SAFR is an industry reference framework for governing agentic AI in financial services — at the point of every action, before execution. Introduced in July 2026 through collaboration among financial industry members. This explainer covers what SAFR is, why it exists, the four components, the four dispositions, and how Aureon Runtime implements it as a shipping product.
For most of the past decade, AI in financial services was decision support. Models produced recommendations and humans reviewed them before action. Institutions are now deploying agents that act autonomously — initiating payments, submitting trading orders, approving credit, filing reports — without per-decision human review.
The governance infrastructure hasn't kept pace. Three gaps in particular:
Model risk management assesses the model before it goes live. Audit reviews sampled transactions hours later. Neither catches a problematic agent decision before it executes.
No standard for when a human decides. Notifications, dashboard flags, email alerts — no deadline, no audit record, no defined reviewer. The appearance of oversight without the substance.
Where institutions build agentic controls, they build them independently for each deployment. Not interoperable, not auditable in a consistent format. Every bank rebuilding the same wheel.
SAFR introduces a governance checkpoint between every agent decision and its execution. The four components interact through a structured record of what the agent intends to do, why, and with what supporting evidence.
Before any agentic action can execute, it is packaged in an envelope with three classes of information:
Type. Scope. Parameters of the proposed action.
Steps the agent executed. Tool calls made. Data retrieved. Checks performed.
Agent identity. Applicable mandate. Account or system state. Operative policy constraints.
Binds each proposed action to a registered, verified agent — before any other evaluation proceeds. Closed-loop registries or open-network directories, depending on the deployment.
The institution's configurable rulebook. Regulatory constraints, product rules, exposure limits, evidence-quality thresholds, and user-granted mandates.
Evaluates each in-scope action deterministically against the retrieved controls. Returns one of four outcomes calibrated to risk.
Tamper-evident, append-only. Every envelope, every disposition, every reason, every timing — preserved as the authoritative record.
The Disposition Engine resolves every in-scope action to one of four outcomes. Higher-risk actions shift toward Deny or Escalate. Lower-risk actions receive Auto-Execute or Observe. Calibration factors: reversibility, financial materiality, customer impact, regulatory sensitivity, novelty.
The action violates a hard regulatory or policy constraint, or exceeds a defined risk threshold. Rejected before execution. Reason recorded.
In scope, below hard constraints, but above the threshold for autonomous execution. Held pending human review, with a defined deadline, reviewer, and audit record.
Within scope, below hard constraints, within defined risk thresholds. Proceeds without human intervention. Fully logged for after-the-fact review.
Permitted to proceed but flagged. Executes while a structured observation is logged. For signals worth monitoring without blocking.
All four outcomes feed into the Audit Log regardless of which was reached. In multi-step workflows, the control flow applies to each action independently — prior authorisation does not carry forward.
SAFR is not the same as content filtering, not the same as observability, not the same as settlement compliance. It sits between them.
Content filtering, prompt defences, output guardrails. Screen out harmful, malformed or policy-violating outputs before they leave the model. Important — but not sufficient.
Pre-execution governance. Envelope, identity, controls, disposition, audit. Determines whether the agent is permitted to do what it proposes to do.
Payment rails, SWIFT, card networks, ACH, core banking. Governs how value actually moves once the action is submitted. Card network rules, message standards, programmable settlement conditions.
Each layer is essential. None substitutes for another. SAFR is the layer that's been missing.
Which pattern to use depends on whether the agent is being newly built or already deployed.
The agent is instrumented to emit a Governance Envelope before each proposed action. The SAFR validator evaluates the envelopes against the controls repository and returns an outcome decision before the agent acts. Tightest integration, most granular governance record, cleanest audit trail. Recommended for new deployments.
A SAFR gateway intercepts outbound API calls at the infrastructure layer, wraps each call in a Governance Envelope, and evaluates it — without any changes to the agent code. Bring legacy or third-party agents under governance without re-engineering. For institutions with many existing agents, gateway is a practical starting point.
Six representative implementations from the SAFR white paper — spanning treasury, payments, wealth management, corporate banking and insurance. Different mechanics, same four-component pattern.
Identity: Digital Agent Passport. Controls: Machine-readable mandates. Disposition: Circuit breakers at agent, principal or counterparty level.
Identity: Agentic Token bound to operator + user. Controls: Consumer-scoped authority (merchant, amount, timeframe). Audit: Verifiable Intent framework.
Identity: Token Requester Identifiers. Controls: Consumer Passkey confirmation → digital rule on Visa network. Disposition: Real-time check at network level.
Identity: ERC-8004 on-chain identity. Controls: Per-transaction caps + Compliance Engine. Audit: Append-only, reconciled with on-chain settlement.
Identity: Agent bound to workflow triggers. Controls: Narrowly-scoped tasks. Disposition: Human review at critical decision points.
Identity: Per-request adviser identity. Controls: Retrieval control, LLM-as-a-Judge evaluation. Disposition: No autonomous execution into financial systems.
Source: SAFR white paper, July 2026. Aureon Runtime implements the same four-component pattern, delivered as a shipping product.
You don't have to build SAFR internally. Aureon Runtime maps to it, component-by-component — with the deterministic controls, the Governance Envelope, the four dispositions, and the tamper-evident audit log as the product.
| SAFR Component | Aureon Module | What it does in Aureon |
|---|---|---|
| Agent Identity | Aureon Core | Cryptographic workload identity, short-lived, tied to registered version and environment. |
| Controls Repository | Aureon Policy | Converts regulation, policy and risk appetite into testable, enforceable controls. Signed control bundles. |
| Disposition Engine | Aureon Runtime | Deterministic disposition against retrieved controls. Human-approval pause. Kill switch, tool revocation, graduated intervention. |
| Audit Log | Aureon Runtime | Tamper-evident, append-only, per-action. OpenTelemetry-compatible traces with redaction policy. |
| Governance Envelope | Native + Gateway SDK | Both integration patterns supported. SDK for Python, TypeScript, Java, .NET. Zero-code option for legacy agents. |
SAFR does not exist in a vacuum. It complements — and is informed by — a growing set of AI governance frameworks in financial services.
AI Risk Management Handbook covering traditional AI, generative AI and agentic architectures. Practical implementation guidance — kill switches, least-privilege, agent certification.
Ongoing MAS workstream developing implementation resources for agentic AI risks. Complements SAFR.
Model AI Governance Framework — four core components (models, memory, tools, actions) with governance across use-case bounding, access limitation, human oversight, principal hierarchy.
Four-part core (Map, Measure, Manage, Govern) for continuous risk evaluation across the AI lifecycle.
Explicit requirements for kill switches, human-in-the-loop, explainability thresholds, red-teaming, automation-bias monitoring for AI in Indian financial institutions.
Three-layer model for agentic payments — intent, control and authorisation, settlement. Cryptographically-signed mandates for verifiable machine-to-machine transactions.
Two ways to start. No sales-cycle overhead. On your premises or in your VPC.