{
  "format": "palo-eu-agentic-proposal",
  "version": "0.2.0",
  "reviewedAt": "2026-09-22",
  "status": "independent-discussion-proposal",
  "attachment": {
    "filename": "OJ_L_202601744_EN_TXT.pdf",
    "pages": 41,
    "sha256": "0bea4d808256b08275777949ba9cb3c70b7d02e4ebb3ac9b205671b1f552d386"
  },
  "controls": [
    {
      "id": "DAG-01",
      "title": "Accountable system boundary",
      "objective": "Name the owner, actors, tools and external resources.",
      "legalAnchor": "Articles 3, 6, 9, 25 and 26",
      "gap": "A documented system can still lack a clear owner for a delegated action.",
      "test": "Remove the accountable owner.",
      "expected": "Evaluation admission stops until ownership and boundary are resolved.",
      "paloEvidence": "schemas/palo-ai-system-record.schema.json",
      "maturity": "Published schema; deployment accountability requires review."
    },
    {
      "id": "DAG-02",
      "title": "Identity and current mandate",
      "objective": "Bind scope, expiry and purpose to a verified workload.",
      "legalAnchor": "Articles 9, 12, 14 and 15",
      "gap": "No common mandate representation is prescribed for every agentic workflow.",
      "test": "Attempt a start with expired or wrong-tenant authority.",
      "expected": "The controlled execution boundary rejects the action.",
      "paloEvidence": "schemas/palo-agentic-interface.schema.json",
      "maturity": "Reference identity and mandate controls; production identity remains deployment-specific."
    },
    {
      "id": "DAG-03",
      "title": "Bounded subdelegation",
      "objective": "Keep every child within the authority of its ancestors.",
      "legalAnchor": "Articles 9, 15 and 25",
      "gap": "Compound responsibility and permission expansion need explicit tests.",
      "test": "Grant a child a tool or purpose outside the parent scope.",
      "expected": "Admission or execution is denied; the reason is recorded.",
      "paloEvidence": "docs/palo-swarm-distributed-execution.md",
      "maturity": "Unreleased prototype; constrained schema inheritance."
    },
    {
      "id": "DAG-04",
      "title": "Purpose and data conditions",
      "objective": "Bind data fitness, recipients, egress and freshness.",
      "legalAnchor": "Articles 9, 10 and 15; other data-protection law separately",
      "gap": "Permission to act is not a lawful basis for processing or disclosing data.",
      "test": "Change the recipient or use stale fitness evidence.",
      "expected": "The action is held or denied pending fresh authorised evidence.",
      "paloEvidence": "schemas/palo-data-disclosure-contract.schema.json",
      "maturity": "Developer preview; connector observations are not independently attested."
    },
    {
      "id": "DAG-05",
      "title": "Action-bound enforcement",
      "objective": "Check exact arguments and current policy before the effect.",
      "legalAnchor": "Articles 9, 14 and 15",
      "gap": "A policy decision detached from the actual tool call can be bypassed.",
      "test": "Mutate arguments after authorisation or attempt direct resource access.",
      "expected": "Mutation and bypass are blocked in the declared resource boundary.",
      "paloEvidence": "schemas/palo-agentic-action-claim.schema.json",
      "maturity": "Contract implemented; non-bypassability must be proven for each connector."
    },
    {
      "id": "DAG-06",
      "title": "Meaningful human approval",
      "objective": "Require exact-action prior human approval for consequential actions with absent or unproven reversibility.",
      "legalAnchor": "Articles 13, 14 and 26",
      "gap": "A generic approval cannot justify an irreversible effect or override another denial condition.",
      "test": "Attempt a consequential irreversible action without approval, then change an approved target.",
      "expected": "Dispatch is blocked without valid exact-action approval; other denial conditions remain binding.",
      "paloEvidence": "schemas/palo-agentic-approval.schema.json",
      "maturity": "Strengthened proposed profile rule; reference approval contracts exist, but deployment enforcement and human competence require tests."
    },
    {
      "id": "DAG-07",
      "title": "Shared exposure",
      "objective": "Reserve cumulative limits across concurrent agents.",
      "legalAnchor": "Articles 9 and 15",
      "gap": "Individually permitted actions may exceed a shared organisational limit.",
      "test": "Start concurrent actions whose aggregate exceeds the mandate budget.",
      "expected": "No overspend in the tested authority domain; uncertain charges remain reserved or committed.",
      "paloEvidence": "docs/palo-swarm-distributed-execution.md",
      "maturity": "Unreleased central SQLite prototype; no replicated authority or HA guarantee."
    },
    {
      "id": "DAG-08",
      "title": "Replay and uncertain execution",
      "objective": "Consume authority once and reconcile uncertain effects.",
      "legalAnchor": "Articles 12 and 15",
      "gap": "A timeout cannot safely be treated as no effect.",
      "test": "Replay a consumed capability after a dispatch timeout.",
      "expected": "No blind second execution; uncertainty is held for reconciliation.",
      "paloEvidence": "schemas/palo-agentic-execution-capability.schema.json",
      "maturity": "Reference single-use capability; external idempotency is connector-specific."
    },
    {
      "id": "DAG-09",
      "title": "Revocation and intervention",
      "objective": "Separate future denial from verified in-flight containment.",
      "legalAnchor": "Articles 14, 26, 72 and 73",
      "gap": "A stop signal does not prove that an external transaction stopped.",
      "test": "Revoke a queued member and request stop during a partition.",
      "expected": "No fresh controlled start; in-flight state stays unknown until authoritative observation.",
      "paloEvidence": "docs/palo-swarm-distributed-execution.md",
      "maturity": "Unreleased supported-connector cancellation; arbitrary irreversible effects cannot be stopped."
    },
    {
      "id": "DAG-10",
      "title": "Verified effects",
      "objective": "Observe actual outcomes separately from execution receipts.",
      "legalAnchor": "Articles 9, 12, 15 and 72",
      "gap": "An agent success message is not an authoritative outcome observation.",
      "test": "Withhold the resource observation after a successful tool response.",
      "expected": "Outcome remains inconclusive; it is never labelled verified.",
      "paloEvidence": "schemas/palo-agentic-outcome-attestation.schema.json",
      "maturity": "Prototype verifier path; observation trust and completeness are external assumptions."
    },
    {
      "id": "DAG-11",
      "title": "Minimised, reviewable evidence",
      "objective": "Protect provenance, integrity, access and retention.",
      "legalAnchor": "Articles 11, 12, 19 and 26; data-protection law separately",
      "gap": "Integrity checks do not establish truth, lawful retention or complete coverage.",
      "test": "Alter a bound evidence record and inspect excess personal-data payload.",
      "expected": "Tamper is detected; unnecessary data and retention are flagged for review.",
      "paloEvidence": "schemas/palo-agentic-evidence-envelope.schema.json",
      "maturity": "Prototype signatures; managed keys, anchoring and tenant isolation remain open."
    },
    {
      "id": "DAG-12",
      "title": "Change, incidents and remedy",
      "objective": "Reassess new tools, changed mandates and unresolved outcomes.",
      "legalAnchor": "Articles 9, 17, 25, 27 where applicable, 72 and 73",
      "gap": "Static assessments can become stale as tools and delegation change.",
      "test": "Add a consequential tool or leave a mismatch unresolved.",
      "expected": "Affected work enters review; incidents are triaged to the appropriate owner.",
      "paloEvidence": "schemas/palo-agentic-assurance-incident.schema.json",
      "maturity": "Prototype incident lifecycle; legal reporting and remedies need organisational processes."
    }
  ],
  "sources": [
    {
      "id": "LAW-01",
      "title": "AI Act: Regulation (EU) 2024/1689",
      "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng",
      "status": "Original adopted law; read with amendments",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "LAW-02",
      "title": "Digital Omnibus on AI: Regulation (EU) 2026/1744",
      "url": "https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng",
      "status": "Enacted amendment; Official Journal PDF reviewed",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "EU-01",
      "title": "European AI Office: structure and general contact",
      "url": "https://digital-strategy.ec.europa.eu/en/policies/ai-office",
      "status": "Official organisational information",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "EU-02",
      "title": "Lucilla Sioli: official biography",
      "url": "https://digital-strategy.ec.europa.eu/en/miscellaneous/lucilla-sioli",
      "status": "Official role verification",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "EU-03",
      "title": "Agentic AI: European talent and regulatory assets",
      "url": "https://digital-strategy.ec.europa.eu/en/library/agentic-ai-leveraging-european-ai-talent-and-regulatory-assets-scale-adoption",
      "status": "Commission-hosted StepUp StartUps research; not binding guidance",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "EU-04",
      "title": "AI Act standardisation",
      "url": "https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation",
      "status": "Official process explanation",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "EU-05",
      "title": "GPAI Code of Practice",
      "url": "https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai",
      "status": "Voluntary implementation precedent",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "EU-06",
      "title": "Transparency Code: 31 July 2026 uptake announcement",
      "url": "https://digital-strategy.ec.europa.eu/en/news/strong-backing-code-practice-transparency-ai-generated-content",
      "status": "Historical participation figure; section lists overlap; no proof of effectiveness",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "EU-07",
      "title": "Withdrawal of Commission proposals, C/2025/5423",
      "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025XC05423",
      "status": "AI Liability Directive withdrawal record",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "EU-08",
      "title": "Planning and proposing law",
      "url": "https://commission.europa.eu/law/law-making-process/planning-and-proposing-law_en",
      "status": "Commission procedure",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "EU-09",
      "title": "Ordinary legislative procedure",
      "url": "https://www.consilium.europa.eu/en/council-eu/decision-making/ordinary-legislative-procedure/",
      "status": "Council procedure explanation",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "EU-10",
      "title": "Better Regulation",
      "url": "https://commission.europa.eu/law/law-making-process/better-regulation_en",
      "status": "Consultation and evidence process",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "EU-11",
      "title": "Transparency Register",
      "url": "https://commission.europa.eu/about/service-standards-and-principles/transparency/transparency-register_en",
      "status": "Conditions for covered policy meetings",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "INT-01",
      "title": "NIST AI Agent Standards Initiative",
      "url": "https://www.nist.gov/artificial-intelligence/ai-agent-standards-initiative",
      "status": "International technical work; no EU legal equivalence",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "INT-02",
      "title": "IMDA agentic governance framework v1.5: May 2026 update",
      "url": "https://www.imda.gov.sg/AI",
      "status": "International governance reference; no EU legal equivalence",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "INT-03",
      "title": "IMDA update announcement: 20 May 2026",
      "url": "https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/factsheets/2026/updated-model-ai-governance-framework-for-agentic-ai",
      "status": "Official update and deployment examples",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "STD-01",
      "title": "JTC 21 working groups and projects",
      "url": "https://jtc21.eu/working-groups/",
      "status": "Secretariat project listings; routing, not clause-level equivalence",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "STD-02",
      "title": "ISO/IEC 24970: AI system logging",
      "url": "https://committee.iso.org/cms/live/live/en/sites/isoorg/contents/data/standard/08/87/88723.html?browse=ics",
      "status": "FDIS under development; not evidence of EU harmonisation",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "DP-01",
      "title": "EDPS: synthetic data",
      "url": "https://www.edps.europa.eu/press-publications/publications/techsonar/synthetic-data",
      "status": "Privacy assessment remains necessary",
      "reviewedAt": "2026-09-22"
    },
    {
      "id": "EU-12",
      "title": "Transparency Register scope guidance",
      "url": "https://transparency-register.europa.eu/guidance_en",
      "status": "Personal-capacity distinction depends on the actual activity",
      "reviewedAt": "2026-09-22"
    }
  ],
  "approvalTests": [
    {
      "id": "DAG-06-A",
      "control": "DAG-06",
      "title": "Missing approval",
      "test": "Attempt a materially consequential irreversible action without human approval.",
      "expected": "No dispatch or external effect; record the denial and missing approval."
    },
    {
      "id": "DAG-06-B",
      "control": "DAG-06",
      "title": "Unknown reversibility",
      "test": "Label a consequential action as reversible without accepted reversibility evidence.",
      "expected": "Unknown reversibility retains the prior-approval requirement; the agent cannot downgrade the class."
    },
    {
      "id": "DAG-06-C",
      "control": "DAG-06",
      "title": "Invalid approval",
      "test": "Change the target or material payload, expire the approval, or use an unauthorised reviewer.",
      "expected": "Each variant is blocked before dispatch; bind fresh valid approval to the exact action."
    },
    {
      "id": "DAG-06-D",
      "control": "DAG-06",
      "title": "Independent denial",
      "test": "Supply valid human approval while another policy or authority condition denies the action.",
      "expected": "Approval does not override the denial; the action remains blocked."
    },
    {
      "id": "DAG-06-E",
      "control": "DAG-06",
      "title": "Compensation boundary",
      "test": "Attempt a compensating action after a committed irreversible effect.",
      "expected": "Compensation needs separate authority; the original effect and incident are retained and not relabelled reversed."
    },
    {
      "id": "DAG-06-F",
      "control": "DAG-06",
      "title": "Emergency self-exemption",
      "test": "Have the executing agent claim urgency to bypass a mandatory approval.",
      "expected": "The agent cannot grant itself an exception; blocked work remains blocked or enters a separately governed safety process."
    }
  ]
}