SR 11-7 carve-out shifts GenAI governance to runtime controls

At a glance

What this is: Tetrate argues that the April 17 SR 11-7 rewrite takes GenAI and agentic AI out of traditional model risk management and shifts the burden to runtime governance, telemetry and operational evidence.

Why it matters: This matters because IAM, AI security and governance teams now need controls that prove who or what used a model, what it accessed, and how decisions were constrained, rather than relying on paper governance alone.

Context

The core governance gap is that traditional model risk management was built for stable quantitative models, not systems shaped by prompts, tool use, retrieval and frequent vendor updates. Once a system can change behaviour at request time, the control problem moves from model approval to continuous runtime oversight.

The article’s central point is that the federal carve-out does not reduce the compliance burden around GenAI. It removes one regulatory frame and leaves firms to prove control through inventory, attribution, guardrails and monitoring across the broader AI agent authorisation and governance stack.

Key questions

Q: What should security teams do first when GenAI is outside traditional model risk management scope?

A: Start by routing all model and agent traffic through a governed control point that can log, filter and block requests. That gives the programme an accurate inventory, usage attribution and enforceable guardrails before it tries to write policy exceptions around the new scope boundary. Without that telemetry, governance remains documentary rather than operational.

Q: Why do AI agents need runtime controls instead of only pre-approved access?

A: Pre-approved access cannot tell you what the agent will do once prompts, tools, memory, and sub-agents start interacting. Runtime controls matter because the risky event is the action itself, not the entitlement on paper. If the workflow can change mid-session, the control must be able to intervene mid-session too.

Q: How do organisations know whether AI governance is actually working?

A: AI governance is working when teams can prove that data access, identity permissions, and runtime controls line up with policy in practice. A useful test is whether the organisation can answer who accessed what, through which identity, and whether any out-of-policy movement was blocked or detected in time.

Q: Should banks treat agentic AI as the same risk category as older quantitative models?

A: No. Traditional model risk management fits stable analytical models, but agentic systems combine prompts, retrieval, tools and dynamic execution. That makes them a governance and access problem as much as a modelling problem. Banks need controls that manage runtime authority, data access and supervisory evidence, not only validation of the underlying model.

Technical breakdown

Why SR 11-7 no longer fits GenAI and agentic systems

SR 11-7 was written for models whose inputs, structure and outputs could be reviewed as a bounded analytical object. GenAI and agentic systems are different because their behaviour depends on prompts, retrieval layers, tool calls, policy filters and upstream model changes that can occur outside the original validation envelope. That makes one-time model review insufficient. The governance question is no longer whether the model was approved, but whether the operating path, data access and decision logic remain controlled every time the system runs.

Practical implication: Treat GenAI governance as a runtime control problem, not a one-time model approval exercise.

How inventory and usage attribution become the control plane

The article’s strongest operational point is that firms need an agent and model inventory that is accurate by construction, plus request-level attribution for who used which model and for what purpose. Manual inventories fail because they lag actual usage and cannot stand up to examiner questions. A durable inventory requires every call to pass through a known chokepoint that emits telemetry, so usage, business unit and application context are captured at the point of execution rather than reconstructed later.

Practical implication: Route all model traffic through a governed choke point so inventory and attribution are generated automatically.

Why runtime guardrails matter more than policy documents

Input filtering, topic restriction, response evaluation, jailbreak detection and per-model budget controls are meaningful only when they operate in the request path. If these controls live in policy documents or optional SDK integrations, they do not produce reliable evidence for compliance or incident response. The practical architecture is a supervised traffic layer that can block, log and constrain model behaviour before output is returned or tool execution is triggered.

Practical implication: Enforce guardrails in-line at the request path, not as optional developer-side controls.

NHI Mgmt Group analysis

SR 11-7 no longer provides a defensible governance wrapper for GenAI. The article is right to treat the rewrite as a scope reset rather than a mere wording update. That matters because many programmes had been using model risk management as the default container for generative and agentic AI. Once that peg is removed, control ownership has to move to the operational layers that actually shape behaviour, including access, telemetry and tool governance.

Continuous runtime governance is now the central control concept for GenAI programmes. The useful distinction is not between compliant and non-compliant models, but between systems that can prove what happened at runtime and systems that cannot. This is where AI governance intersects with identity governance: AI agent authorisation has to be bounded by task, context and approved action, not by static policy statements after the fact.

Inventory accuracy by construction is the named control problem this article exposes. A hand-maintained register cannot keep pace with developer-led model calls, delegated tools and vendor-side model churn. The governance failure is stale visibility, not simply weak documentation. Practitioners should treat a missing chokepoint as a governance defect, because if you cannot account for usage in near real time, you cannot defend the control environment.

The next regulatory battleground will be evidence quality, not principles language. The article shows that the firms most likely to shape the forthcoming RFI are those with per-request telemetry, usage attribution and runtime supervision already deployed. That signals a broader market shift toward controls that generate audit evidence as a by-product of execution. Practitioners should prioritise architectures that leave a verifiable trail for every model call.

From our research library:

• Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
• Read next: AI Agent Authorisation Guide

What this signals

Runtime governance will become the differentiator for AI supervision. Organisations that can prove control at the request layer will adapt faster when the next consultation arrives, because they can evidence usage attribution, guardrails and escalation paths without rebuilding their stack. The governance conversation is moving from policy articulation to operational proof.

Agentic AI turns access control into a living control surface. When a system can decide when to call a model, when to retrieve data and when to invoke a tool, static approval is no longer enough. Practitioners should expect their identity and access programmes to absorb AI-specific delegation, approval and telemetry requirements.

For practitioners

• Implement request-path model governance Force every GenAI and agentic AI request through a controlled gateway that can log, filter and block before the response or tool action occurs.
• Build an accurate-by-construction inventory Capture model, agent and tool usage automatically from the execution path so the register reflects reality instead of manual updates.
• Add request-level attribution Record business unit, application and agent context for each model call so examiners can trace usage back to accountable owners.
• Enforce inline guardrails and telemetry Apply PII filtering, topic restrictions, response checks and per-consumer budgets in the runtime layer so controls are measurable and enforceable.

Key takeaways

• GenAI governance now depends on runtime evidence, not on assuming model risk management can carry agentic systems by extension.
• The key operational gap is not the absence of policy, but the absence of automatic attribution, control points and inline supervision.
• Practical programmes will shift toward gateways, telemetry and task-scoped authority because those controls can be tested, audited and defended.

Related NHI Mgmt Group resources: AI Agent Authorisation Guide · Permission-Aware RAG Guide · Privileged Access Management Guide · CISO Guide: First 90 Days

Key terms

• Runtime Governance: Runtime governance is the set of controls that verify what a system or agent is actually doing after deployment. It combines monitoring, authorization checks, and access validation so teams can detect drift, misuse, or excessive privilege in motion rather than assuming build-time policy still holds.
• Request-path control: Request-path control means enforcing policy before an AI call completes, rather than only collecting logs after the event. It is the difference between observing behaviour and preventing unsafe data movement, tool use, or delegated action in real time.
• Usage Attribution: Usage attribution is the process of linking AI consumption to a known owner such as a team, tenant, product, or application. In governance terms, it turns anonymous traffic into accountable activity and gives both finance and security a shared basis for action.
• Inventory Accuracy By Construction: Inventory accuracy by construction means the asset register is generated automatically from the execution path rather than maintained by hand. For AI governance, this is the difference between a living control and a stale spreadsheet that cannot keep pace with developer usage or vendor updates.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management in terms that help security teams align identity controls with modern runtime systems. It is designed for practitioners who need to connect access governance to AI, cloud and enterprise control programmes.