An AI agent that approves an exception or changes a customer record exercises authority on behalf of the institution. The board needs to know who granted that authority, what limits apply and who responds when the agent makes a mistake.
Banks and credit unions are encountering agentic AI through the platforms they already use for fraud operations, lending, collections and customer service. Unlike a tool that drafts an answer for someone to review, an agent can carry out a sequence of actions across systems. A product update can therefore change the institution’s risk exposure without looking like a new technology deployment.
The practical challenge is to bring those actions within existing governance. That requires a named owner, documented authority, controls around consequential decisions and evidence of what happened when the agent acted.
The challenge is already emerging in practice. In October 2026, Reuters reported that major US banks were blocking third-party AI agents from accessing customer accounts, amid concerns about agents taking actions beyond users' instructions. In Australia, APRA’s April 2026 letter to industry on AI found that identity and access management capabilities “have not yet adjusted to nonhuman actors such as AI agents”.
These developments raise a critical governance question: how can financial institutions maintain control and accountability when AI agents act on behalf of customers or across institutional boundaries?
For a practical guide to connecting risk, controls and evidence across your institution, download Protecht’s Risk in motion eBook.
Accountability follows the activity
Using a vendor’s technology does not remove an institution’s responsibility for the activities it performs. Under APRA’s operational risk standard, CPS 230, the board is ultimately accountable for oversight of operational risk management, including the management of service provider arrangements.[1] APRA’s AI letter also noted “an overreliance on vendor presentations and summaries” by boards, and warned that AI embedded in vendor software can make upstream dependencies opaque.[2]
The Financial Accountability Regime (FAR), which now covers banks, insurers and superannuation trustees, makes the point personal. Accountable persons must take reasonable steps to ensure the entity meets its obligations within their area of responsibility.[3] An agent operating within an executive’s remit falls inside that duty.
APRA expects entities to establish, at a minimum, ownership and accountability across the AI lifecycle, an inventory of AI tooling and use cases, and human involvement for high-risk decisions.[2]
The Financial Stability Board, the international body that monitors the global financial system, also released its final report on Sound Practices for Responsible Adoption of AI in October 2026, stressing the importance of AI governance across the whole institution as well as providing its framework for managing risks when implementing AI or agentic AI.
Delegated authorities and approval matrices often assume that a person initiates each consequential action. An agent can operate outside those arrangements unless its permissions are explicitly mapped to them. For example, a service account may technically allow a payment or a record change even though nobody has approved that use of the agent. The gap lies between what the system permits and what management intended to allow.
This review should happen before a capability is enabled. Bring the process owner, technology team and risk function together to compare proposed use with actual permissions. A pilot should have explicit limits and evidence requirements, including how staff will identify agent activity. Expansion should follow a review of exceptions and control performance, rather than a vendor’s release timetable.
Direct human oversight of consequential decisions
Oversight needs to reflect the action and its consequences. High-volume, well-defined tasks may be suitable for automation when limits, monitoring and escalation work reliably. Novel decisions, significant customer harm and actions that are difficult to reverse call for closer human involvement.
An agent processing routine cases can free staff to review anomalies and exceptions. That benefit depends on the quality of the handoff. Management should define what constitutes an exception, assign someone to review it and establish a response time that suits the potential harm. A queue that grows faster than staff can clear it creates a new operational weakness.
For each deployment, distinguish work governed by clear rules from work requiring judgment. Transaction volume alone does not make a task suitable for autonomous execution. An unusual dispute may require interpretation of an obligation or an assessment of customer vulnerability, even when it sits in a large processing queue. The agent can gather information while a person retains the decision.
Put authority and controls around each agent
There are several steps you should take to ensure agent management works effectively:
-
Start with an inventory of agents, whether built internally, bought separately or embedded in vendor platforms. Record an accountable owner, the actions each agent can perform, the systems it accesses and the authority it exercises. Ask vendors to explain which capabilities can act autonomously and how those capabilities are enabled or changed.
-
Document bounded authority through transaction limits, permitted actions, data-access restrictions and approval requirements. An agent that can update a customer address need not also be able to change payment details. Review permissions when its purpose changes, and test whether the technical restrictions enforce the limits management approved.
-
Design escalation around confidence, financial value, unusual activity and customer-harm indicators. The receiving team needs enough information to assess the case and enough capacity to respond. Test that handoff with realistic exceptions before expanding deployment.
-
Keep records that support an investigation: the information available to the agent, its output and action, the authority under which it operated, and any approval or notification. The record should distinguish an agent’s recommendation from an action executed by a person or another system. Retention and access controls also need to reflect the sensitivity of customer information.
-
Test how to stop an agent and identify which actions can be reversed. Some effects cannot be fully undone, such as disclosing information to the wrong recipient. Those actions need stronger prevention and approval controls. A shutdown procedure should specify who can invoke it and how service continues while the agent is unavailable.
-
Extend risk appetite to autonomous action by defining acceptable uses, prohibited activities and tolerances for errors and escalation. Review those limits against incident experience and changes in the vendor’s capabilities. ASIC will begin a review of banks’ AI use in 2026–27, focused on customer-facing interactions, decision-making and lending, so tolerances should reflect potential customer harm as well as operational error.[4]
Questions for the board
Directors should ask whether the agent inventory includes capabilities embedded by vendors and whether each has an owner and approved authority. They should also understand who decides which actions require human judgment, what agents escalated during the reporting period, and whether shutdown and recovery arrangements have been tested. A lack of escalations warrants investigation: it may reflect reliable processing, weak thresholds or failures in the handoff.
Next steps for your organisation
Agentic AI can affect operational, third-party, compliance and customer risks at the same time. You need to link each deployment to the processes it supports, the obligations those processes must meet and the controls that limit its actions.
Incidents and near misses then become evidence for reviewing both the agent and the surrounding process. CPS 230 requires entities to notify APRA within 72 hours of becoming aware of a material operational risk incident. This gives management a practical basis for explaining who was accountable, what authority applied and whether the controls worked.
Governing agents requires a clear relationship between their authority, the processes they affect and the controls around their actions. Protecht connects risk assessments, controls, obligations, incidents and remediation workflows, helping teams record ownership, review exceptions and report the evidence supporting their oversight of autonomous activity.
Request a Protecht demo to see how connected risk and compliance workflows can support the decisions your institution needs to make.
Additional resources
Managing AI risks: Turning uncertainty into advantage: Discover how Protecht’s AI governance solution centralises AI oversight, aligns with ISO 42001 and the EU AI Act, and integrates AI risk into enterprise GRC.
AI project governance checklist: Assess your AI project risks with our structured governance checklist. Identify gaps, strengthen oversight, and align with global AI standards.
References
[1] APRA, CPS 230 Operational Risk Management. https://www.apra.gov.au/standards/cps-230
[2] APRA, Letter to industry on artificial intelligence (AI), 30 April 2026. https://www.apra.gov.au/news-and-publications/apra-letter-industry-artificial-intelligence-ai
[3] APRA, Financial Accountability Regime. https://www.apra.gov.au/cross-industry/financial-accountability-regime-far
[4] ASIC, ASIC’s 2026–27 banking sector priorities, 30 September 2026. https://download.asic.gov.au/media/0tobhg1c/26-232mr-asic-supervisory-letter-banking-published-30-september-2026.pdf