Your agent is about to hold a credential to a system that holds someone's record.
For agentic AI
Do not ship an agent
without a visa.
A Droplet is the context visa: it clears a passported agent for ONE deployment context, names the tools it may call and the data it may reach, halts the acts that require a human, and expires by default.
Agent Boundary Map
droplet: activeDischarge Summary Agent v2.4.1 — cardiology ward
Art. 6(1) · MDR Rule 11 Class IIa · Art. 14 owner: clinical safety officer · visa expires 30 Sep 2026
Tool-calls inside the visa
Refused at the boundary
An agent does not answer. It acts.
A chatbot produces text a human reads. An agent calls tools, holds credentials, writes to systems, and produces effects nobody sees individually — in a triage queue, a claims file, or a minor’s account. Scan the system, issue the passport, grant the visa: the visa is where the consequence of acting is bounded.
Four live failure modes
Agents already in production — with no visa.
A clinical assistant that can write to the patient record, with no oversight gate and no event log.
With a Droplet
The Droplet grants read-only in one context. Every write halts under AI Act Art. 14 for a named clinician. Every call is recorded under Art. 12 as a signed Evidence Record.
A claims-handling agent retrieving from a corpus that anyone can add a document to.
With a Droplet
The corpus is untrusted input. Integrity is checked and injected instructions are raised as anomalies before the agent acts on them — an injected instruction would otherwise inherit the agent's full data access.
An MCP-enabled agent selecting whichever tool it judges relevant, with no declared list.
With a Droplet
The tool allowlist is declared at grant. Any call outside it is refused, logged as an anomaly, and raised to the CISO. An agent with no declared tools has no boundary to enforce.
An eligibility agent scoring applicants on a model swapped out two quarters ago.
With a Droplet
A model swap reverts the passport's Art. 15 accuracy and Art. 10 bias evidence to unproven and suspends every Droplet granted on it. Under GDPR Art. 22 the decision must remain contestable; on unproven evidence, it is not.
The controls
Four things a visa fixes that a passport cannot.
One context
Cleared for THIS deployment, on THIS data, for THIS population. A second context requires a second visa.
Tool allowlist
Every callable tool declared at grant. Anything else is refused at the call and logged as an anomaly.
Art. 12 event log
Every tool-call a signed, immutable Evidence Record: tool, timestamp, context, action, approval.
Expiry and revocation
Expires by default. Revoked in one action. Drift, a model swap, or a failed diagnostic suspends it automatically.
Human oversight — AI Act Art. 14
The acts that halt for a named human.
Art. 14 requires oversight that is effective: a person able to interpret the output, disregard it, and intervene. A Droplet names which acts halt, who they halt for, and what record the intervention produces. An approve button with nothing behind it is not oversight.
Visa lifecycle
Grant. Gate. Log. Revoke.
Grant
Against an issued Ripple only. One context, one data scope, one tool allowlist, one expiry.
Gate
DPO clears the data scope. CISO clears tools, credentials, and egress. Under seal where consequence is highest.
Log
Every tool-call recorded under Art. 12 as a signed Evidence Record. Anomalies raised in real time.
Revoke
One action withdraws the visa. The agent halts at its next call, and the withdrawal is recorded.
The difference
Agents in production — with and without a visa.
Without a Droplet
- Cleared once, everywhere — the context was never named
- Tool selection left to the model at runtime
- Tool-calls unlogged — the act cannot be reconstructed
- The RAG corpus trusted as content, not treated as instruction
- Oversight is an approve button with no basis to disagree
- No expiry, and no way to stop the agent without shipping code
With a Droplet
- One visa per context — a new population needs a new grant
- Tool allowlist declared at grant; anything else refused and logged
- Every call a signed Evidence Record under AI Act Art. 12
- Corpus integrity checked; injected instructions raised as anomalies
- Art. 14 gates halt the act for a named human who can override
- Expires by default; revoked in one action, effective at the next call
Addressed
Agent governance — the four objections we hear.
“The agent already has a Ripple. Why grant a Droplet as well?”
A passport says what a system is. A visa says where it may operate. An assistant passported for adult emergency intake holds no clearance for paediatric intake — the population changed, so the evidence no longer covers the deployment. The passport is untouched; the visa must be granted afresh, or refused.
“Our agents are internal tools, not vendor products.”
Internal agents typically hold more access, not less: production credentials, patient and customer records, write paths into core systems. And there is no procurement counterparty forcing the evidence. A Droplet restores the gate that the absence of a purchase order removed.
“It is a prototype. Governance can wait until production.”
A prototype with a live credential is a production agent with no owner. If it wrote to a clinical record last Tuesday and the calls were not logged, no governance added afterwards can reconstruct what it did.
“We already monitor agents with an observability stack.”
Observability records what happened. A visa states what was authorised, in which context, under which conditions, until when — and permits revocation before the next act rather than analysis after it. Under Art. 12 the log is necessary. Under Art. 14 it is nowhere near sufficient.
Step 3 — the visa
Grant the visa
before the agent acts.
One context. One data scope. One tool allowlist. One expiry date. Nothing else stands between a passported agent and an act nobody cleared.
AffectLog provides technical and operational evidence to support AI access, supplier-risk, security, privacy, and governance review. Not legal advice, certification, notified-body conformity assessment, or regulatory approval.