Agentic AI in financial operations: build the control framework before the autonomy
Banks are piloting AI agents that act, not just answer. The institutions that will scale them safely are designing supervision, limits, and audit into the system now — the way they already do for human traders.
The first generation of AI in banking answered questions. The generation now entering pilots takes actions: reconciling breaks, drafting and routing payments for approval, triaging disputes, opening and closing cases across systems that were never designed to be driven by software. The industry has started calling these systems agents, and the name is apt in a way most vendors do not intend — because finance already knows exactly how to manage agents. It has been doing it, for human ones, for a century.
That existing discipline — mandates, limits, dual control, supervision, audit — is the most useful frame we have for agentic AI, and it is strikingly absent from most pilots we review.
Autonomy is a limit structure, not a capability
A junior trader does not receive the firm’s full balance sheet on day one. They receive a mandate: instruments they may touch, sizes they may deal in, counterparties they may face, and escalation rules for everything else. Autonomy is earned by evidence and widened deliberately.
AI agents deserve the same treatment, mechanically enforced. That means hard, system-level limits on what an agent can execute without a human in the loop — by transaction value, by data classification, by reversibility. It means separating the agent that proposes from the system that approves, so that a compromised or confused model cannot both decide and act. And it means the limits live outside the model, in infrastructure the model cannot talk its way around.
The audit trail is the product
When a regulator, an auditor, or your own operational-risk team asks why the agent did what it did, “the model decided” is not an answer. Every action needs a reconstructable trail: the inputs the agent saw, the tools it called, the intermediate reasoning it recorded, the human approvals it received. This is not an overlay to add before the audit. It is the core engineering artifact, and retrofitting it is vastly more expensive than designing for it.
Our research work on explainable models points to a practical truth here: explainability that satisfies a data scientist rarely satisfies a supervisor. The explanation has to be legible at the level of the business action — this payment, this customer, this decision — not at the level of feature attributions.
Security inherits everything
An agent with credentials to your core systems is, from an attacker’s perspective, a privileged employee who works at machine speed, never sleeps, and can be socially engineered through its inputs. Prompt injection is not a curiosity; it is the phishing of this architecture. The security perimeter must assume the agent will occasionally be wrong or manipulated, and make the blast radius survivable: least-privilege credentials, egress controls, anomaly detection on the agent’s own behavior.
What to do about it
Pick one process where the agent’s worst day is cheap — internal reconciliation, not customer payments. Write the mandate first, as if onboarding a new employee: permitted actions, hard limits, escalation triggers, supervision cadence. Instrument everything. Then widen autonomy only as the evidence accumulates. The institutions that scale agentic AI will not be the ones that moved first; they will be the ones whose control frameworks let them keep moving after the first incident.