1 in 5
Only one in five companies has a mature governance model for autonomous AI agents, while agentic deployment accelerates across every business line.
For CROs, CISOs, and Heads of Model Risk
Your data science teams are deploying AI agents faster than you can govern them.
Regulators just made that your problem. The revised interagency model risk guidance leaves generative and agentic AI out of scope, but examiners will still judge your controls. We close that gap. Not with policy documents. With running controls, audit trails, and evidence.
20+ years of risk and controls transformation at Citi and Wells Fargo. Hands-on with the automation stack: n8n, MCP, self-hosted infrastructure.
Every agent action. Logged. Controlled. Examiner-ready.
Experience across
- HCAHealthcare
- Wells Fargo
- Citi
- AIG
- UPS
- Stanford
Supervisory context / mid-2026
Governance moved from principles to enforcement. Most institutions did not.
SR 26-2
The April 2026 revised interagency model risk guidance explicitly excludes generative and agentic AI from scope. Your governance practices must fill the gap. Examiners will ask how.
54%
Of IT leaders now rank AI governance as a top enterprise risk priority, up from 29% two years ago. Boards are asking for evidence, not intentions.
Policy binders do not survive examinations. Controls do. The question your board will ask is simple: where are our agents running, what can they do, and can we prove it?
Engagements
Three steps. Each one stands on its own. Each one earns the next.
01
AI Agent Risk & Controls Assessment
A complete picture of your AI and agent exposure, delivered in the language your examiners and audit committee speak.
- Inventory of AI and agent usage across the institution, including shadow AI
- Risk classification of every use case, mapped to NIST AI RMF, ISO/IEC 42001, and your existing model risk tiering
- Gap analysis against post-SR 26-2 supervisory expectations
- 90-day remediation roadmap with one workflow selected for a governed rebuild
02
Governed Build
We take one high-value agent workflow and rebuild it with the controls inside, not bolted on. Human approval gates, policy checks, PII masking, full audit trail, monitoring, and a model registry entry. Built on infrastructure you own and can inspect: n8n, MCP, your cloud or ours.
- One production agent workflow, governed end to end
- Control documentation your second line can test
- Evidence pipeline: every prompt, tool call, and decision captured
- Handover to your team, no vendor lock-in
03
Fractional AI Risk Leadership
Senior AI governance leadership without the full-time hire. Standing agent inventory reviews, control testing cadence, board and examiner preparation, and vendor AI due diligence. The function, before you build the department.
- Quarterly board-ready AI risk reporting
- Examination and audit response support
- Third-party AI due diligence framework
- Governance operating model your team runs after we leave
Method
The Agent Control Framework
Five stages, in order, because each depends on the last. Mapped to NIST AI RMF and the model risk principles your institution already runs. No new bureaucracy. An extension of the framework your examiners already trust.
-
1 Inventory
Find every model, agent, and LLM touchpoint, sanctioned or shadow. You cannot govern what you cannot see.
Maps to: NIST AI RMF “Map” · model inventory expectations
-
2 Classify
Tier every use case by materiality and exposure, the same risk-based logic as SR 11-7. A drafting assistant is not a credit decision agent.
Maps to: NIST AI RMF “Measure” · risk tiering
-
3 Control
Embed the controls in the workflow itself: approval gates, data masking, scope limits, kill switches. Controls that execute, not controls that exist on paper.
Maps to: NIST AI RMF “Manage” · first-line controls
-
4 Evidence
Capture every prompt, tool call, and decision in an audit trail your second line can test and your examiner can read.
Maps to: audit and effective-challenge expectations
-
5 Oversee
Standing review cadence, drift and incident monitoring, board reporting. Governance as an operating rhythm, not a one-time project.
Maps to: NIST AI RMF “Govern” · ongoing monitoring
Tools & resources
Practical tools you can use in the next five minutes.
Built from the same framework we deploy in engagements. Free, immediate, and computed in your browser. No sign-up.
Interactive
AI Agent Risk Tier Classifier
Describe an agent use case across four dimensions. Get an indicative risk tier mapped to NIST AI RMF, plus the technical controls that use case needs to pass an examination.
Classify a use caseInteractive
Governance Readiness Check
Ten questions across the five control domains. A scored readiness tier, your weakest domain, and the first three gaps to close before an examiner asks.
Run the readiness checkInteractive Demo
Agent Evidence Ledger
The black box recorder for regulated agents. Capture who authorized an action, what it decided, and whether it matched policy, as tamper-evident, hash-linked records. Query the trail, simulate tampering, and export an examiner-ready evidence package. Seeded with synthetic records for demonstration.
Open the ledgerDownload · PDF
Board Briefing Deck
An editable board-ready briefing: Governance & Control Architecture for Agentic AI. The exposure gap, the five-stage framework, the questions your board will ask, and a tactical roadmap.
Download the deckThese tools provide indicative, general information to support internal discussion. They are not a substitute for a formal AI risk assessment, nor legal, regulatory, or compliance advice. Tier logic and control lists reflect Synopra's current view and may change.
Track record
Controls and delivery, at institutions where both are non-negotiable.
+40%
Controls testing coverage
Engineered the AI/ML automation strategy and execution for an enterprise-wide Risk Controls Self-Assessment (RCSA) transformation at a top-4 US bank, increasing controls testing coverage by 40% across business-critical applications in a highly regulated environment.
Wells Fargo · Strategy & Program
85%
SLA compliance
Led ITIL service governance across 135+ global payment platforms, driving SLA compliance to 85% while maintaining strong system availability in strict regulatory markets.
Citi · Treasury & Trade Solutions
76
Executive dashboards standardized
Standardized and automated cross-functional performance and delivery reporting for Fortune 100 clients including a major national healthcare system, giving C-suite stakeholders defensible metrics for capital planning and risk.
Launch by NTT DATA · Fortune 100 clients
270+
Technology leaders trained
Designed and delivered executive workshops on scalable IT governance at Stanford University for over 270 technology and business leaders. Featured as an expert panelist on AI leadership at UC Berkeley, engaging senior product and engineering executives across Fortune 100 technology, financial services, and healthcare enterprises.
Stanford University · UC Berkeley
Detailed engagement references available on request.
Principal
Martin Vonderheiden
Most of the market is split between slide-deck strategists and pure developers. I sit in the middle, on purpose.
I’ve spent 20+ years directing risk, controls, and technology transformation at the intersection of the world’s most complex, regulated industries—leading enterprise programs at Citi, Wells Fargo, AIG, and HCA Healthcare.
I’m also an active, hands-on practitioner of AI-native development. I design, build, and run governed agent workflows myself on self-hosted n8n and Model Context Protocol (MCP) infrastructure. Because I actually build the systems, I understand the real-world operational cost and technical reality of the controls I write. This bridge between executive-level product strategy and technical execution is where AI governance becomes practical.
I have advised on AI leadership at UC Berkeley Haas School and have led workshops at Stanford on technology governance frameworks used by 270+ Silicon Valley leaders and professionals. I work in English and German, aligning enterprise AI delivery with both US and EU regulatory frameworks.
MS Industrial Engineering & Business, RPTU Kaiserslautern
Would your agent governance survive an examination?
Ten questions. Three minutes. A scored readiness tier across the five control domains, and the three gaps to close first.
Contact
Start with a 30-minute governance briefing.
No pitch. A walkthrough of the current supervisory landscape for agentic AI and the three questions your board will ask this year. If it is useful, we talk about next steps. If not, you keep the briefing.