R-DG-01 Data Governance & Integrity DAMAGE 4.1 / Critical

Data Lineage Severance

Agent reasoning is an unstructured transformation; data lineage controls have nothing to trace. BCBS 239 lineage requirements collapse when data passes through generative reasoning.

The Risk

BCBS 239 and equivalent institutional data governance frameworks require end-to-end lineage: every data element must be traceable from source to final use, with transformations documented and reversible. These frameworks assume data flows through deterministic, schema-aware pipelines: extract, transform, load, query. Each step produces logs and metadata. Agents break this assumption fundamentally. When an agent performs reasoning, it combines data from multiple sources inside a context window, applies non-deterministic transformations (the model itself), and produces outputs that have no traceable relationship to inputs. The lineage chain is severed not at a single weak point but across its entire length.

Lineage controls assume that transformations can be audited after the fact. An agent's internal reasoning is proprietary to the model provider and inaccessible to the institution. Prompt-response logs tell you what went in and what came out, but nothing about how the model decided which data to use, how it weighted conflicting information, or why it produced the specific output. Regulatory auditors and compliance teams cannot reconstruct the reasoning. They cannot verify that the lineage they are required to maintain under BCBS 239 actually exists. The control continues to exist on paper; the underlying reality it documents has vanished.

How It Materializes

A global bank operating under MAS requirements uses agents to reconcile cross-border settlement data. The agent receives feeds from SWIFT, CHIPS, and the institution's nostro accounts, identifies discrepancies through reasoning, and proposes corrections. BCBS 239 requires the bank to maintain lineage for every reconciliation decision, linking each correction back to the specific SWIFT message and nostro transaction it resolved. When the agent completes a reasoning pass, it produces a reconciliation decision but no intermediate steps. The bank logs the decision and the input feeds, but the reasoning itself is inside the model.

Six months later, a correspondent bank disputes a settlement instruction. The auditor requests lineage for the reconciliation decision. The bank can show input data and output decision, but nothing in between. The reconciliation decision cannot be justified to a regulator because the logical chain connecting inputs to outputs is proprietary to the LLM provider and absent from the bank's records. The bank is unable to meet BCBS 239 documentation requirements for a decision made by its own system.

DAMAGE Score Breakdown

Dimension Score Rationale
D - Detectability 3 Absence of lineage is detectable in audit, but often after reconciliation or customer dispute emerges. Intermediate reasoning steps never exist to discover.
A - Autonomy Sensitivity 4 Fully autonomous agents make decisions with no human-in-the-loop logging. Even with oversight, agent's internal reasoning remains opaque.
M - Multiplicative Potential 4 Every agent decision lacking lineage compounds. Downstream decisions built on agent outputs inherit the absent provenance.
A - Attack Surface 3 Prompt injection and reasoning manipulation are possible, but lineage severance is structural, not attack-dependent.
G - Governance Gap 5 BCBS 239 assumes traceable transformations. Agent reasoning is fundamentally untraceable by design. Governance frameworks have no mechanism to address this.
E - Enterprise Impact 4 Audit failures, regulator disputes, inability to defend decisions in disputes or enforcement actions. Systemic impact on trust in settlement and reconciliation.
Composite DAMAGE Score 4.1 Critical. Requires immediate architectural controls. Cannot be accepted.

Agent Impact Profile

How severity changes across the agent architecture spectrum.

Agent Type Impact How This Risk Manifests
Digital Assistant Moderate Even with human review, agent reasoning steps are absent from logs. Human cannot reconstruct how agent arrived at recommendation.
Digital Apprentice Moderate-High Progressive autonomy means less human intervention. Lineage gaps compound as agent makes more independent decisions.
Autonomous Agent High Agent makes decisions independently. No human reasoning to supplement missing agent logs. Lineage is completely severed.
Delegating Agent High When agent delegates to tools, tool calls are logged but agent reasoning that decided which tool to use remains opaque.
Agent Crew / Pipeline Critical Multiple agents in sequence. Each agent severs lineage independently. Output of one agent becomes input to next, with no intermediate documentation.
Agent Mesh / Swarm Critical Agent-to-agent reasoning is invisible to logging infrastructure. No lineage whatsoever across dynamic delegation network.

Regulatory Framework Mapping

Framework Coverage Citation What It Addresses What It Misses
BCBS 239 Complete Principle 5 Requires accurate, timely data and adequate infrastructure for tracking data movements. Does not anticipate unstructured reasoning or non-deterministic transformations without intermediate documentation.
EU AI Act Partial Article 24 (Documentation) Requires high-risk AI systems to maintain documentation of AI system design and performance. Does not require documentation of internal reasoning steps or intermediate decisions within opaque models.
NIST AI RMF 1.0 Partial GOVERN 1.1, MAP 2.1 Recommends transparency and accountability for AI lifecycle and lineage of model development. Does not address runtime reasoning transparency or context window reasoning.
MAS AIRG Partial Appendix 2 (Governance) Requires clear accountability and governance framework with documented decision-making processes. Does not specify technical requirements for lineage of agent reasoning.
ISO 42001 Partial Section 6.1 Addresses information management and knowledge assets tracking. Does not explicitly address LLM reasoning or context window lineage.
GDPR Partial Article 22 (Automated Decision-Making) Requires meaningful information about the logic of automated decisions. Does not define what constitutes adequate documentation when logic is proprietary to model provider.
OWASP Agentic Top 10 Partial LLM05 (Improper Output Handling) Addresses validation of agent outputs. Does not address lineage or traceability of reasoning steps.
NIST CSF 2.0 Partial GOVERN (GV.RO-01) Requires establishing roles and maintaining organizational data structures. Does not address unstructured reasoning lineage.

Why This Matters in Regulated Industries

Lineage is not a policy requirement; it is a regulatory prerequisite for defending decisions in enforcement actions, customer disputes, and third-party audits. When a correspondent bank challenges a settlement correction, or a regulator asks why a loan was rejected, the financial institution must produce the decision logic. Agents produce outputs but not the reasoning. This gap is not an inconvenience; it renders compliance documentation fictitious. The institution maintains lineage records that claim to trace every decision but cannot actually trace decisions made by agents. Regulators in MAS, FCA, Fed, and ECB jurisdictions have begun enforcing documentation standards for automated decision-making. An institution defending an agent-based decision in front of a regulator will be unable to produce the intermediate steps that justify the decision. The penalty is not just a compliance finding; it is loss of credibility in the regulator's assessment of the institution's control environment.

In capital markets and banking, lineage severance creates operational risk as well as compliance risk. When settlement reconciliation agents produce discrepancies, the back office cannot identify root causes because the agent's reasoning is absent. Disputes pile up. Correspondent banking relationships strain. The institution becomes unreliable as a counterparty because it cannot justify its own decisions. This cascades to operational risk ratings and counterparty assessment scores.

Controls & Mitigations

Design-Time Controls

  • Prohibit agents from performing transformations that must be documented under BCBS 239 or equivalent frameworks. Agents may only serve as research or recommendation layers, with final transformations executed through deterministic, logged systems.
  • Implement a "lineage-first" architecture where agents provide structured intermediate outputs (decision nodes, selected sources, reasoning options) rather than direct answers. Require a final deterministic step that links agent output to transformation logic.
  • Use Component 4 (Blast Radius Calculator) to categorize data elements by lineage criticality. Prohibit agents from processing BCBS-critical data without explicit governance approval and compensating controls.
  • Establish a data governance review process that audits agent uses quarterly, examining whether any agent touches data that should be lineage-controlled.

Runtime Controls

  • Require agents to output intermediate reasoning tokens in structured JSON format (sources used, confidence scores, alternatives considered) as part of every response. Log these tokens separately with unique identifiers for every agent interaction.
  • Implement vector store snapshots: capture the exact documents and embeddings an agent retrieved during reasoning. Store snapshots for 7 years alongside decision logs.
  • Use Component 10 (Kill Switch) to halt any agent that produces decisions without structured intermediate outputs. Configure kill switches to activate on detecting unstructured reasoning in high-lineage-impact domains.
  • Attach cryptographic signatures (Component 2) to agent reasoning logs, creating immutable audit trails that model providers cannot alter post-hoc.

Detection & Response

  • Monitor audit logs for decisions lacking intermediate provenance. Flag any agent use in settlement, reconciliation, or credit decisions where lineage documentation is incomplete or missing.
  • Conduct quarterly audits comparing agent-made decisions to lineage records. Sample decisions, attempt to reconstruct reasoning from available logs. Document any reconstruction failures.
  • Create incident response procedures for lineage severance discovery: immediately review all prior decisions by affected agent, notify internal audit and regulators, suspend agent pending redesign.

Related Risks

Address This Risk in Your Institution

Data Lineage Severance requires architectural controls that go beyond what existing frameworks provide. Our advisory engagements are purpose-built for banks, insurers, and financial institutions subject to prudential oversight.

Schedule a Briefing