SAFR — Safeguards for Agentic Finance at Runtime · vSAFR v1.0 (July 2026)
SAFR — Safeguards for Agentic Finance at Runtime
SAFR — Safeguards for Agentic Finance at Runtime — 93% of in-scope requirements covered.
14 requirements · 14 in scope (12 enforced · 2 designed). The 93% is weighted over the in-scope base.
Source: BuildFin.AI — "Safeguards for Agentic Finance at Runtime" white paper, Version 1.0, July 2026. Industry reference framework developed through financial-industry collaboration, with lineage in MAS Project MindForge Phase 2 (Executive Handbook + Operationalisation Handbook, Singapore FinTech Festival 2025) and the BuildFin.AI implementation-resources work stream. SAFR is a reference approach, not regulatory guidance or a managed service. · License: The SAFR white paper is published by BuildFin.AI as an industry reference. The KYE™ registry paraphrases each SAFR requirement's intent and cites the SAFR component / section for crosswalk purposes only; it reproduces no substantial text. Mapping is one-directional (SAFR requirement -> KYE™ artefact) and asserts no endorsement by BuildFin.AI or MAS.
By category
| Category | Reqs | Enforced | Designed | Advisory | Deferred | Coverage |
|---|---|---|---|---|---|---|
| Runtime governance at the point of action | 2 | 2 | 0 | 0 | 0 | 100% |
| Agent identity (SAFR component 1) | 2 | 1 | 1 | 0 | 0 | 75% |
| Controls repository & mandate (SAFR component 2) | 2 | 2 | 0 | 0 | 0 | 100% |
| Deterministic disposition (SAFR component 3) | 3 | 2 | 1 | 0 | 0 | 83% |
| Governance envelope (authenticated evidence) | 1 | 1 | 0 | 0 | 0 | 100% |
| Immutable audit log (SAFR component 4) | 1 | 1 | 0 | 0 | 0 | 100% |
| Substantive human escalation | 1 | 1 | 0 | 0 | 0 | 100% |
| Deployment patterns & scope boundary | 2 | 2 | 0 | 0 | 0 | 100% |
Every requirement → the KYE™ artefact that enforces it
| ID | Title | Status | KYE™ enforcement |
|---|---|---|---|
safr.pre-execution-governance |
Every agentic financial action is governed at runtime BEFORE execution — not only at pre-deployment validation and not only in a retrospective audit | enforced | audit_events: kye.purpose.request.v1, kye.purpose.admissibility.v1engines: internal, internal, internalconstitution_refs: constitution/12-PURPOSE-PERMISSION.md |
safr.per-step-independent-authority |
In multi-step agentic workflows the control flow applies to each action independently — an Auto-Execute or Observe outcome at one step carries no authority into the next | enforced | audit_events: kye.purpose.admissibility.v1, kye.evidence.decision_map.v1engines: internal, internalconstitution_refs: constitution/12-PURPOSE-PERMISSION.md |
safr.agent-identity-verification |
Every proposed action is bound to a recognised, registered agent whose identity is verified against its registry entry before any other evaluation proceeds | enforced | audit_events: kye.agent.governance.v1, kye.purpose.request.v1engines: internal, internalconstitution_refs: constitution/52-DELEGATED-AGENT-BINDING.md, constitution/00-INDEX.md |
safr.authoritative-registry-resolution |
In open networks the Agent Identity component resolves which registry is authoritative for the action context and retrieves the appropriate identifier accordingly | designed | audit_events: kye.agent.governance.v1engines: internal, internalconstitution_refs: constitution/52-DELEGATED-AGENT-BINDING.md |
safr.controls-repository |
A configurable controls repository — drawn from organisational policy, regulatory requirements, product rules, and user-provided authority — is the rulebook every proposed action is checked against | enforced | audit_events: kye.evidence.decision_map.v1, kye.purpose.admissibility.v1engines: internal, internalconstitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/29-PROFILES-LITE.md |
safr.mandate-capability-authority |
User-delegated authority is captured as an explicit, machine-readable mandate (permitted action types, decision logic, escalation conditions, validity period, principal authority); the agent cannot extend the scope of a mandate through its own reasoning | enforced | audit_events: kye.purpose.request.v1, kye.agent.governance.v1engines: internalconstitution_refs: constitution/52-DELEGATED-AGENT-BINDING.md, constitution/12-PURPOSE-PERMISSION.md |
safr.deterministic-disposition |
The Disposition Engine evaluates each in-scope action deterministically against the retrieved controls and produces a bounded outcome calibrated to the risk the action presents | enforced | audit_events: kye.evidence.decision_map.v1engines: internal, internalconstitution_refs: constitution/12-PURPOSE-PERMISSION.md |
safr.four-outcome-disposition |
Every proposed action resolves to exactly one of four outcomes — Deny, Escalate, Auto-Execute, or Observe | enforced | audit_events: kye.evidence.decision_map.v1, kye.purpose.admissibility.v1engines: internalconstitution_refs: constitution/12-PURPOSE-PERMISSION.md |
safr.risk-calibrated-outcome |
Outcome assignment is calibrated to the risk profile of the action using factors such as reversibility, financial materiality, customer impact severity, regulatory sensitivity, and novelty/anomaly | designed | audit_events: kye.evidence.decision_map.v1engines: internal, internalconstitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/25-EDGE-GOVERNANCE.md |
safr.governance-envelope-authenticated |
Each action is packaged in a governance envelope (action + reasoning/action-trace + context metadata) before assessment, and the envelope is authenticated against its origin — not merely treated as a record of what the agent reported | enforced | audit_events: kye.evidence.tool_call.v1, kye.evidence.pack.v1, kye.replay.context_seal.v1engines: internal, internalconstitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/52-DELEGATED-AGENT-BINDING.md |
safr.immutable-audit-log |
Every governance decision produces an entry in an immutable, tamper-evident, append-only audit log that captures the complete history of every action and every decision, reconstructable without relying on the agent's own account | enforced | audit_events: kye.evidence.pack.v1, kye.replay.proof.v1engines: internal, internal, internalconstitution_refs: constitution/30-AUDIT-WORM-RETENTION.md, constitution/13-RESILIENCE-LOOP.md |
safr.substantive-human-escalation |
Escalation to a human reviewer is substantive rather than nominal — bounded escalation volume, a timeout window that defaults to block or senior escalation on no decision, and reviewers with authority equal to the original agent decision | enforced | audit_events: kye.purpose.admissibility.v1, kye.compliance.attestation.v1engines: internal, internalconstitution_refs: constitution/36-GOVERNEDUI.md, constitution/21-DELEGATED-AUDITABILITY.md |
safr.native-and-gateway-integration |
The governance layer supports both native instrumentation (the agent emits a governance envelope before each action) and gateway interception (a gateway wraps outbound API calls) without requiring changes to agent code | enforced | audit_events: kye.evidence.tool_call.v1, kye.purpose.request.v1engines: internal, internalconstitution_refs: constitution/16-EDGE-RUNTIME.md, constitution/52-DELEGATED-AGENT-BINDING.md |
safr.decision-not-settlement-boundary |
The governance layer governs the DECISION to act — distinct from settlement rails (which move value) and LLM guardrails (which shape model output); these layers are complementary, not interchangeable, and the decision layer operates after content filtering and before execution | enforced | audit_events: kye.evidence.decision_map.v1engines: internalconstitution_refs: constitution/00-INDEX.md, constitution/12-PURPOSE-PERMISSION.md |