Marginalia · anatomy · The Agentic Bank

Turns CFR text into atomic obligations, maps them to the control inventory by scope (not keyword), and surfaces the gaps.

Regulatory compliance & change-management desk. Stands alone: it parses a published amendment into work items for compliance owners.

Methodology

1 Retrieve the regulation section in scope.
2 Check applicability and scope first: confirm the rule binds a bank (part 1022 binds money-services businesses, 1023 binds brokers, not the bank). Do not credit bank controls for obligations the bank is not subject to.
3 Extract atomic obligations: one requirement each, with its citation; split compound requirements into separate obligations.
4 Retrieve the control inventory and map by scope, not keyword: a control covers an obligation only if its described scope actually reaches it.
5 Classify each mapping covered / partial / gap, and list the partials and gaps as the work items.
6 Recommend concrete remediation for each gap: a new control, an enhancement, an owner.

Sandboxed tools

In-process MCP tools only. Built-in tools disabled, settingSources [], permissionMode bypassPermissions. The only ground truth is the tools.

get_regulation read 12 / 31 CFR (vendored)

Retrieves a regulation: a specific section or the whole part.

list_controls read

The bank's documented controls: id, name, domain, description, status.

record_assessment commit

Commits the obligations assessment. Called exactly once.

Outcome contract

An obligations assessment: the extracted obligations with citations, obligation-to-control mappings with a coverage status, the gaps, and recommended actions.

▸ the validated schema (Assessment)

type Assessment = {
  regId, citation: string
  obligations: { id, text, type?, citation? }[]
  mappings: { obligation, controls: string[],
              status: "covered" | "partial" | "gap", note? }[]
  gaps: string[]
  summary: string
  recommendedActions: string[]
}

Grounding

real Real CFR parts. The vendored 12 / 31 CFR text (the same corpus the regulations repo mirrors). Obligations cite the real section numbers.

synthetic The control inventory. The bank's documented controls. Synthetic, because a real control inventory is proprietary.

Governance seams

The three trust boundaries a runtime governance layer clamps onto. Shown here ungoverned, so you can see exactly what would be inspected, redacted, or blocked.

Model plane

context in

The Marginalia methodology plus the retrieved regulation text and the control inventory.

governor → Pin the model to the retrieved text; flag claims not traceable to it.

Tool plane

rule + controls

The get_regulation and list_controls calls' full I/O.

governor → Govern which regulations and control records are in scope for a given assessment.

Data plane

the commit

The recorded assessment (obligations, mappings, gaps) written to the case journal.

governor → Require sign-off before a 'covered' claim is trusted by downstream compliance work.

Marginalia credits no coverage it cannot ground in both the rule text and the control inventory. The applicability gate is what stops it from declaring false coverage on a rule the bank is not even subject to.

Evals & guardrails

4 / 4 golden Graded on obligation extraction, mapping status, and the gap list.

Out-of-scope rule (part 1022 / 1023). Flags the rule as binding MSBs / brokers, not the bank, instead of crediting bank controls.
Scope vs keyword. Marks a CIP-records control as not covering a Travel-Rule recordkeeping obligation.

Orchestration

Specialist parse → map → gap

⇢Stands alone on the compliance desk
⇢Gaps are actioned by a compliance owner