Agentic AI Risk Controls: Setting Boundaries for Autonomous Actions in Financial Services
Updated: Sep 22
Agentic AI is changing the risk profile of artificial intelligence in financial services by moving beyond systems that generate information or predictions toward systems that can use tools, make decisions, and execute actions with limited human intervention. The resulting risks are not limited to the accuracy of an AI model. They can also involve authorization, access, transaction execution, data security, operational resilience, consumer impact, third-party dependencies, and the potential for errors to propagate across interconnected systems.
The governance challenge is therefore not simply to determine whether an agent produces accurate outputs. Financial institutions need to establish clear boundaries around what an agent is permitted to do, determine when human intervention is appropriate, and implement controls that are proportionate to the system's autonomy, authority, use, and potential impact.
SR 26-2, the interagency Revised Guidance on Model Risk Management issued April 17, 2026, provides an important point of reference for model risk management but does not cover generative AI or agentic AI models. The guidance is nonbinding and risk-based, and its principles should not be treated as a universal framework for governing autonomous systems. Instead, institutions should consider how existing risk-management, technology, cybersecurity, compliance, third-party, and governance frameworks can be applied to the specific risks created by agentic AI.
This article examines a practical framework for establishing boundaries around autonomous actions, assigning accountability, implementing operational guardrails, and providing management and the Board with meaningful oversight of agentic AI risk.
Table of Contents
Understanding the Risk of Agentic AI
The first step in developing effective agentic AI risk controls is to recognize how these systems differ from traditional models and generative AI. While related, their ability to take action introduces a fundamentally different risk profile that extends beyond informational accuracy into the realm of operational execution.
Agentic AI vs. Generative AI and Traditional Models
Traditional predictive models and generative AI systems primarily produce informational outputs. A credit underwriting model produces a risk score; a marketing AI generates email copy; a chatbot provides a customer with an account balance. The risk, while significant, is centered on the quality, accuracy, and fairness of that information.
Agentic AI, in contrast, is defined by its capacity for autonomous action. These systems are designed to pursue objectives by performing a sequence of tasks, often using other software tools or APIs. In practical terms, an agentic system might:
Receive a customer request to dispute a transaction.
Access internal systems to retrieve transaction details.
Analyze the details against predefined dispute criteria.
Initiate a provisional credit to the customer’s account.
Generate and send a notification to the customer.
This multi-step, tool-using capability distinguishes agentic AI. The system is not just providing an answer; it is executing a business process with limited, or in some cases no, direct human intervention for each step.
From Model Output to Autonomous Action
The transition from generating information to executing actions fundamentally alters the risk equation. An inaccurate output from a traditional model creates the potential for a poor human decision. An erroneous action by an autonomous agent creates an immediate operational event. This shift introduces several new risk considerations:
Delegation Risk: The institution is delegating a degree of decision-making authority to a non-human agent. This creates a direct risk of unauthorized or incorrect transactions, data modifications, or customer communications.
Compounding Errors: In a multi-step process, a small error in an early step can be amplified as the agent proceeds. An incorrect data retrieval could lead to a flawed analysis, resulting in an improper financial transaction.
Velocity of Impact: Autonomous agents can execute actions at a speed and scale that is impossible for human teams. A flawed process could result in thousands of incorrect actions before a human has the opportunity to detect and intervene.
A Broader Risk-Management Challenge
Because agentic AI executes tasks, its risk profile implicates multiple, established risk domains across the enterprise. It is not a self-contained "AI risk" but a new vector for existing risks. Effective governance requires a cross-functional approach that recognizes these connections:
Operational Risk: The potential for direct financial loss, process failure, or business disruption resulting from an agent's actions.
Compliance Risk: The risk that an agent’s actions violate consumer protection laws (e.g., UDAAP, Fair Lending), BSA/AML requirements, or other regulations.
Technology and Cybersecurity Risk: The risk of an agent’s credentials being compromised or the agent being manipulated to perform unauthorized actions.
Third-Party Risk: The risk introduced when an agent relies on external tools, data sources, or APIs provided by vendors.
Treating agentic AI solely as a model risk management challenge is insufficient. A comprehensive governance framework must integrate these interconnected risk disciplines to establish durable and effective controls.
Establishing Delegated Authority and Human Oversight
Controlling agentic AI is less about validating a single algorithm and more about managing a digital workforce. This requires a formal "delegated authority" framework that treats each agent like a high-risk employee, with defined job functions, clear limitations, and appropriate levels of supervision.
Defining Use Cases and Authority Boundaries
Before an agent is deployed, its purpose and boundaries must be explicitly defined and documented. This is not a technical exercise but a business and risk decision. Management should approve a "charter" for each agent that specifies:
Permitted Activities: A precise list of the tasks the agent is authorized to perform (e.g., read customer data, initiate payments, send communications).
Prohibited Activities: An explicit list of actions the agent is forbidden from taking (e.g., closing accounts, approving loans above a certain threshold, altering system-level configurations).
Value and Volume Thresholds: Concrete limits on the agent’s authority, such as the maximum value of a transaction it can process or the number of actions it can take in a given period.
These boundaries should be codified as deterministic rules that operate independently of the agent’s own logic, ensuring they cannot be overridden by the agent itself.
Risk-Based Human Oversight
The level of human oversight should be proportionate to the risk of the agent’s activities. A one-size-fits-all approach is inefficient and can be ineffective. Instead, institutions should adopt a tiered model of supervision:
Human-in-the-Loop (HITL): For high-risk activities, the agent requires explicit human approval before executing an action. The agent may prepare a transaction or decision, but a person must provide the final authorization.
Human-on-the-Loop (HOTL): For moderate-risk activities, the agent operates autonomously but is supervised by a human who can intervene or override its actions if necessary. This model relies on robust monitoring and alerting to bring exceptions to human attention.
Human-out-of-the-Loop: For low-risk, routine tasks, the agent may operate fully autonomously, with human review occurring on a periodic, sample basis after the fact.
The decision of which model to use should be based on factors like financial impact, customer impact, regulatory sensitivity, and the irreversibility of the agent’s potential actions.
Governance, Accountability, and Decision Rights
Accountability for an agent’s actions cannot reside with the technology itself. Clear lines of ownership are essential for effective governance and issue resolution. The governance framework should assign specific responsibilities:
Business Owner: A senior leader in the relevant business unit who is ultimately accountable for the agent’s performance, its impact on business objectives, and its adherence to risk appetite.
Product/System Owner: A manager responsible for the day-to-day operation of the agent, including monitoring its performance, managing updates, and serving as the first point of contact for incidents.
Risk and Compliance Partners: Subject matter experts from the second line of defense who provide independent advice and challenge on the agent’s design, controls, and compliance with institutional policies. For more on this, see our guide on AI accountability in financial services.
Operationalizing Controls Around Autonomous Actions
A delegated authority framework is only effective if it is supported by robust operational and technical controls. These controls act as the practical enforcement mechanism for the business rules and risk tolerances defined in the governance process.
Identity, Access, and Transaction Controls
An autonomous agent is a non-human user that requires its own unique identity and access credentials. Standard Identity and Access Management (IAM) principles are a critical foundation for agentic AI risk controls:
Least-Privilege Access: The agent’s credentials should grant it access only to the specific systems, data, and functions required to perform its authorized tasks.
Credential Management: Agent credentials (e.g., API keys, service accounts) must be securely stored, rotated regularly, and monitored for anomalous activity.
Transaction-Level Controls: In addition to access controls, specific transaction controls should be implemented. These include hard-coded limits on transaction values, frequency (velocity checks), and approved counterparties.
Guardrails, Escalation, and Fail-Safe Mechanisms
Effective agentic AI risk controls include deterministic guardrails that operate outside the agent’s probabilistic reasoning. These are non-negotiable rules that constrain the agent’s behavior.
Deterministic Rules: Simple, rule-based software should be used to validate an agent's proposed actions against predefined limits before execution. For example, a rule could block any payment instruction from an agent that exceeds its authorized transaction limit.
Escalation Triggers: Clear triggers should be established to automatically escalate a task to a human operator. This could be based on confidence scores, the presence of certain keywords in a customer communication, or any action that falls outside of standard parameters.
"Kill Switches": A reliable mechanism must be in place to immediately halt an agent’s operations if it begins to behave erratically or exceeds critical risk thresholds. This control should be accessible to designated human supervisors and operate independently of the agent’s core processing.
Monitoring, Testing, and Audit Trails
Continuous monitoring is essential for autonomous systems. Unlike traditional models that are validated at a point in time, agents interact with dynamic environments, and their performance can change. Monitoring should cover:
Action Logs: A comprehensive and immutable log of every action taken by the agent, including the data used, the tools accessed, and the resulting outcome.
Exception Monitoring: Real-time tracking of any actions that are blocked by guardrails, escalated to humans, or generate errors.
Performance Metrics: Ongoing measurement of the agent’s effectiveness, efficiency, and adherence to its objectives.
This data provides a critical audit trail for internal reviews, regulatory examinations, and incident response.
Third-Party and Connected-Agent Risk
Many agents will rely on third-party tools, APIs, or data sources to perform their functions. This introduces vendor risk that must be managed through a structured due diligence and oversight process. Institutions should assess a vendor’s security controls, operational resilience, and data handling practices before integrating their services into an agentic workflow. For additional guidance, see our framework for third-party risk management for AI vendors. Furthermore, when multiple agents interact, their interdependencies create the potential for systemic risk, where a failure in one agent can cascade to others.
Monitoring, Assurance, and Board Oversight
Effective governance requires a continuous feedback loop that provides senior management and the Board with a clear view of agentic AI risk. This involves moving beyond technical performance metrics to a holistic assessment of risk and control effectiveness.
Measuring Agentic Risk
To provide meaningful oversight, leadership needs Key Risk Indicators (KRIs) that are specifically designed for autonomous systems. These KRIs should focus on the stability and predictability of the agent’s behavior. Examples include:
Human Intervention Rate: The percentage of tasks that require human escalation or correction. An increasing rate may signal a degradation in agent performance or a change in the operating environment.
Exception Rate: The frequency with which an agent’s actions are blocked by deterministic guardrails or fail-safes.
Unauthorized Action Attempts: Any instance where the agent attempts to perform a task outside its documented authority.
Transaction Limit Breaches: The number of attempted transactions that exceed predefined value or velocity thresholds.
Aggregate and Interdependent Risk
An institution’s risk profile is not simply the sum of its individual agentic systems. Management must consider aggregate risk, where multiple agents, models, and workflows create complex dependencies. A common data source or a shared API used by several agents can become a single point of failure. A risk assessment process should map these interdependencies to understand how a disruption in one area could have a cascading impact across the organization.
Independent Assurance and Issue Management
The three lines of defense model provides a useful structure for agentic AI assurance.
The first line (business units) owns the risk and is responsible for designing, implementing, and monitoring the agent and its controls.
The second line (Risk and Compliance) provides independent oversight, establishing policies, setting standards, and performing risk-based testing of the first line’s controls.
The third line (Internal Audit) provides independent assurance to the Board. Its role is not to re-perform validation or testing but to evaluate the effectiveness of the overall governance framework and the risk management practices of the first and second lines.
Board and Senior Management Reporting
Reporting to the Board and senior management should be concise, strategic, and risk-focused. Instead of detailing the technical specifications of AI systems, reports should concentrate on the information leaders need to exercise their oversight duties. Effective reporting, often included in broader enterprise risk updates, should cover:
Material risks associated with key agentic systems and their alignment with the institution’s risk appetite.
Performance against established KRIs and trends over time.
Significant incidents, control failures, or policy exceptions and the status of remediation efforts.
The inventory of agentic systems and any significant changes or new deployments planned.
This level of reporting enables leadership to ask informed questions and provide credible challenge, fulfilling their governance responsibilities. For more on this topic, refer to our practical governance guide on AI risk for boards.
Executive Takeaways
Recognize that agentic AI models are outside the scope of SR 26-2 and consider how existing risk-management and governance frameworks can address the authority, operational, technology, compliance, and other risks associated with autonomous actions.
Implement appropriate guardrails, such as value-based limits, velocity controls, escalation mechanisms, or other restrictions, based on the risk and authority associated with each agentic workflow.
Implement Key Risk Indicators (KRIs) specific to autonomous systems, such as human intervention rates and exception rates, to provide meaningful risk oversight to senior management and the Board.
Maintain an inventory of identified agentic systems that captures relevant use cases, authority boundaries, testing, known limitations, and other information needed to support risk assessment and oversight.
Ensure Internal Audit evaluates the effectiveness of the agentic AI risk control framework rather than duplicating the validation and testing activities performed by the first and second lines of defense.
How Versapien Can Help
Versapien assists financial institutions in designing and implementing AI governance frameworks that address the unique challenges of agentic systems. Our senior-led team provides strategic advisory on delegated authority structures, risk-based control implementation, and regulatory exam readiness. We help organizations integrate autonomous AI into their existing enterprise risk management programs without guaranteeing specific regulatory outcomes or examination results.
Comments