The move from chat-based assistance to agentic workflows changes the control problem. A prompt produces an answer; an agent may produce a chain of actions. That chain needs a defined purpose, controlled permissions, reliable evidence and an accountable human owner.
Five control gates for a banking AI agent
Define the mandate
State the use case, prohibited actions, jurisdiction, data boundaries and success criteria before the agent is connected to a workflow.
Limit permissions
Use least-privilege access, separation of duties and explicit approval for external communication, customer impact or financial posting.
Require evidence
Record the source, retrieval time, prompt or instruction, tool calls, assumptions and confidence signals behind each material output.
Keep a human checkpoint
Route high-impact, uncertain or irreversible actions to a named reviewer with enough context to challenge the recommendation.
Monitor and stop
Test drift, prompt injection, abnormal tool use and repeated failures. Maintain a visible kill switch and an action-reconstruction log.
Use the VERIFY → REVIEW → APPROVE → MONITOR cycle
Verify the agent’s purpose, data sources and permissions. Review the output and the path taken to produce it. Approve only where the accountable officer can explain the decision. Monitor behaviour, exceptions and emerging failure modes after deployment.
Practical test: if a supervisor, auditor or customer complaint team cannot reconstruct what the agent did, which evidence it used and who approved the outcome, the workflow is not ready for uncontrolled production use.
Where to start
- Begin with low-impact internal workflows such as document classification, policy comparison or draft preparation.
- Create an AI use-case register with risk tier, owner, data class, permissions, human checkpoint and review frequency.
- Run adversarial tests before connecting the agent to customer records, payment systems, credit decisions or regulatory submissions.
- Review third-party model, hosting, data-retention, subcontractor and incident-notification dependencies.
This note is an educational research perspective. It does not provide legal advice, regulatory approval or an automatic compliance determination. Apply the relevant law, supervisory expectations, internal policy and professional judgment.