THE MANDATE
A regulator asks your Chief Data Officer one question: "Show me every AI system making decisions in this bank, who owns each one, and who is empowered to shut it down." The room goes quiet. That silence is a governance failure — and this module is how you make sure it never happens to you.
You've trained excellent operators.
You have no operating model.
Six modules made individuals good at briefing, verifying, recording, operating, observing, and challenging AI. But personal excellence doesn't survive an org chart. The moment there are fifty operators and two hundred workloads, you need something individuals can't provide: an institutional mandate.
The operating model banks already trust.
Three lines of defence — applied to AI.
You don't need to invent AI governance. You need to map AI onto the model your institution already runs. Tap each line to see its role, the module that delivers it, and what breaks when it's missing.
The Model Bill of Materials.
Triage the portfolio. No owner, no tokens.
Here is the enterprise AI register — every workload, its owner, tier, and charter status. Three rows are shadow AI: running in production with no owner and no charter. For each, make the call: register & charter it, or decommission it. The rule is the mandate.
The Token Strategy Charter.
The gate every workload passes before it ships.
A new agent wants to go live. Before it gets a single token, it must present a complete Charter — signed by the business owner and risk, not engineering. Assemble the six mandatory elements; miss one and the gate stays shut.
Checkpoint one.
Register and rule.
Two questions on the operating model so far. The reasoning comes either way.
TRAM — the risk appetite matrix.
The cell dictates the controls.
Not every workload deserves the same governance. The Token Risk Appetite Matrix places each one by cost-variance tolerance and output-variance tolerance — and the cell it lands in mandates the model tier, agentic depth, and review topology. Tap each cell to see what it permits.
Translate the model into the board's language.
And onto the regulator's clock.
A board doesn't want token counts. It wants two answers: are we compliant, and who is accountable. Your operating model maps cleanly onto every framework that matters — and the EU AI Act's obligations are already on a countdown.
GPAI & GOVERNANCE OBLIGATIONS · 2 AUG 2026
Checkpoint two.
Risk and accountability.
The last two questions of the program.
A mandate without enforcement is a memo.
Three workloads are in violation. Rule.
The operating model only means something if breaching it has consequences. Here are three real violations. For each, choose the enforcement action the mandate requires — the answer isn't always the harshest one.
You've written the mandate.
Now here's the platform that enforces it.
All seven modules complete. You can brief, countersign, record, operate, observe, challenge — and now govern the whole function. That is the full arc from a single prompt to an institutional mandate.
AgentPMO is the platform that runs this at scale: a live MBOM of every agent, the Charter as a registration gate, TRAM-driven controls, and a compliance clock counting down to the EU AI Act. The mandate, operationalised.