A passport says what the system is. It does not say where it may operate.
Droplets - step 3 of 3
Grant the visa.
One context. Time-bound.
A Droplet is the context visa: clearance for one passported AI system to operate in ONE deployment context, on THIS data, under stated conditions - expiring by default.
Agent Boundary Map
droplet: activeDischarge Summary Agent v2.4.1 - cardiology ward
Art. 6(1) · MDR Rule 11 Class IIa · Art. 14 owner: clinical safety officer · visa expires 30 Sep 2026
Tool-calls inside the visa
Refused at the boundary
A passport is not permission to enter.
Scan the system. Issue the passport. Grant the visa. The visa is the step where consequence attaches: it names the one context the system may operate in, the data it may reach there, the actions that halt for a human, and the date the clearance dies. A system that acts - an agent, a copilot, a retrieval assistant - cannot be governed by a passport alone.
When a visa is mandatory
Six acts that require a Droplet before the first call.
The agent reads a clinical record
Art. 9 data. DPO gate at grant. Read-only credential, no egress.
The agent writes to a core system
Write scope must be named in the visa. CISO gate. Default is read-only.
The agent retrieves from a RAG corpus
The corpus is untrusted input. Injected instructions inherit the agent's access.
The agent scores a credit application
GDPR Art. 22. Contestability and human review must exist before the decision lands.
The agent can be reached by a minor
GDPR Art. 8 · DSA Art. 28. Oversight gate, no profiling, hard expiry.
The agent calls an external API
Egress boundary declared. Under DORA, the third-party dependency is registered.
What a visa closes
Four conditions that mean the agent is operating unlawfully in practice.
An agent operating in a context nobody cleared.
A Droplet clears ONE context. A triage assistant validated for adult emergency intake holds no visa for paediatric intake - the population changed, so the clearance does not carry.
An agent that decides for itself which tool to call.
The tool allowlist is declared at grant and recorded with the visa - the boundary your deployment is held to. An MCP-enabled agent with no declared tool list is an agent with no boundary.
An agent whose tool-calls were never recorded.
AI Act Art. 12 requires automatic recording of events over the system's lifetime. The Droplet records that this logging is a condition of the grant, and who is accountable for it.
Clearance that never expires.
Every Droplet expires by default. Renewal is a new decision on current evidence - drift, a model change, or a failed check is a reason not to renew.
Inside the visa
Ten fields. One context. One expiry date.
A Droplet answers one question: may this system operate HERE, on THIS data, under WHAT conditions - and until when?
The passport it is granted against
No Ripple, no Droplet. A visa is never granted to an unpassported system.
The single context it clears
One deployment, one population, one purpose. A second context requires a second visa.
Data scope
Exactly which categories may be reached - Art. 9 health, Art. 8 minors' data, financial profiling.
Tool allowlist
Every tool the agent may call, declared at grant. A call outside the list breaches the visa's conditions.
Systems and endpoints
Which internal systems may be reached, and whether the credential is read or write.
Egress boundary
What may cross the perimeter. RAG corpora and retrieved documents are treated as untrusted input.
Human oversight gates
Which actions halt for a named human - AI Act Art. 14 oversight that can actually intervene.
Event logging
The AI Act Art. 12 event logging the deployment must keep, recorded as a condition of the visa.
Expiry
Every visa expires. There is no indefinite clearance and no silent renewal.
Revocation authority
The named person accountable for the grant, and for withdrawing the clearance in the deploying system.
Human oversight - AI Act Art. 14
Oversight that can actually stop the action.
Art. 14 requires oversight that is effective - a named person able to interpret the output, disregard it, and intervene. A Droplet names the acts that halt, the person they halt for, and the record the halt produces. A reviewer with only an approve button is not oversight.
Event logging - AI Act Art. 12
Every tool-call becomes an Evidence Record.
Recorded and reconstructable after the fact: what the agent called, with what context, what it received, and whether a human cleared it. An unlogged tool-call is an act that cannot be defended - to a supervisory authority or to the person it affected.
Visa lifecycle
Grant. Gate. Log. Expire.
Grant
Against an issued Ripple only. One context, one data scope, one tool allowlist, one expiry date.
Gate
DPO clears the data scope; CISO clears the tools, credentials, and egress. Under seal for the highest-consequence contexts.
Log
Art. 12 event logging recorded as a condition of the visa, with an accountable owner.
Expire
Every visa expires by default. Renewal is a new decision, recorded with actor, role, and time.
The difference
Agents in production - with and without a visa.
Without a Droplet
- Cleared once, everywhere - context never named
- Tool selection left to the model at runtime
- Tool-calls unlogged - the act cannot be reconstructed
- RAG corpus trusted as content, not treated as instruction
- Oversight is an approve button with nothing behind it
- No expiry, and no way to revoke without shipping code
With a Droplet
- One visa per context - a new population needs a new grant
- Tool allowlist declared at grant and recorded with the visa
- Art. 12 logging named as a condition of the grant
- Corpus integrity named as evidence the grant depends on
- Art. 14 gates halt the act for a named human who can disagree
- Expires by default; renewal is a recorded decision
Addressed
Droplets - the four objections we hear.
“The agent already has a Ripple. Why does it need a Droplet?”
A passport says what a system IS and what is proven about it. A visa says WHERE it may operate. The same triage model, correctly passported, is cleared for adult emergency intake and not for paediatric intake - because the population it was validated on changed. The passport is unchanged; the visa must be granted separately, or refused.
“Our agents are internal. They are not vendor products.”
Internal agents typically hold more access, not less: production credentials, employee and customer records, write paths into core systems. The absence of a procurement counterparty removes the only party that would otherwise have forced the evidence. A Droplet restores that gate.
“We already monitor agents with an observability stack.”
Observability records what an agent did. A visa states what it was authorised to do, in which context, under which conditions, until when - decided before the action rather than analysed after it. Under Art. 12 the log is necessary; under Art. 14 it is not sufficient.
“The agent is experimental. Governance can wait.”
An experimental agent with a live credential is a production agent with no owner. The cost of granting a visa is minutes. The cost of reconstructing, after an incident, what an unlogged agent did to a patient record or a loan book is not measured in minutes.
Step 3 - the visa
Grant the visa
before the agent acts.
One context. One data scope. One tool allowlist. One expiry date. A Droplet is the only thing standing between a passported system and an act nobody cleared.
AffectLog provides technical and operational evidence to support AI access decisions. Not legal advice, certification, notified-body conformity assessment, or regulatory approval.