# Control 2.12: Supervision and Oversight (FINRA Rule 3110)

**Control ID:** 2.12<br>
**Pillar:** Management<br>
**Regulatory Reference:** FINRA Rule 3110 (Supervision), FINRA Rule 3120 (Supervisory Control System), FINRA Rule 2210 (Communications with the Public), FINRA Rule 4511 (Books and Records), FINRA Regulatory Notice 24-09 (Gen AI / LLM Guidance), SEC Rules 17a-3 / 17a-4 (Recordkeeping and WORM), SOX Sections 302 / 404 (Internal Controls), NYDFS 23 NYCRR 500 (Supervisory Review Analogue)<br>
**Last UI Verified:** April 2026<br>
**Governance Levels:** Baseline / Recommended / Regulated

---

!!! tip "Agent 365 Architecture Update"
    Entra Agent ID's sponsorship model provides structured human accountability for agent lifecycle, aligning with FINRA 3110 supervision requirements (see Control 2.26). The three-role model (Owners, Sponsors, Managers) creates separation of duties where sponsors provide business oversight without technical modification rights. See [Unified Agent Governance](../../framework/agent-identity-architecture.md) for sponsorship model configuration and FINRA 3110 alignment details.

!!! warning "Sovereign Cloud Availability — GCC, GCC High, DoD"
    **Supervisory obligations under FINRA Rule 3110 apply equally to agents deployed in commercial, GCC, GCC High, and DoD tenants.** However, as of April 2026, several of the Microsoft tools referenced in this control have parity gaps in sovereign clouds:

    - **Microsoft Copilot Studio human-agent handoff and approval actions** — verify availability and feature parity in your sovereign tenant before relying on them for Zone 3 supervision.
    - **Microsoft Agent Framework HITL (RequestPort / `request_info()` / checkpoints with pending requests)** — the Agent Framework itself is available, but downstream evidence-export integrations may lag.
    - **Microsoft Entra Agent ID sponsorship and agent-identity Lifecycle Workflows** — have no announced GA in GCC, GCC High, or DoD (see Control 2.26 sovereign-cloud admonition).
    - **Microsoft Agent 365 admin center** — no announced sovereign-cloud GA parity (see Control 2.25).

    FSI firms operating sovereign tenants must:

    - Maintain a **documented compensating supervisory control**: principal-led manual review at the zone-appropriate sampling rate, evidenced in the supervision register maintained under this control (see the Retention table below), and reconciled against the Control 1.2 / 3.1 agent registry.
    - **Not** claim technical enforcement of Zone 3 HITL in sovereign clouds in the firm's WSPs unless Microsoft has published parity for the specific feature being claimed.
    - Disclose the absence of native technical enforcement in the firm's WSPs so FINRA / OCC / SEC / NYDFS examiners are not surprised.
    - Re-verify feature parity at least quarterly and update this control's status in the firm's control register.

## Objective

Establish supervisory procedures for AI agent outputs aligned with FINRA Rule 3110 requirements, implementing human-in-the-loop (HITL) review, sampling protocols, and documented oversight. For Zone 3 customer-facing deployments, firms must configure Copilot Studio human-agent handoff, Power Automate approval actions, or equivalent Microsoft Agent Framework HITL workflows (RequestPort / `request_info()` with checkpointed pending requests) so that outputs meeting the firm-defined high-risk criteria are routed to a qualified human reviewer before delivery. Exact configuration must be documented in the firm's WSP addendum and tested annually under Rule 3120; the availability and behavior of these features in sovereign clouds is subject to the Sovereign Cloud admonition above.

This control **supports compliance with** FINRA Rule 3110 (Supervision), FINRA Rule 4511 (Books and Records), FINRA Rule 2210 (Communications with the Public), FINRA Rule 3120 (Supervisory Control System), FINRA Regulatory Notice 24-09 (Gen AI / LLM Guidance), SEC Rules 17a-3 / 17a-4 (Recordkeeping and WORM retention), and SOX Sections 302 / 404 (Internal Controls). **It does not replace** a firm's written supervisory procedures, the designation of an appropriately registered principal (Series 24 for broker-dealers, Series 66/65 for investment advisers), or the registered-principal supervisory review required by FINRA Rule 3110 for the business activities involved. Controls 2.25, 2.26, and 3.6 reference this control as the authoritative non-substitution anchor; tooling described in those controls likewise supports — and does not substitute for — supervisory obligations under this control.

---

## Why This Matters for FSI

- **FINRA Rule 3110:** Requires written supervisory procedures (WSPs) for all business activities including AI-assisted communications. The FINRA 2026 Annual Oversight Report emphasizes that AI-assisted supervision tools require the same WSP rigor as human supervisory workflows, including documented escalation paths for AI-flagged exceptions.
- **FINRA Rule 4511:** Supervision records must be maintained as books and records
- **SEC Rule 17a-4:** Supervisory review documentation preserved for regulatory examination
- **SOX Sections 302/404:** Management certification requires documented internal controls

!!! info "Updated February 2026"
    FINRA 2026 oversight priorities highlight AI supervision as an examination focus area. Firms using AI for supervisory functions (trade surveillance, communication monitoring) must document how AI substitutes for or augments human supervision.

---

## Control Description

This control establishes supervision through:

1. **Written Supervisory Procedures** - Document WSPs for AI agent deployment and monitoring
2. **Human-in-the-Loop Configuration** - Configure HITL requirements in Copilot Studio
3. **Sampling Protocols** - Define statistical sampling for output review
4. **Principal Designation** - Assign qualified supervisors per FINRA requirements
5. **Exception Escalation** - Define escalation paths for flagged outputs
6. **Supervision Evidence** - Maintain review logs for regulatory examination

---

## Key Configuration Points

- Create WSP addendum for AI agent supervision
- Configure Copilot Studio supervisory patterns for Zone 3: **human-agent handoff** (escalation to a live reviewer), **approval actions** (Power Automate-triggered pre-send approval), and **generative-answers guardrails** (content source constraints and moderation). Pattern selection must match the firm-defined high-risk criteria in the WSP and must be verifiable by configuration export.
- Set sampling rates: 100% for high-risk actions, statistical sampling for routine
- Designate qualified principals (Series 24 for BD, Series 66 for RIA) as supervisors
- Configure Power Automate workflows for review queue management
- Implement escalation triggers for flagged content
- Archive supervision decisions with reviewer identity and timestamp

!!! tip "Automation Available"
    See [FINRA Supervision Workflow](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/finra-supervision-workflow) in FSI-AgentGov-Solutions for automated supervision queue management with SLA tracking, escalation workflows, and audit trail generation supporting FINRA Rule 3110 compliance.

---

## Zone-Specific Requirements

| Zone | Requirement | Rationale |
|------|-------------|-----------|
| **Zone 1** (Personal) | Self-service with periodic spot-check; annual WSP acknowledgment | Low external impact, minimal supervision needed |
| **Zone 2** (Team) | Owner-level supervision; 10% sampling; documented review process | Shared agents warrant structured oversight |
| **Zone 3** (Enterprise) | Principal supervision; HITL for high-risk; statistical sampling; real-time monitoring | Customer-facing requires maximum supervisory controls |

---

## Roles & Responsibilities

| Role (canonical — see `docs/reference/role-catalog.md`) | Responsibility |
|---|---|
| **Compliance Officer** | Own the WSP addendum, designate qualified principals, validate regulatory alignment, sign the annual Rule 3120 testing report. |
| **Designated Principal / Qualified Supervisor** (Series 24 for BD supervisory scope; Series 66 / 65 for RIA scope) | Execute supervisory review of flagged outputs, approve / reject / escalate under the WSP, sign principal pre-use approvals required by Rule 2210, sign Rule 3120 evidence. Registration must be current and verifiable via CRD. |
| **AI Governance Lead** | Own the framework-level supervision design, define sampling protocols and zone thresholds, coordinate sovereign-cloud compensating-control operation, present control evidence to internal audit. |
| **AI Administrator** | Configure Copilot Studio HITL / human-agent handoff and approval actions; configure Agent Framework HITL evidence export; maintain admin-configured SoD boundaries for the sponsorship model; this is the Microsoft-admin-surface operator, distinct from the governance lead. |
| **Agent Owner** | Ensure each assigned agent is registered in Control 1.2 / 3.1, has a documented zone classification, and operates within the scope for which the principal has approved supervision. |

---

## Related Controls

| Control | Relationship |
|---------|--------------|
| [2.6 — Model Risk Management (OCC Bulletin 2026-13 (formerly OCC 2011-12) / Fed SR 26-2 (formerly SR 11-7))](2.6-model-risk-management-sr-26-2.md) | Supervision is a component of MRM; this control provides the human-oversight layer for models in production. |
| [2.13 — Documentation and Record-Keeping](2.13-documentation-and-record-keeping.md) | WSPs, supervision registers, and reviewer decisions maintained per record-keeping requirements. |
| [2.25 — Agent 365 Admin Center Governance](2.25-agent-365-admin-center-governance-console.md) | **Non-substitution downstream.** Agent 365 admin approval workflows reference this control as the supervisory anchor; admin approval is not principal supervision. |
| [2.26 — Entra Agent ID Identity Governance](2.26-entra-agent-id-identity-governance.md) | **Non-substitution downstream.** Sponsorship provides lifecycle accountability; principal supervision (this control) provides business-activity oversight. |
| [1.7 — Comprehensive Audit Logging](../pillar-1-security/1.7-comprehensive-audit-logging-and-compliance.md) | Supervision events (HITL decisions, escalations, 3120 testing) are captured in the immutable audit log feeding WORM retention. |
| [3.1 — Agent Inventory and Metadata Management](../pillar-3-reporting/3.1-agent-inventory-and-metadata-management.md) | Supervision scope is bounded by the authoritative agent registry; untracked agents cannot be supervised. |
| [3.4 — Incident Reporting and Root Cause Analysis](../pillar-3-reporting/3.4-incident-reporting-and-root-cause-analysis.md) | Supervisory failures and missed HITL reviews trigger the incident process. |
| [3.6 — Orphaned Agent Detection and Remediation](../pillar-3-reporting/3.6-orphaned-agent-detection-and-remediation.md) | **Reactive layer.** When agents lose accountable owners/sponsors, 3.6 detection re-enters this control's supervisory scope until reassignment. |

---

## AI Agent Autonomy Levels (2026 Oversight Report Guidance)

The FINRA 2026 Annual Regulatory Oversight Report emphasizes that firms must define and supervise AI agent autonomy levels. Different autonomy levels require different supervisory approaches. The Report notes that agentic AI systems with varying autonomy levels require supervisory procedures tailored to the degree of autonomy—fully autonomous agents executing actions without human approval require more stringent supervisory controls than agents that only recommend actions.

| Autonomy Level | Description | Supervision Requirement | Zone Applicability |
|---------------|-------------|------------------------|-------------------|
| **Recommend-Only** | Agent provides recommendations; human approves all actions | Post-use review acceptable (Rule 3110) | Zone 1-2 |
| **Semi-Autonomous** | Agent executes routine actions; human approval for material decisions | Pre-approval workflows for material thresholds | Zone 2-3 |
| **Fully Autonomous** | Agent executes all actions within scope without per-action human approval | Real-time monitoring + exception alerting + pre-deployment principal approval mandatory; post-use review at 100% of materially-impactful actions until supervisory confidence is demonstrated | **Not in scope at Agent 365 GA.** Autonomous-agent identities with their own mailboxes / delegated permissions remain in Preview at Agent 365 GA (May 1, 2026) and are out of scope for production Zone 3 deployment until Microsoft publishes GA licensing and governance guidance (see Control 2.25). |

!!! danger "Autonomous Agents, Zone 3, and Agent 365 Preview Scope"
    Fully autonomous agents (self-directing without per-action human approval) are **not recommended** for Zone 3 customer-facing deployments in financial services, and are **out of scope at Agent 365 GA** — Microsoft's autonomous-agent identity pattern remains in Preview at the May 1, 2026 GA milestone (see Control 2.25). FINRA's 2026 Annual Regulatory Oversight Report reinforces the expectation of meaningful human oversight of AI-assisted customer interactions; a firm that deploys a fully autonomous agent into Zone 3 before Microsoft publishes GA guidance for the pattern is acting ahead of both the platform's supported configuration and the regulator's stated expectation.

### Autonomy Classification Requirements

1. **Document autonomy level** in agent governance records
2. **Map autonomy to supervision** procedures in WSPs
3. **Configure HITL thresholds** appropriate to autonomy level
4. **Test autonomy limits** per Rule 3120 annual requirements

---

## FINRA Rule 2210 Communication Classifications

FINRA Rule 2210 distinguishes communication types with different supervision requirements. AI agent outputs must be classified correctly:

| Communication Type | Definition | Supervision Requirement | AI Agent Impact |
|-------------------|------------|------------------------|-----------------|
| **Correspondence** | To 25 or fewer retail investors within 30 days | Post-use review acceptable | Zone 2 agents may qualify |
| **Retail Communication** | To more than 25 retail investors within any 30 calendar-day period | Principal approval before first use, subject to the enumerated exclusions in Rule 2210(b)(1) (e.g., certain previously-approved templated content, certain filed / reused institutional material). Firms must document which exclusion, if any, is relied upon. | Zone 3 agents typically require; document per-template approval or exclusion reliance. |
| **Institutional Communication** | To institutional investors only | Internal procedures | Reduced supervision burden |

!!! warning "Zone 3 Classification Critical"
    If an AI agent's output could reach more than 25 retail investors within any 30-day period, it likely qualifies as a **Retail Communication** requiring pre-use principal approval. Err on the side of stricter classification.

### Classification Decision Tree

1. **Who is the audience?**
   - Institutional only → Institutional Communication
   - Includes retail → Continue to step 2

2. **How many retail investors in 30 days?**
   - ≤25 → Correspondence (post-use review OK)
   - >25 → Retail Communication (pre-use approval required)

3. **Agent zone classification?**
   - Zone 1: Personal use, not shared externally
   - Zone 2: May generate Correspondence if audience limited
   - Zone 3: Assume Retail Communication; configure HITL pre-approval

See: [FINRA Rule 2210](https://www.finra.org/rules-guidance/rulebooks/finra-rules/2210)

---

## Rule 3120 Annual Testing Requirements

FINRA Rule 3120 requires firms to test and verify their supervisory control systems annually. For AI agent governance, this includes testing that AI supervision controls function as designed.

### Annual Testing Checklist

| Test Area | Frequency | Evidence Required |
|-----------|-----------|-------------------|
| **WSP Adherence** | Annual | Documented testing results showing procedures are followed |
| **HITL Functionality** | Annual | Test cases with pass/fail results for review queue |
| **Escalation Procedures** | Annual | Simulated escalation logs showing proper routing |
| **Review Queue Performance** | Annual | Queue audit showing timely reviews within SLA |
| **Sampling Protocol Execution** | Annual | Evidence that sampling rates are met |
| **Supervisor Qualifications** | Annual | Verification that designated principals maintain required registrations |

### Testing Methodology

1. **Design Effectiveness:** Verify WSPs adequately address AI agent supervision risks
2. **Operating Effectiveness:** Test that controls operate as designed throughout the year
3. **Exception Handling:** Verify exceptions are identified, escalated, and resolved
4. **Documentation:** Maintain Rule 3120 testing evidence (design, operating effectiveness, exceptions, remediation) for **6 years** on WORM-backed storage or a compliant 17a-4(f) audit-trail alternative, easily accessible for the first 2 years. Rule 3120 testing evidence is a supervision record under SEC 17a-4(b)(4).

!!! warning "Examination Focus"
    The FINRA 2026 Annual Regulatory Oversight Report emphasizes that examiners will assess whether firms have tested their AI supervisory controls per Rule 3120. Undocumented testing is treated as no testing.

See: [FINRA Rule 3120](https://www.finra.org/rules-guidance/rulebooks/finra-rules/3120)

---

## Entra Agent ID Sponsorship Alignment

!!! info "Entra Agent ID — Maturing with Agent 365 GA"
    Microsoft Entra Agent ID sponsorship model is in preview, with the broader **Agent 365 control plane reaching GA on May 1, 2026**. This feature provides identity governance capabilities that align with FINRA 3110 supervision requirements.

    **March 2026 Status:** Entra Agent ID and Conditional Access policies targeting non-human agent identities remain in Preview. The Agent 365 Unified Control Plane reaches GA on May 1, 2026, with Observability SDK integration expected to mature at or shortly after GA. Organizations should plan production deployment of sponsorship-dependent controls to align with the Agent 365 GA timeline. See [Agent 365 overview](https://learn.microsoft.com/en-us/microsoft-agent-365/overview) for current availability.

### Supervision Through Sponsorship

Microsoft Entra Agent ID introduces a **human sponsorship model** for AI agent identities (Agentic Users). Every agent identity requires a designated human sponsor who serves as the agent's supervisor throughout its lifecycle. This model aligns naturally with FINRA Rule 3110's requirement for designated supervisors and written supervisory procedures.

**How Sponsorship Aligns with FINRA 3110:**

The sponsor serves as the **designated supervisor** for the agent's lifecycle — analogous to the "qualified principal" requirement in FINRA 3110. Key alignment points:

1. **Human accountability for agent actions** — Every agent has an identifiable human sponsor responsible for oversight
2. **Lifecycle governance with separation of duties** — Sponsors cannot delete agents, supporting maker/checker separation that helps prevent evidence destruction (supporting FINRA 4511 record-keeping requirements)
3. **Departure notification workflows** — Entra Lifecycle Workflows send notifications when a sponsor leaves the organization but do not auto-reassign sponsorship by default; automatic reassignment requires custom workflow extensions
4. **Periodic attestation and access reviews** — Re-attestation workflows align with FINRA 3110's periodic supervisory review obligations
5. **Audit trail of sponsorship decisions** — All sponsorship assignments, transfers, and attestations are logged in Entra audit logs for examination readiness

### FINRA 3110 Sponsorship Mapping

| FINRA 3110 Requirement | Entra Agent ID Capability | Implementation |
|------------------------|---------------------------|----------------|
| **Designated supervisor** | Human sponsor required for every agent identity | Assign sponsor at agent identity creation; sponsor must exist before agent can be deployed |
| **Written supervisory procedures (WSPs)** | Lifecycle workflows enforce sponsorship governance | Configure review workflows in Entra ID Governance; document procedures in WSP addendum |
| **Periodic supervisory review** | Access reviews and re-attestation workflows | Configure quarterly sponsor attestation; reviewer confirms agent still serves business purpose and operates within approved scope |
| **Supervisor reassignment on departure** | Lifecycle departure workflows | Notification triggered on sponsor termination; backup sponsor must be manually assigned or automated via custom workflow extensions |
| **Separation of duties** | Sponsor role is distinct from Owner and Manager roles in the Entra Agent ID sponsorship model | Configure Entra role assignments so the sponsor's account does not hold the Entra / Power Platform role required to delete the agent identity or the underlying Copilot Studio / Agent Framework resource. **Verify the specific built-in role boundaries in your tenant against current Microsoft Learn documentation** — Microsoft has not published a guarantee that the sponsor role is intrinsically prohibited from deletion in every surface. Treat SoD as a **firm-configured** control, evidenced by a quarterly role-assignment attestation, not an intrinsic platform property. |
| **Supervision audit trail** | Entra audit logs capture all sponsorship events | Logs include sponsor assignments, attestations, workflow triggers, and access reviews for regulatory examination |

### Implementation Considerations

**Zone-Specific Sponsorship Requirements:**

Microsoft Entra Agent ID requires **at least one sponsor for each agent identity and agent identity blueprint** at the platform level — sponsorship cannot be waived in any zone. FSI **supervisory intensity** layered on top of that platform requirement varies by zone:

- **Zone 1 (Personal):** Sponsor required by Entra Agent ID (platform-enforced); creator typically serves as sponsor with light supervisory review by Compliance Officer
- **Zone 2 (Team):** Sponsor required by Entra Agent ID (platform-enforced); team lead serves as sponsor with documented review process and periodic attestation
- **Zone 3 (Enterprise):** Sponsor required by Entra Agent ID (platform-enforced); designated qualified principal serves as sponsor with quarterly attestation and formal WSP integration

**Sponsorship vs. Other Supervision Controls:**

Sponsorship provides **lifecycle and identity governance**. It complements (does not replace) other supervision controls documented in this control:

- **Human-in-the-Loop (HITL)** — Real-time review of agent outputs before delivery to customers
- **Sampling protocols** — Statistical review of agent communications for quality and compliance
- **Exception escalation** — Risk-based triggers that escalate concerning outputs to supervisors

Use sponsorship to establish **who is accountable** for the agent. Use HITL, sampling, and escalation to supervise **what the agent does**.

**Cross-References:**

- See [Agent Identity Architecture](../../framework/agent-identity-architecture.md) for sponsorship governance procedures, lifecycle workflows, and Zone-specific attestation requirements

---

## Implementation Playbooks

!!! info "Step-by-Step Implementation"

    This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

    - [Portal Walkthrough](../../playbooks/control-implementations/2.12/portal-walkthrough.md) — Step-by-step portal configuration
    - [PowerShell Setup](../../playbooks/control-implementations/2.12/powershell-setup.md) — Automation scripts
    - [Verification & Testing](../../playbooks/control-implementations/2.12/verification-testing.md) — Test cases and evidence collection
    - [Troubleshooting](../../playbooks/control-implementations/2.12/troubleshooting.md) — Common issues and resolutions

---

## March 2026 Documentation Update

### Human-in-the-loop workflows in Microsoft Agent Framework

Microsoft Agent Framework now documents human-in-the-loop (HITL) workflows by using **request and response** handling. Executors can send a request to an external system or human operator, wait for the response, and resume workflow execution with the returned decision. Pending requests are preserved in checkpoints and re-emitted when a workflow is restored.

| Official workflow capability | Supervision use case |
|------------------------------|----------------------|
| RequestPort / `request_info()` | Route high-risk agent actions to a designated principal or compliance queue before continuing |
| Response handlers | Preserve the reviewer decision against the original request so the approval path remains auditable |
| Checkpoints with pending requests | Resume supervisory reviews after outages without losing approval context or outstanding actions |
| Event streaming | Feed supervision queues, case-management tooling, or evidence exports with reviewer actions and timestamps |

This pattern is relevant when building custom supervision workflows outside Copilot Studio. It complements Copilot Studio review queues and human handoff; it **does not replace** written supervisory procedures, designated-principal assignment, reviewer qualifications (Series 24 for BD; Series 66 / 65 for RIA), or the principal pre-use approval that Rule 2210 requires for retail communications. Agent Framework HITL is supervisory **infrastructure**; FINRA 3110 requires supervisory **decision-making by qualified humans**.

---

## Supervision Evidence Retention (FINRA 4511 / SEC 17a-4)

Supervision records under FINRA Rule 3110 are books-and-records under FINRA Rule 4511 and SEC Rule 17a-4(b)(4). They must be preserved on a non-rewriteable, non-erasable medium (WORM) per SEC Rule 17a-4(f), or using an audit-trail alternative permitted under the 2022 amendments. The table below enumerates the artifacts this control produces and the retention discipline that applies to each.

| Evidence Artifact | Source System | Retention | Medium / Integrity | Regulatory Anchor |
|---|---|---|---|---|
| WSP addendum (AI agent supervision) and amendments | Firm document management | 6 years, easily accessible first 2 | WORM or audit-trail alternative; versioned with signer identity and timestamp | FINRA 4511; SEC 17a-4(b)(4), (f) |
| HITL / human-handoff reviewer decisions (approve / reject / escalate) | Copilot Studio transcripts; Agent Framework response handlers; Power Automate approval history | 6 years from review date | WORM or immutable audit log export; reviewer UPN + timestamp + decision + rationale | FINRA 3110; 4511; SEC 17a-4(b)(4) |
| Sampling protocol results (selection, review, disposition) | Supervision workflow; case-management system | 6 years | WORM or audit-trail alternative | FINRA 3110; 3120; 4511 |
| Exception / escalation logs | Supervision workflow; SIEM | 6 years | Immutable audit log; chain-of-custody preserved | FINRA 3110; 4511 |
| Rule 3120 annual-testing evidence (design, operating, exceptions, remediation) | Internal testing working papers | 6 years | WORM-exportable; signed by testing supervisor | FINRA 3120; 4511 |
| Principal-designation records (registration status, qualification verifications) | HR / Compliance system of record | Duration of designation + 6 years after | WORM; periodic (at least annual) attestation | FINRA 3110; 4511 |
| Agent Framework request/response supervision artifacts (request ID, checkpoint state, reviewer response payload) | Agent Framework event stream; evidence export pipeline | 6 years from request resolution | Immutable export to WORM-backed store or compliant audit-trail system | FINRA 3110; 4511; SEC 17a-4(b)(4) |
| 2210 classification decisions (Correspondence vs Retail vs Institutional) and principal pre-use approvals where required | Marketing review system; supervision workflow | 6 years (per 2210 / 4511) | WORM; approver UPN + registration + timestamp | FINRA 2210; 4511 |

Records required under 17a-4(b) must remain easily accessible for the first two years. Firms using the 17a-4(f) audit-trail alternative must maintain the Designated Third Party / Designated Executive Officer attestations Microsoft's M365 compliance documentation specifies for the relevant Purview or compliant-recordkeeping configuration.

---

## Verification Criteria

Each criterion below is stated as an objective evidence test — the evidence type, sample size, retention, and signer are examiner-visible. "Functions correctly" is not an acceptable result; produce the artifact.

| # | Evidence Test | Evidence Type | Sample / Frequency | Retention | Signed By |
|---|---|---|---|---|---|
| 1 | **WSP addendum coverage.** The firm's WSP addendum names this control, enumerates the supervision activities for each zone, designates qualified principals by name and registration, and was approved by a registered principal before current effective date. | Versioned WSP document with signature page | Full document; re-reviewed at least annually | 6 yrs; WORM or 17a-4(f) audit-trail alternative | Designated Principal (Series 24 / 66) |
| 2 | **HITL configuration — Zone 3 (commercial cloud).** For a random sample of N=10 Zone 3 agents per quarter, the Copilot Studio human-agent handoff configuration or Agent Framework HITL wiring is present, the trigger criteria match the WSP, and a test transcript demonstrates routing to a qualified reviewer. | Configuration export + test transcript | N=10/quarter | 6 yrs | AI Administrator + Compliance Officer |
| 3 | **Principal registration verification.** For 100% of designated principals listed in the WSP addendum, the firm can produce current CRD verification (Series 24 for BD supervisory scope; Series 66 / 65 for RIA scope) dated within the last 90 days. | CRD extract; WebCRD attestation | 100%, quarterly | Duration of designation + 6 yrs | Compliance Officer |
| 4 | **Review queue SLA.** Supervisory review queue shows median and 95th-percentile time-to-review within the firm's documented SLA (per zone); exceptions are logged as incidents under Control 3.4. | Queue export with latency metrics | Monthly report | 6 yrs | AI Governance Lead |
| 5 | **Reviewer-decision audit trail.** For a random sample of N=25 reviewer decisions per quarter, each record contains non-null reviewer UPN, timestamp, decision (approve / reject / escalate), and rationale; each decision is traceable to the original agent interaction and (for Agent Framework) to the originating request ID and checkpoint. | Immutable audit log export | N=25/quarter | 6 yrs WORM | Compliance Officer |
| 6 | **Rule 3120 annual test.** Rule 3120 annual test of AI supervisory controls is performed, documents design and operating effectiveness, enumerates exceptions with remediation, and is signed by a qualified principal. | Rule 3120 working papers | Annual | 6 yrs | Designated Principal |
| 7 | **Rule 2210 classification evidence.** For a random sample of N=10 customer-facing Zone 3 agent outputs per quarter, the 2210 classification (Correspondence / Retail / Institutional) is recorded; where classification is Retail Communication, principal pre-use-approval evidence (or documented exclusion) is attached. | Supervision register entries with linked approvals | N=10/quarter | 6 yrs | Designated Principal |
| 8 | **Sovereign-cloud compensating control (GCC / GCC High / DoD only).** For sovereign tenants, a quarterly manual supervisory review against the Control 1.2 / 3.1 agent registry, evidenced by signed attestation, covers all Zone 3 agents not backed by commercial-cloud HITL tooling. | Manual attestation record | Quarterly, 100% | 6 yrs | Designated Principal |
| 9 | **Agent Framework evidence retention (if used).** For every HITL request raised via Agent Framework `request_info()`, the firm retains request ID, checkpoint state at pause, reviewer response payload, and final executor output. | Agent Framework evidence export | 100% of HITL requests | 6 yrs from resolution | AI Administrator |

Any missing artifact is treated as a control exception requiring written remediation and re-test within the following quarter.

---

## Additional Resources

**FINRA Guidance:**

- [FINRA Rule 3110: Supervision](https://www.finra.org/rules-guidance/rulebooks/finra-rules/3110) — Primary supervision rule
- [FINRA Rule 3120: Supervisory Control System](https://www.finra.org/rules-guidance/rulebooks/finra-rules/3120) — Testing and verification of supervisory procedures
- [FINRA Regulatory Notice 24-09: Gen AI and LLM Guidance](https://www.finra.org/rules-guidance/notices/24-09) — Official guidance on AI supervision obligations
- [FINRA 2026 Annual Regulatory Oversight Report](https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report) — Most comprehensive AI agent supervision guidance (December 2025)
- [FINRA RN 25-07: Workplace Modernization (RFC - Request for Comment)](https://www.finra.org/rules-guidance/notices/25-07) — Addresses workplace rules, not AI governance
- [FINRA Communications FAQ D.8](https://www.finra.org/rules-guidance/guidance/faqs/advertising-regulation) — Firms are responsible for AI-generated communications

**Microsoft Learn:**

- [Microsoft Learn: Quickstart: Create and deploy an agent](https://learn.microsoft.com/en-us/microsoft-copilot-studio/nlu-gpt-overview)
- [Microsoft Learn: Human Agent Handoff](https://learn.microsoft.com/en-us/microsoft-copilot-studio/advanced-hand-off)
- [Microsoft Learn: Human-in-the-Loop workflows in Microsoft Agent Framework](https://learn.microsoft.com/en-us/agent-framework/workflows/human-in-the-loop)
- [Architecting Agent Solutions — Microsoft Guidance](https://learn.microsoft.com/en-us/microsoft-copilot-studio/guidance/architecture/)

---

*Updated: May 2026 | Version: v1.6.2 | UI Verification Status: Current*
