Agents break those assumptions. This paper argues that trust management - the explicit identification, assessment, and governance of trust signals - needs to become a discipline in its own right, with registers, scoring, thresholds, and continuous monitoring, paralleling how organisations already manage risk.

An MCP server for agents to read, search, and surgically edit markdown docs — with RBAC and git-native approval.

Agents that manage documentation need more than file access — they need structure, governance, and the ability to edit precisely without reading everything. en-quire gives them that: section-level editing, searchable document structure, and git-native approval workflows, all without imposing a schema on your markdown.

AI can do the work. Knowing what to work on, when it's done, and whether it matters — that's the hard part. 14 weeks of measurement, three frameworks, preliminary results.

In a 14-week single-studio pilot, decision latency fell by roughly 68% and no projects went unreviewed. Three integrated frameworks for managing AI-augmented creative work.

Three tiers (Campaigns → Content Briefs → Production Outputs) bridge strategy to execution. One anchor piece generates multiple platform adaptations. Resource visibility before commitment, not after overload.

A three-tier system for planning and executing marketing campaigns. Maintains narrative coherence across platforms while enabling parallel production and resource visibility. Developed internally, tested over two months.

Every task should trace back to a strategic outcome. Without this golden thread, you're busy but not building. The missing layer is outcome-driven initiative governance.

Tasks without strategic lineage often fail silently. When daily work can't trace back to outcomes, studios tend to optimize for motion instead of progress—shipping content that compounds nothing.

Four layers—Value Streams, Strategic Outcomes, Initiatives, Tasks—with explicit linkage create the 'golden thread' that traces any daily task back to strategic purpose.

A four-layer hierarchy connecting daily tasks to strategic purpose. Value Streams organize the portfolio, Strategic Outcomes define success, Initiatives bound the programs, and Tasks do the work—with explicit linkage at every level.

Allocate creative attention using simple indices that balance exploitation of proven ideas with exploration of new concepts. Score tasks 0-22 based on Revenue, Portfolio Value, Engagement, and Exploration—then pick the highest score 90% of the time.

A practical heuristic for allocating creative attention across competing projects, inspired by multi-armed bandit theory. This is not a formal reinforcement learning implementation—it's a pragmatic decision framework that balances exploitation of proven ideas with exploration of new concepts.

Individual posts succeed while campaigns fail because nothing connects daily content to quarterly goals. The missing layer is campaign-level governance.

Marketing campaigns fragment when strategy lives in one system and execution in another. The gap between 'why we post' and 'what we post' creates drift, wasted effort, and content that compounds nothing.

Explicit decision boundaries, three-gate closures, and restart protocols enable AI delegation without losing quality or control.

Operational protocols for delegating creative and operational work to AI agents. Decision boundaries, quality gates, restart protocols, and the three-gate closure system—developed through 8 weeks of internal pilot use at NullProof Studio.

Creative work operates on three distinct rhythms (daily, weekly, monthly)—forcing everything onto one calendar creates decision latency and kills both deep work and incubation.

Creative studios often struggle when all work runs on one rhythm. Multi-clock work separates daily shipping, weekly strategy, and monthly dormant review so ideas can mature without chaos.

A three-band operating system (HF/LF/Dormant) for creative studios that protects deep work, reduces task starvation risk, and uses Bandit Scores to balance exploitation with exploration. Developed and tested at NullProof Studio.