Compliance Agent: Evidence Logistics, Control Testing, and the Mesh’s Control Plane

Enterprise Agent Mesh Engineering Guides · 12/12 · AI-Agent Factory

Build a Compliance Agent that makes assurance reproducible: enumerate populations deterministically, sample with a stored seed, seal evidence with provenance, reserve judgement for a bounded assessment step, and continuously test whether every other agent in the mesh is behaving inside its declared authority.

This guide adapts Article 12 of The Enterprise Agent Mesh — Building Twelve Production AI Agents on Claude Code. It preserves the handbook’s twelve-section structure and its double role for Compliance: a domain agent for GRC work and the mesh’s control plane.

Reference design, not a client case study. The handbook contains reference-deployment estimates, thresholds, failure observations and sample architecture. They are not independently verified Infinity Technologies client outcomes or universal benchmarks. Notes marked Web-edition qualification distinguish current-source checks and engineering hardening from the source design. Legal and regulatory classifications require qualified review for the actual organisation, jurisdiction and use case. Technical and legal references checked 16 September 2026.

A control test is mostly evidence logistics. The model earns its place only at the bounded judgement step; the population, sample, evidence collection and audit trail belong to deterministic systems.

The Header illustration represents the shared Enterprise Agent Mesh platform and its governance boundary. It is not a screenshot of a deployed Compliance product or an auditor dashboard.

1. What this agent is actually for

The handbook gives the Compliance Agent two jobs. The first is conventional second-line work: control testing, evidence collection, framework crosswalks, questionnaire support, issue tracking, third-party risk and regulatory-change triage. The second is architectural: every other agent writes into the shared evidence ledger, while Compliance reads across that ledger to detect authority breaches, undeclared tool use, approval drift and retention failures.

The sequencing matters. Build the ordinary GRC capability first. An agent that cannot reproducibly select a sample, assemble evidence and distinguish pass, fail and inconclusive has no standing to supervise eleven other agents.

The autonomy ladder is asymmetric by design

The source places assessment drafts at L1, issue creation and evidence attachment at L2 after approval, anomaly routing at L3 after an established clean operating period, and a narrow set of deterministic tasks at L4. The unusual part is L4: population enumeration, seeded sampling and evidence collection can be autonomous precisely because no model decision is involved.

This reverses a common mistake. “Autonomous” does not mean “the model has become trustworthy enough”. It means a deterministic, reproducible path has no judgement to delegate. The model’s most consequential output — whether a sample meets a criterion — remains bounded, cited and reviewable.

The Compliance Agent must never sign an assessment of record, close an issue or finding, assess a control it operates, attest to a regulator or external auditor in its own name, modify another agent’s prompts/configuration/permissions, or overwrite/delete collected evidence. Those are structural prohibitions, not promotion targets.

Web-edition qualification — regulation is use-case and role specific. The current consolidated EU AI Act remains a useful architecture input for logging, human oversight, transparency and post-market monitoring, but obligations depend on the system’s classification and the organisation’s role. Record the classification basis, assessor and review date in the inventory; do not hard-code a handbook timetable into runtime policy.

2. Architecture

The source reduces a control test to six steps. Five are deterministic. That division of labour is the architecture.

If the model chooses the sample, the test is already compromised. A language model asked for “representative” items optimises for salience, not statistical validity. More importantly, the auditor cannot reconstruct why those particular records were chosen. A reproducible seed can.

# Reference architecture excerpt — deterministic orchestration.
async def run_control_test(control_id, period, run_id):
    control = await grc.get_control(control_id)
    population = await population_query(control.population_query, period)
    seed = sha256(f"{control_id}|{period.iso}|{run_id}".encode()).hexdigest()
    sample = sample_population(control_id=control_id, period=period,
        method=control.sampling_method,
        size=required_sample_size(control.frequency, len(population)),
        seed=seed, population=population)
    bundles = [await collect_evidence(control_id, item.id, control.evidence_types)
               for item in sample]
    assessments = [await assess_sample(control_id, item.id, bundle.bundle_id)
                   for item, bundle in zip(sample, bundles)]
    return {"control_id": control_id, "period": period.iso, "run_id": run_id,
            "seed": seed, "population_query_sha256": control.population_query_sha256,
            "population_size": len(population), "sample_ids": [item.id for item in sample],
            "assessments": assessments, "conclusion": None}

The final conclusion is deliberately null. The model can produce sample-level evidence-backed judgements. A named tester concludes whether the control operated effectively for the period.

Topology: domain worker plus read-only supervisor

NATS: compliance.test_due | regulatory.feed_item | agent.<domain>.decision_written
  → compliance-orchestrator
      → control-tester → deterministic tools → sealed evidence
      → crosswalk-proposer → proposed control graph edges
      → mesh-conformance-monitor → READ-ONLY evidence ledger
      → questionnaire-responder / reg-change-triage
Inter-agent coordination is events, never nested agent authority.

The Compliance Agent is not a super-agent with universal access. It receives deliberately narrow views: evidence metadata, named ledger queries, control definitions and source artifacts only where a test requires them. It does not ask another agent to “explain itself” through a nested LLM call, because that would let the subject of supervision shape the supervisor’s evidence.

The mesh control plane is queryable governance

The source’s highest-signal checks are autonomy-tier breaches, tool calls outside declared scope, human-override spikes, reviewer concentration, unreviewed high-impact actions and retention violations. A zero-row result is still evidence: the daily all-clear demonstrates that the monitoring control ran. Missing monitoring output is itself a finding.

-- Reference SQL shape: declared-scope conformance.
SELECT l.agent_id, t.tool_name, count(*) AS calls
FROM evidence_ledger l
JOIN evidence_tool_call t ON t.decision_id = l.decision_id
LEFT JOIN agent_tool_scope s
  ON s.agent_id = l.agent_id AND s.tool_name = t.tool_name
WHERE l.occurred_at > now() - interval '7 days'
  AND s.tool_name IS NULL
GROUP BY l.agent_id, t.tool_name
ORDER BY calls DESC;

Override drift is useful because it can detect a changed world even when no prompt changed. Group findings by prompt_version, but do not leap from correlation to cause: “override rate rose on version 7.2.0” is a finding; “the prompt is worse” still needs investigation.

3. Repository layout and CLAUDE.md

compliance-agent/
  CLAUDE.md
  ai-inventory.yaml
  MODEL_CARD.md
  .mcp.json
  .claude/agents/{control-tester,crosswalk-proposer,mesh-conformance-monitor}.md
  .claude/agents/{questionnaire-responder,reg-change-triage}.md
  .claude/skills/control-test-run/{SKILL.md,reference.md,sampling.md}
  .claude/skills/questionnaire-answer/{SKILL.md,reference.md}
  .claude/hooks/{hooks.json,sod-gate.py,independence-gate.py}
  control-graph/nodes/{iso27001,soc2,internal,nist-csf}.yaml
  control-graph/edges/{curated,proposed}.yaml
  mcp/{evidence,ledger}/server.py
  runbooks/{incident-reporting,control-failure}.md
  evals/golden/{assessments,crosswalk,ledger_anomalies}.jsonl
  .github/workflows/compliance-ci.yml

CLAUDE.md carries invariants, not framework text

# Compliance Agent — operating invariants
## Independence
- Never assess a control this agent operates.
- If the operator or owner is an agent under test: inconclusive / segregation_of_duties.
- Never write to another agent's repository, prompt, permissions or MCP config.
## Evidence
- Evidence artifacts are append-only. There is no mutation or deletion tool.
- Point-in-time configuration evidence does not prove period operation.
- Every artifact cites bundle id, digest, collection time, collector and source reference.
## Conclusions
- pass | fail | inconclusive are distinct outcomes.
- Never close an issue or finding. Propose closure with evidence for human review.
## Time
- State the observation period explicitly.
- Read engagement-specific windows from the GRC record.
## Escalation
- Reporting-sensitive failures follow the versioned incident runbook and named owner.

Framework clauses, regulations and supervisory guidance do not belong in CLAUDE.md. They are versioned, effective-dated and often access-controlled. Put them in retrieval. Sampling mathematics belongs in the test skill.

ai-inventory.yaml is deployable governance data

The inventory should configure gateway scopes, CI assertions, retention jobs and conformance queries. Record system ID, owner, technical owner, purpose, organisational role, claimed classification, maximum autonomy, model card, scopes, prohibitions, logs and review dates. The source’s illustrative inventory uses stale Recruitment wording about ranked shortlists; this web edition deliberately aligns the inventory with Article 1’s evidence-only Recruitment design. The inventory must describe the deployed system, not copy a stale example.

systems:
  - id: recruitment-agent
    owner: group:talent-acquisition
    technical_owner: group:platform-eng
    purpose: "Evidence assembly for human recruitment review"
    role: {claim: deployer, assessed_by: grc-lead, assessed_on: 2026-09-01}
    classification: {claim: high-risk-candidate, basis_ref: LEGAL-ASSESSMENT-EXAMPLE}
    human_oversight: {max_autonomy: L2, oversight_control: CTRL-AI-004}
    model_card: agents/recruitment/MODEL_CARD.md
    logs: {store: evidence_ledger, retention_policy_ref: RET-AI-03}

For systems in scope, map legal duties to artifacts the engineering organisation already needs: classification records, human-review evidence, disclosure strings, logs, ingest provenance, monitoring/evaluation plans, incident runbooks and training attestations. The current consolidated EU AI Act is the source of law, not this mapping.

4. Subagents

control-tester: one sample, one criterion

---
name: control-tester
description: Assess one sampled item against one control criterion from a sealed evidence bundle.
tools: mcp__evidence__assess_sample, mcp__evidence__get_bundle, mcp__grc__get_control, mcp__corpus__search
disallowedTools: Write, Edit, Bash, mcp__grc__update_control, mcp__grc__close_issue
model: sonnet
maxTurns: 12
---
Assess one sampled item only. Do not select samples, collect evidence or conclude on the control as a whole.
Verify control criterion, artifact digests, source-system provenance and period coverage.
Return pass | fail | inconclusive with criterion and artifact citations.
A snapshot does not prove period operation. Missing population provenance is inconclusive.

inconclusive is not a model failure. It is a required business outcome. A tester must be able to say “the evidence does not support a defensible conclusion” without being forced into false assurance.

crosswalk-proposer: propose typed edges, never author them

---
name: crosswalk-proposer
description: Propose typed mappings among frameworks; proposals are never authoritative.
tools: Read, Grep, Glob, mcp__corpus__search, mcp__graph__read_edges
disallowedTools: Write, Edit, mcp__graph__write_edges
model: opus
maxTurns: 30
---
Compare objectives, evidence required, period/frequency and scope.
Edge types: satisfies | partially_satisfies | depends_on | supersedes.
partially_satisfies requires an explicit evidence_gap.
Never make proposed edges authoritative.

The expensive failure is a mapping that is 90% right. Similar language does not mean the evidence requirements or observation period are equivalent.

mesh-conformance-monitor: read-only by construction

---
name: mesh-conformance-monitor
description: Report mesh anomalies from fixed evidence-ledger queries.
tools: mcp__ledger__run_named_query, mcp__ledger__describe_schema, Read
disallowedTools: Write, Edit, Bash, mcp__grc__update_control
model: sonnet
background: true
---
Named queries: tier_breach, out_of_scope_tools, override_drift,
retention_violation, reviewer_concentration, unreviewed_high_impact.
Return agent, query, row count, example decision ids, prompt version and observed facts.
Do not invent cause. Report zero rows as an operated-control result.

Arbitrary SQL over the global ledger is deliberately unavailable. The monitor chooses among reviewed parameterised queries, limiting both accidental disclosure and prompt-induced query construction.

questionnaire-responder drafts only from curated graph edges and current evidence; uncited answers become gaps. reg-change-triage classifies high-volume feed items into ignore / monitor / impacts-control and hands material items to a reviewed path.

5. Skills

control-test-run

---
name: control-test-run
description: Run a control test from authoritative population through evidence-backed sample assessments.
allowed-tools: mcp__evidence__sample_population, mcp__evidence__collect_evidence, mcp__evidence__assess_sample, mcp__grc__get_control, Read
---
1. Read the control, operator, owner, frequency, criterion and evidence types.
2. Check segregation of duties; independence failure => inconclusive.
3. Enumerate population from the stored population query and record its digest.
4. Derive the run seed; sample with reviewed method/size. The model never chooses items.
5. Collect evidence; missing artifacts remain first-class gaps.
6. Assess each sample via control-tester.
7. Persist provenance and leave overall conclusion null.
8. A named human signs or rejects the run.

sampling.md carries method selection, sample-size policy and stratification rules. reference.md carries evidence types, period-coverage rules, inconclusive reason codes and source-system examples. This keeps the skill readable and leaves context for actual evidence.

questionnaire-answer

The second skill decomposes a security questionnaire into atomic requirements, maps each through curated graph edges, retrieves current evidence state and produces a cited draft. Customer-specific phrasing may live in its reference file; factual evidence state cannot. Any statement leaving the organisation requires a named human to approve the exact artifact version.

6. Integrations and the MCP layer

{
  "mcpServers": {
    "grc": {"type":"http","url":"${GATEWAY_URL}/grc/mcp","headersHelper":"/opt/agent-platform/bin/get-mcp-auth-headers.sh"},
    "ledger": {"type":"stdio","command":"uv","args":["run","--directory","/opt/compliance/mcp/ledger","server.py"],"env":{"LEDGER_DSN":"${LEDGER_RO_DSN}"}},
    "evidence": {"type":"stdio","command":"uv","args":["run","--directory","/opt/compliance/mcp/evidence","server.py"],"env":{"WORM_BUCKET":"${WORM_BUCKET}","WORM_MODE":"COMPLIANCE"}}
  }
}

These are organisation-owned reference interfaces. The agent has no MCP server for another agent’s repository and no generic write interface to control definitions.

Seal evidence, but describe Object Lock precisely

The source uses S3 Object Lock in Compliance mode. AWS documents that Compliance mode protects a specific retained object version from overwrite or deletion, including by the root user, and prevents shortening its retention. It does not prevent a new version or delete marker at the same key. Evidence citations therefore bind version ID + content digest + retention metadata, not only bucket/key.

{"bundle_id":"BUNDLE-EXAMPLE","artifact":{"bucket":"evidence-worm","key":"controls/CTRL-17/run/sample-009.json","version_id":"immutable-version-id","content_sha256":"sha256-of-exact-bytes","source_system":"idp","source_reference":"event-set-009","collected_at":"2026-09-16T00:00:00Z","collector_identity":"svc-compliance-agent","retain_until":"policy-derived-date"}}

Assessment schema: inconclusive is load-bearing

{
  "conclusion":"pass | fail | inconclusive",
  "inconclusive_reason":"period_coverage | missing_artifact | self_reported | ambiguous_criterion | population_provenance | segregation_of_duties | source_mismatch | null",
  "criterion_citations":[{"framework":"internal","clause_path":"CTRL-17/criterion","quote":"exact criterion text"}],
  "evidence_citations":[{"bundle_id":"BUNDLE-EXAMPLE","artifact_sha256":"digest","supports":"what this artifact proves"}],
  "rationale":"bounded explanation"
}

Schema-constrained output is only the first layer. The backend must verify cited bundle IDs and hashes rather than trusting syntactically valid model output.

Web-edition qualification — permissions are defence in depth, not the perimeter. Claude permission policies and hooks can reduce accidental or model-induced tool use, but backend identity and scopes remain authoritative. Do not put “never close a finding” only in a prompt-time callback that may not execute for every auto-approved call.

7. Retrieval design

The Compliance corpus contains framework text, internal policies and standards, regulations and supervisory guidance, prior audit reports and management responses, and obligations extracted from contracts. It does not contain the evidence artifacts themselves. Evidence stays in sealed storage; the corpus holds metadata and fetches an exact artifact through an authorised, logged tool only when a test needs it.

Regulatory text is a graph, not a flat document

Chunk by legal structure — regulation → chapter → article → paragraph → point — and preserve the full citation path. Resolve cites, amends, repeals and derogates_from edges at ingest. Effective dating is mandatory: a 2025 control period must be assessed against the provision in force for that period, not merely today’s website text.

regulation_chunk:
  doc_id: dora-consolidated
  citation_path: "Chapter II > Article 5 > paragraph 2 > point (e)"
  effective_from: 2025-01-17
  effective_to: null
  content_sha256: ...
  related_nodes:
    - {edge: scoped_by, citation_path: "Chapter II > Article 5 > paragraph 1"}

The hard problem is crosswalk semantics

Embedding similarity between framework controls produces plausible but unsafe equivalence. Typed curated edges make the missing evidence explicit.

CREATE TABLE control_edge (
  edge_id BIGSERIAL PRIMARY KEY,
  src_control TEXT NOT NULL,
  dst_control TEXT NOT NULL,
  edge_type TEXT NOT NULL CHECK (edge_type IN ('satisfies','partially_satisfies','depends_on','supersedes')),
  coverage_note TEXT NOT NULL,
  evidence_gap TEXT[],
  confidence NUMERIC(3,2) NOT NULL,
  proposed_by TEXT,
  curated_by TEXT,
  curated_at TIMESTAMPTZ,
  effective_from DATE NOT NULL,
  effective_to DATE,
  CHECK (edge_type <> 'partially_satisfies' OR array_length(evidence_gap,1) >= 1)
);

Only curated edges may influence questionnaire answers or test planning. Confidence is triage metadata, not authority. Rejections and downgrades become evaluation data.

Web-edition qualification — framework versions move. The NIST AI RMF page states that AI RMF 1.0 is being revised, and its Playbook is expected to be updated after the revision. Pin mappings to the exact framework version assessed.

8. Guardrails

The control plane’s credibility depends on independence: no control-definition write tool, no finding-closure tool, no repository write path to supervised agents, and a read-only ledger role.

# Reference PreToolUse policy excerpt.
def compliance_gate(tool_name, args, context):
    control_id = args.get("control_id")
    if tool_name.endswith(("assess_sample", "collect_evidence")):
        if control_is_owned_or_operated_by_agent_under_test(control_id):
            return deny("segregation_of_duties: independent review required")
    if tool_name.endswith(("close_issue", "close_finding")):
        return deny("issue closure requires a named human owner")
    if tool_name.endswith("sample_population"):
        expected = derived_seed(control_id, args.get("period"), args.get("run_id"))
        if args.get("seed") != expected:
            return deny("sample seed is not reproducible for this run")
    if is_write_to_supervised_agent_repo(tool_name, args):
        return deny("control plane cannot modify supervised agents")
    return allow()

Resolve control ownership and the “agents under test” set server-side from signed inventory/GRC state. A policy hook that trusts prompt-controlled ownership fields is not independent.

Human signatures at reliance boundaries

The source requires human signature for the overall test conclusion, issue/finding closure and external statements. Bind approval to the exact run/artifact digest and current entitlement. Recheck immediately before execution. Bulk approval UX can destroy substantive review even when a human click technically exists, so monitor reviewer concentration and approval velocity.

PII and privilege stay outside the general corpus

Access-review artifacts can contain names, employment status and sensitive termination context. Keep them behind source-specific ACLs. Privileged material and external-auditor workpapers need separate access and retention. “Compliance needs everything” is not an access-control model.

9. Production deployment

Control tests are event-driven. A scheduler reads control frequency and periods from the GRC system; the worker derives a stable run ID, claims the run atomically, performs deterministic steps, invokes model judgement only for assessments, seals the result and emits “ready for human conclusion”.

# Reference deployment shape — plumbing omitted.
async def handle_test_due(event):
    run_id = sha256(f"{event['control_id']}|{event['period']}|{event['cycle']}".encode()).hexdigest()[:32]
    claim = await run_store.claim(run_id)
    if claim.status == "completed": return claim.result
    if claim.status == "running" and not claim.lease_expired: return
    control = await grc.get_control(event["control_id"])
    population = await run_stored_population_query(control, event["period"])
    seed = sha256(f"{event['control_id']}|{event['period']}|{run_id}".encode()).hexdigest()
    sample = sample_population(population, control.sampling_method, required_sample_size(control,len(population)), seed)
    bundles = await collect_all(sample, control)
    assessments = await assess_all(sample, bundles, control)
    await run_store.complete_with_outbox(run_id, {"seed":seed,"sample_ids":[x.id for x in sample],"assessments":assessments,"conclusion":None}, "agent.compliance.run_ready")

The handbook’s read-before-write idempotency examples express intent but are not atomic under concurrency. Use a unique logical run key, claim/lease, terminal states and an outbox committed with completion. A source outage becomes a recorded evidence gap and an inconclusive path, not an uncontrolled model retry.

For regulated financial entities, DORA’s ICT third-party register is structured GRC data. The EBA lists the register-of-information ITS as adopted and published in the Official Journal. Map the current authoritative format and ownership into the GRC system rather than memorising an illustrative register in a prompt.

10. Evaluation

Report a full three-class confusion matrix for pass, fail and inconclusive. A single accuracy number hides the most expensive cell: false assurance.

These are source reference values, not measured Infinity results. False-pass cost is asymmetric, but an agent can game that target by returning inconclusive on everything; that is why inconclusive calibration needs its own metric.

Evaluate the control plane itself

Seed synthetic anomalies into a ledger replica: an autonomy breach, undeclared tool call, override spike isolated to one prompt version, reviewer concentration and expired evidence. Run the daily monitor and measure detection and time-to-detection. This tests whether governance works, not only whether a task agent works.

- anomaly_id: tier-breach-001
  type: autonomy_breach
  expected_query: tier_breach
  expected_detection_within: PT24H
- anomaly_id: scope-001
  type: undeclared_tool
  expected_query: out_of_scope_tools
- anomaly_id: drift-001
  type: override_spike
  multiplier: 4
  expected_query: override_drift
- anomaly_id: retention-001
  type: expired_evidence_reference
  expected_query: retention_violation

Evaluation data requires governance too. External-auditor workpapers may not be reusable, and internal workpapers can be restricted. Build an authorised labelled set rather than copying audit material into a model test directory.

11. Failure modes described in the handbook

The plausible-but-wrong crosswalk

Similar control text hides different evidence requirements. Mitigation: typed edges, coverage notes, mandatory evidence gaps for partial satisfaction, human curation and rejection/downgrade data in evals.

Evidence that exists but proves the wrong thing

A current screenshot proves configuration at an instant; it does not prove six months of operation. Period coverage is evidence semantics, not decoration.

Sampling from a pre-filtered population

A random sample can be perfect over the wrong universe. Enumerate population from a stored reviewed query and record its digest. Population whose provenance cannot be reproduced is inconclusive.

Regulatory text without the amendment

Effective dating and amendment edges must be part of retrieval. The right article number from the wrong version is still wrong evidence.

The agent closes the loop on its own finding

Issue creation, remediation evidence, reassessment and closure can become self-certification with a tired bulk approver. Keep closure outside agent authority and monitor approval concentration.

Compliance theatre at machine speed

The deepest failure is beautifully sealed evidence for controls that do not work. Put assurance next to operational outcomes: incidents, near misses, waivers, repeat findings, remediation time and “tested effective but later involved in an incident”. A perfect pass rate with worsening outcomes calls for better testing, not more documentation.

12. Build order

Week 1: ledger and immutable artifact store

Build the evidence ledger and sealed store before the Compliance Agent. Instrument the first production agents from day one. Observability added after an incident cannot reconstruct evidence that was never captured.

Month 1: one control, end to end

Implement authoritative population enumeration, reproducible sampling and evidence collection for one high-volume machine-readable control. Run at L1: humans assess every sample and sign every conclusion. Create ai-inventory.yaml for the agents actually live.

Quarter 1: widen carefully and turn on mesh monitoring

Expand to a controlled set of controls, seed one framework-pair graph by hand, run mesh conformance daily and add the seeded-anomaly meta-eval. The handbook’s fifteen-to-twenty-control example is a reference sequence, not a delivery promise.

The source closes with a programme-level recommendation: start the mesh with two agents, not twelve. Two bounded agents plus a ledger exercise identity, tools, evidence and governance. Twelve simultaneous prototypes create shared risk before the platform exists.

Sources and implementation notes

Primary source: Article 12, “The Compliance Agent: Evidence Logistics, Control Testing, and the Mesh’s Control Plane”, plus the handbook’s shared identity, evidence-ledger, evaluation and message-bus conventions. This web edition preserves seeded sampling, immutable-evidence provenance, explicit inconclusive outcomes, curated crosswalks, read-only mesh supervision, asymmetric evaluation and build order.

Web-edition qualifications: WORM claims are narrowed to retained object versions and cite version IDs; inventory text is aligned with the evidence-only Recruitment design; regulatory timelines are not hard-coded; framework versions are effective-dated; idempotency uses an atomic run claim; backend identity remains the authorisation perimeter; and source thresholds/costs are reference values rather than client results.

• EUR-Lex — Regulation (EU) 2024/1689, Artificial Intelligence Act.
• European Banking Authority — DORA register-of-information ITS.
• AWS — S3 Object Lock.
• NIST — AI Risk Management Framework and AI RMF Playbook.
• Claude Code — hooks, Agent SDK — permissions and MCP configuration.

Explore the enterprise series

This is guide 12/12 for the business-function agents in Infinity Technologies’ AI-Agent Factory hexagonal mesh. It is separate from the InfinitySDLC engineering-agent series.

Previous: 11 Legal Agent — The Playbook Is the Program.

The twelve-agent business series is now complete. The separate final pass will verify CMS/public integrity, Header/card alt text, TOC/anchors, neighbour links and all twelve Home Copy hexagon mappings without publishing Home Copy itself.