AI Developers In London: Turning October's UK Agent Policy Into An Agent Register And Decision Records

"""An agent registry shaped by the ICO's agentic AI call for evidence (8 October 2026) and the NCSC's
five risk dimensions for automated actions (21 September 2026).

Each agent is registered with an owner, a purpose, a lawful basis, its tools and the authority it acts
under. Each tool grant carries an NCSC-style score. The mapping from scores to controls at the bottom is
our example policy, not an NCSC rule: the NCSC blog does not combine the five scores into one rating.

Standard library only. Tested on Python 3.14.4 and 3.11.14 with mypy --strict.
"""

from __future__ import annotations

from dataclasses import dataclass, replace
from datetime import date
from typing import Literal

Control = Literal["run", "run_with_monitoring", "approve_each_action", "do_not_automate"]

# NCSC, "One does not simply defend agentically", 21 September 2026: Potency levels, quoted.
POTENCY = {
    0: "AI provided data and then outputs explainable advice to a human",
    1: "AI provides non-explainable advice to a human",
    2: "Autonomously collects data using read-only privileges across APIs and web search",
    3: "Changes data or system state via APIs (Easier to guardrail than code)",
    4: "Executes code or makes direct system/runtime changes",
}


@dataclass(frozen=True)
class NcscScore:
    """0 to 4 on each NCSC dimension. Higher means riskier, including a higher (weaker) rollout score."""

    potency: int
    scope: int
    criticality: int
    rollout_confidence: int
    recoverability: int

    def __post_init__(self) -> None:
        for name, value in vars(self).items():
            if not 0 <= value <= 4:
                raise ValueError(f"{name} must be 0-4, got {value}")


def required_control(s: NcscScore) -> Control:
    """Example policy only. Tune it with your risk and compliance teams."""
    if s.criticality == 4 and s.recoverability == 4 and s.potency >= 3:
        return "do_not_automate"
    if max(s.potency, s.criticality, s.recoverability, s.rollout_confidence) >= 3:
        return "approve_each_action"
    if s.potency <= 1:
        return "run"
    return "run_with_monitoring"


@dataclass(frozen=True)
class ToolGrant:
    tool: str
    access: Literal["read", "write"]
    score: NcscScore


@dataclass(frozen=True)
class AgentRecord:
    agent_id: str  # the agent's own non-human identity
    owner: str  # a named person
    purpose: str
    lawful_basis: str
    data_categories: tuple[str, ...]
    tools: tuple[ToolGrant, ...]
    delegated_by: str  # whose authority the agent acts under
    authority_expires: date
    related_agents: tuple[str, ...] = ()


class AgentRegistry:
    def __init__(self) -> None:
        self._agents: dict[str, AgentRecord] = {}

    def register(self, record: AgentRecord) -> dict[str, Control]:
        if not record.owner or not record.purpose or not record.lawful_basis:
            raise ValueError(f"{record.agent_id}: owner, purpose and lawful basis are required")
        controls = {g.tool: required_control(g.score) for g in record.tools}
        blocked = sorted(t for t, c in controls.items() if c == "do_not_automate")
        if blocked:
            raise PermissionError(f"{record.agent_id}: remove {', '.join(blocked)} or keep them manual")
        self._agents[record.agent_id] = record
        return controls

    def authorise(self, agent_id: str, tool: str, today: date) -> Control:
        """Runtime check before every tool call: unknown agent, expired authority or ungranted tool fails."""
        record = self._agents.get(agent_id)
        if record is None:
            raise PermissionError(f"{agent_id} is not registered")
        if today > record.authority_expires:
            raise PermissionError(f"{agent_id}: delegated authority expired on {record.authority_expires}")
        grant = next((g for g in record.tools if g.tool == tool), None)
        if grant is None:
            raise PermissionError(f"{agent_id} has no grant for {tool}")
        return required_control(grant.score)


if __name__ == "__main__":
    registry = AgentRegistry()
    kyc_agent = AgentRecord(
        agent_id="agent:kyc-file-prep-01",
        owner="Head of Client Onboarding",
        purpose="Prepare onboarding files: check documents are present, legible, in date and consistent",
        lawful_basis="Legal obligation (Money Laundering Regulations 2017), customer due diligence",
        data_categories=("identity documents", "proof of address", "screening results"),
        tools=(
            ToolGrant("read_documents", "read", NcscScore(2, 0, 2, 1, 0)),
            ToolGrant("draft_document_request", "read", NcscScore(0, 0, 1, 1, 0)),
            ToolGrant("send_document_request", "write", NcscScore(3, 0, 1, 2, 4)),
        ),
        delegated_by="Onboarding team (process owner)",
        authority_expires=date(2027, 3, 31),
    )
    for tool, control in registry.register(kyc_agent).items():
        print(f"{tool:<24} {control}")
    risky = replace(kyc_agent, agent_id="agent:kyc-closer-01",
                    tools=kyc_agent.tools + (ToolGrant("close_account", "write", NcscScore(3, 1, 4, 2, 4)),))
    try:
        registry.register(risky)
    except PermissionError as exc:
        print("refused:", exc)
    print("authorise send:", registry.authorise("agent:kyc-file-prep-01", "send_document_request", date(2026, 10, 15)))
    for agent, tool in [("agent:kyc-file-prep-01", "close_account"), ("agent:unknown", "read_documents")]:
        try:
            registry.authorise(agent, tool, date(2026, 10, 15))
        except PermissionError as exc:
            print("refused:", exc)
    print("potency 3 means:", POTENCY[3])

Tested on Python 3.14.4 and 3.11.14 with mypy 2.4.0 --strict. The score-to-control mapping is an example policy.

"""Tamper-evident decision records that can answer the ICO's reconstruction questions: which agent was
involved, what authority it was operating under, what systems or data it accessed, and whether any human
involvement was meaningful (ICO agentic AI call for evidence, Theme 4, 8 October 2026).

Records are append-only JSON lines, each chained to the previous record's hash. verify() recomputes the
chain so an edited or deleted record is detected. The 'meaningful review' check is an illustrative
heuristic, not a legal test.

Standard library only. Tested on Python 3.14.4 and 3.11.14 with mypy --strict.
"""

from __future__ import annotations

import hashlib
import json
from dataclasses import asdict, dataclass
from pathlib import Path

GENESIS = "0" * 64


@dataclass(frozen=True)
class DecisionRecord:
    decision_id: str
    agent_id: str
    asked_to: str  # the task the agent was given
    authority: str  # whose delegated authority it acted under
    data_accessed: tuple[str, ...]  # system and record references, not the data itself
    tools_used: tuple[str, ...]
    agent_output: str
    reviewer: str | None
    reviewer_could_change_outcome: bool
    evidence_shown_to_reviewer: bool
    review_seconds: int
    outcome: str
    subject_informed: bool  # UK GDPR Art 22C safeguards, where the decision is about a person
    representation_route: str  # how the person can make representations, get human intervention and contest


def meaningful_review(r: DecisionRecord, minimum_seconds: int = 30) -> bool:
    """Illustrative only: a named reviewer, with power to change the outcome, who saw the evidence."""
    return (r.reviewer is not None and r.reviewer_could_change_outcome
            and r.evidence_shown_to_reviewer and r.review_seconds >= minimum_seconds)


def _hash(body: dict[str, object]) -> str:
    return hashlib.sha256(json.dumps(body, sort_keys=True).encode()).hexdigest()


def append(log: Path, record: DecisionRecord) -> str:
    lines = log.read_text().splitlines() if log.exists() else []
    prev = json.loads(lines[-1])["hash"] if lines else GENESIS
    body: dict[str, object] = {"record": asdict(record), "prev": prev}
    digest = _hash(body)
    with log.open("a", encoding="utf-8") as fh:
        fh.write(json.dumps({**body, "hash": digest}) + "\n")
    return digest


def verify(log: Path) -> list[str]:
    problems: list[str] = []
    prev = GENESIS
    for n, line in enumerate(log.read_text().splitlines(), start=1):
        entry = json.loads(line)
        body = {"record": entry["record"], "prev": entry["prev"]}
        if entry["prev"] != prev:
            problems.append(f"line {n}: chain broken (record removed or reordered)")
        if _hash(body) != entry["hash"]:
            problems.append(f"line {n}: content changed after it was written")
        prev = entry["hash"]
    return problems


def reconstruct(log: Path, decision_id: str) -> str:
    for line in log.read_text().splitlines():
        r = json.loads(line)["record"]
        if r["decision_id"] == decision_id:
            rec = DecisionRecord(**{**r, "data_accessed": tuple(r["data_accessed"]),
                                    "tools_used": tuple(r["tools_used"])})
            return (f"{decision_id}: agent {rec.agent_id} was asked to {rec.asked_to}, under the authority of "
                    f"{rec.authority}. It accessed {', '.join(rec.data_accessed)} using "
                    f"{', '.join(rec.tools_used)}. Reviewer: {rec.reviewer}. "
                    f"Meaningful review: {meaningful_review(rec)}. Outcome: {rec.outcome}.")
    raise LookupError(decision_id)


if __name__ == "__main__":
    log = Path("decisions.jsonl")
    log.unlink(missing_ok=True)
    def kyc_check(decision_id: str, client: str, data: tuple[str, ...], output: str,
                  evidence_shown: bool, seconds: int, outcome: str) -> DecisionRecord:
        return DecisionRecord(
            decision_id=decision_id, agent_id="agent:kyc-file-prep-01",
            asked_to=f"check the onboarding file for client {client}",
            authority="Onboarding team (process owner)", data_accessed=data,
            tools_used=("read_documents", "draft_document_request"), agent_output=output,
            reviewer="a.khan", reviewer_could_change_outcome=True, evidence_shown_to_reviewer=evidence_shown,
            review_seconds=seconds, outcome=outcome, subject_informed=True,
            representation_route="Client services team, by email or phone")

    append(log, kyc_check("D-0001", "C-1042", ("dms://onboarding/C-1042/passport", "crm://clients/C-1042"),
                          "Proof of address older than 3 months", True, 95, "request new proof of address"))
    append(log, kyc_check("D-0002", "C-1043", ("dms://onboarding/C-1043/passport",),
                          "File complete", False, 4, "file marked complete"))
    print(reconstruct(log, "D-0001"))
    print(reconstruct(log, "D-0002"))
    print("verify clean log:", verify(log) or "ok")
    lines = log.read_text().splitlines()
    log.write_text(lines[0].replace("95", "300") + "\n" + lines[1] + "\n")  # someone edits a record
    print("verify after edit:", verify(log))

Tested on Python 3.14.4 and 3.11.14 with mypy 2.4.0 --strict. The meaningful review test is illustrative, not a legal test.