---
title: "SAFR — Safeguards for Agentic Finance at Runtime — KYE Protocol™ coverage"
description: "SAFR — Safeguards for Agentic Finance at Runtime coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it."
url: https://kyeprotocol.com/compliance/safr/
lang: en
source: "KYE Protocol"
---

> SAFR — Safeguards for Agentic Finance at Runtime coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it.

SAFR — Safeguards for Agentic Finance at Runtime

# SAFR — Safeguards for Agentic Finance at Runtime — 93% of in-scope requirements covered.

14 requirements · 14 in scope (12 enforced · 2 designed). The 93% is weighted over the in-scope base.

**Source:** BuildFin.AI — "Safeguards for Agentic Finance at Runtime" white paper, Version 1.0, July 2026. Industry reference framework developed through financial-industry collaboration, with lineage in MAS Project MindForge Phase 2 (Executive Handbook + Operationalisation Handbook, Singapore FinTech Festival 2025) and the BuildFin.AI implementation-resources work stream. SAFR is a reference approach, not regulatory guidance or a managed service. · **License:** The SAFR white paper is published by BuildFin.AI as an industry reference. The KYE™ registry paraphrases each SAFR requirement's intent and cites the SAFR component / section for crosswalk purposes only; it reproduces no substantial text. Mapping is one-directional (SAFR requirement -> KYE™ artefact) and asserts no endorsement by BuildFin.AI or MAS.

## By category

| Category | Reqs | Enforced | Designed | Advisory | Deferred | Coverage |
| --- | --- | --- | --- | --- | --- | --- |
| Runtime governance at the point of action | 2 | 2 | 0 | 0 | 0 | **100%** |
| Agent identity (SAFR component 1) | 2 | 1 | 1 | 0 | 0 | **75%** |
| Controls repository & mandate (SAFR component 2) | 2 | 2 | 0 | 0 | 0 | **100%** |
| Deterministic disposition (SAFR component 3) | 3 | 2 | 1 | 0 | 0 | **83%** |
| Governance envelope (authenticated evidence) | 1 | 1 | 0 | 0 | 0 | **100%** |
| Immutable audit log (SAFR component 4) | 1 | 1 | 0 | 0 | 0 | **100%** |
| Substantive human escalation | 1 | 1 | 0 | 0 | 0 | **100%** |
| Deployment patterns & scope boundary | 2 | 2 | 0 | 0 | 0 | **100%** |

## Every requirement → the KYE™ artefact that enforces it

| ID | Title | Status | KYE™ enforcement |
| --- | --- | --- | --- |
| `safr.pre-execution-governance` | Every agentic financial action is governed at runtime BEFORE execution — not only at pre-deployment validation and not only in a retrospective audit | enforced | **audit\_events**: `kye.purpose.request.v1`, `kye.purpose.admissibility.v1` **engines**: `internal`, `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `safr.per-step-independent-authority` | In multi-step agentic workflows the control flow applies to each action independently — an Auto-Execute or Observe outcome at one step carries no authority into the next | enforced | **audit\_events**: `kye.purpose.admissibility.v1`, `kye.evidence.decision_map.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `safr.agent-identity-verification` | Every proposed action is bound to a recognised, registered agent whose identity is verified against its registry entry before any other evaluation proceeds | enforced | **audit\_events**: `kye.agent.governance.v1`, `kye.purpose.request.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/52-DELEGATED-AGENT-BINDING.md`, `constitution/00-INDEX.md` |
| `safr.authoritative-registry-resolution` | In open networks the Agent Identity component resolves which registry is authoritative for the action context and retrieves the appropriate identifier accordingly | designed | **audit\_events**: `kye.agent.governance.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/52-DELEGATED-AGENT-BINDING.md` |
| `safr.controls-repository` | A configurable controls repository — drawn from organisational policy, regulatory requirements, product rules, and user-provided authority — is the rulebook every proposed action is checked against | enforced | **audit\_events**: `kye.evidence.decision_map.v1`, `kye.purpose.admissibility.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md`, `constitution/29-PROFILES-LITE.md` |
| `safr.mandate-capability-authority` | User-delegated authority is captured as an explicit, machine-readable mandate (permitted action types, decision logic, escalation conditions, validity period, principal authority); the agent cannot extend the scope of a mandate through its own reasoning | enforced | **audit\_events**: `kye.purpose.request.v1`, `kye.agent.governance.v1` **engines**: `internal` **constitution\_refs**: `constitution/52-DELEGATED-AGENT-BINDING.md`, `constitution/12-PURPOSE-PERMISSION.md` |
| `safr.deterministic-disposition` | The Disposition Engine evaluates each in-scope action deterministically against the retrieved controls and produces a bounded outcome calibrated to the risk the action presents | enforced | **audit\_events**: `kye.evidence.decision_map.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `safr.four-outcome-disposition` | Every proposed action resolves to exactly one of four outcomes — Deny, Escalate, Auto-Execute, or Observe | enforced | **audit\_events**: `kye.evidence.decision_map.v1`, `kye.purpose.admissibility.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `safr.risk-calibrated-outcome` | Outcome assignment is calibrated to the risk profile of the action using factors such as reversibility, financial materiality, customer impact severity, regulatory sensitivity, and novelty/anomaly | designed | **audit\_events**: `kye.evidence.decision_map.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md`, `constitution/25-EDGE-GOVERNANCE.md` |
| `safr.governance-envelope-authenticated` | Each action is packaged in a governance envelope (action + reasoning/action-trace + context metadata) before assessment, and the envelope is authenticated against its origin — not merely treated as a record of what the agent reported | enforced | **audit\_events**: `kye.evidence.tool_call.v1`, `kye.evidence.pack.v1`, `kye.replay.context_seal.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/52-DELEGATED-AGENT-BINDING.md` |
| `safr.immutable-audit-log` | Every governance decision produces an entry in an immutable, tamper-evident, append-only audit log that captures the complete history of every action and every decision, reconstructable without relying on the agent's own account | enforced | **audit\_events**: `kye.evidence.pack.v1`, `kye.replay.proof.v1` **engines**: `internal`, `internal`, `internal` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md`, `constitution/13-RESILIENCE-LOOP.md` |
| `safr.substantive-human-escalation` | Escalation to a human reviewer is substantive rather than nominal — bounded escalation volume, a timeout window that defaults to block or senior escalation on no decision, and reviewers with authority equal to the original agent decision | enforced | **audit\_events**: `kye.purpose.admissibility.v1`, `kye.compliance.attestation.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/36-GOVERNEDUI.md`, `constitution/21-DELEGATED-AUDITABILITY.md` |
| `safr.native-and-gateway-integration` | The governance layer supports both native instrumentation (the agent emits a governance envelope before each action) and gateway interception (a gateway wraps outbound API calls) without requiring changes to agent code | enforced | **audit\_events**: `kye.evidence.tool_call.v1`, `kye.purpose.request.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/16-EDGE-RUNTIME.md`, `constitution/52-DELEGATED-AGENT-BINDING.md` |
| `safr.decision-not-settlement-boundary` | The governance layer governs the DECISION to act — distinct from settlement rails (which move value) and LLM guardrails (which shape model output); these layers are complementary, not interchangeable, and the decision layer operates after content filtering and before execution | enforced | **audit\_events**: `kye.evidence.decision_map.v1` **engines**: `internal` **constitution\_refs**: `constitution/00-INDEX.md`, `constitution/12-PURPOSE-PERMISSION.md` |

Canonical KYE™ surfaces referenced on this page: [KYE Protocol™](https://kyeprotocol.com/).