Hong Kong asks who owns an agent's purpose. Write the owner and the stop before it acts.

On 2 November 2026 the Hong Kong Monetary Authority published a discussion paper on how banks govern agentic A.I., and launched Project SAGE the same day. The paper’s centre is who still answers when software is allowed to act. The rule that stays in place is which decisions an AI should never take alone.

This is an illustrative reading of the paper and the press release that announced it. It adds no facts. The paper introduces no binding requirements and asks for comments before 1 February 2027. This is education, not legal or supervisory advice.

What the paper is asking

For this paper, agentic A.I. means a system that pursues an assigned objective by planning and executing a sequence of actions, using tools and other systems, and adapting as conditions change. A drafting assistant that only prepares an email for a person to send sits outside that definition. The same assistant, connected so it can send and file on its own, sits inside.

The paper calls this intent-anchored accountability, and states: “Accountability for actions taken by an A.I. agent should remain with the AI and the person or business function responsible for the deployment’s underlying business intent.” In the paper, AI means an authorized institution, not the software.

Each deployment should have one designated accountable owner, normally the business owner of the purpose. Technical and independent control owners support that person. Ultimate accountability stays with the business owner.

The boundary sits outside the prompt

Tools, permissions, and data access should be set in advance, enforced in the system, and changed only through the bank’s change process. The paper says high-level instructions or prompts alone may not reliably constrain an agent. The agent may read one instruction differently as the context changes, meet new tools or data, or meet outside content written to alter what it does.

While it runs, a deployment should be unable to widen its own authority, add capabilities, create or alter credentials, open a new outside connection, or edit its own boundary controls, unless the bank has approved a controlled arrangement for that. Where law, regulation, or internal policy reserves a decision for a person, the system may inform and should not decide. Where that is unclear, the same split applies.

What counts as a real stop

A bank should be able to bring an agent to a safe state promptly when a risk line is crossed or an incident starts. The paper’s term is a kill switch. Depending on the design, that stop may halt the task, revoke access or credentials, cut connections to outside tools or systems, pause outbound messages, start a fallback, and keep the logs and evidence. Where that is needed to contain harm, the stop should still work if a vendor, platform, or other third party is unavailable.

Approval counts where the approver sees the substance, can reject it, treats rejection as legitimate, and has time before the action takes effect. If volume or speed outruns the reviewer, the paper says that step is not an effective control.

Two steps, using the paper’s own examples

The preliminary stance is a two-step test of significant reach, then effective oversight. It sets no new numerical thresholds, and it still asks whether per-action approval is the second step or only a control after reach is settled.

Step one is reach. Any of three is enough to continue: positions (moving funds, changing accounts, products, or data, or creating a commitment), obligations (discharging a duty, such as closing a regulatory alert), or a critical operation. Drafting or research with no critical-operation role, and with no material sharing of personal, customer, or confidential information outside the bank, is not material. Reach has to be significant on thresholds the bank already uses. Small reversible actions still count if they outrun the bank’s ability to spot and stop them.

Step two asks whether genuine approval of each action stands between the deployment and that harm. If not, it is material. If yes, it stays material only when the action cannot be undone, because a failed gate on a reversible action can still be corrected.

The paper gives these as classification examples.

• Research and drafting with no change to positions, no discharged duty, and no critical operation is not material.
• Closing false-positive financial-crime alerts, with no approval for each action, is material. The closure discharges a regulatory duty, and no person intervenes before a wrongful closure.
• Wholesale payment release with approval of every payment is still material, because a settled payment may not be reversible.

Deployments that share a model, platform, orchestrator, or critical dependency are assessed together. The paper asks whether a registry would show those concentrations, and it does not envisage a public list of each bank’s deployments. Its practical test is whether the deployment’s current capabilities, operating limits and access rights still match what was authorised, and cannot expand without deliberate approval. In Of One, the kill test is the result that would prove that claim wrong.

What to do this week

Pick one agent that can change a record, send a message, or move toward a payment. Fill five lines. The drill is not a finding that the paper applies to you.

• Purpose. What it may pursue, and what it may not do.
• Owner. One named person, and whether they can suspend it without a vendor.
• Boundary. Tools, permissions, and data access, written outside the prompt. If the list lives only in the instruction, mark it unenforced.
• Gate. For money, a closed duty, or an action you cannot undo: does someone see the substance and have time to reject it first?
• Stop. Who halts it, what happens to work already in flight, and when the stop was last tried.

of1.ai’s line is that anything you cannot undo waits at a human gate, and the gate is a named person. The paper’s test is whether that person can challenge, constrain, suspend, or withdraw the deployment.

Time with Utlyze to run Ask, Map, Move on one decision of your own is a consult: $400 an hour, in 5-hour blocks.