Governing AI agents inside a bank: the four controls that actually matter

Most enterprises are piloting AI agents in a sandbox and calling it governance. Then the pilot graduates, an agent gets a production credential, and the control story collapses in a week. We have run this transition with financial services clients, and the pattern repeats: the technology is rarely the blocker. The blocker is that nobody defined what the agent is allowed to be.

Here are the four controls that carry the weight.

1. Identity and lifecycle

An agent is not a user and it is not a script. It needs its own identity, issued by the same directory that issues human identities, with an owner, an expiry, and a documented purpose. If your agent borrows a service account, you have already lost the ability to answer who did what.

• Give each agent a distinct identity, never a shared credential
• Attach an owner in the business, not only in IT
• Set a hard expiry and force a re-justification to renew

2. Access and limits

Scope narrows as autonomy grows. An agent that reads a table and drafts a summary should not hold write access to the same system. We separate the read path from the write path, and we cap the blast radius with rate limits and transaction ceilings.

The useful question is not whether the agent can be trusted. It is how much damage it can do before a human notices.

3. Human supervision

Supervision has to be designed, not assumed. In practice that means a defined approval gate for irreversible actions, a queue someone actually monitors, and an escalation path with a name at the end of it. If the queue is real but nobody owns it, the control does not exist.

4. Traceability

Every agent decision needs to be reconstructable after the fact: the prompt, the data it saw, the tool it called, the result, and the policy that allowed it. Regulators will ask for the reasoning trail, not the log line. Designing that trail up front is cheap. Rebuilding it during an audit is not.

What this looks like in a delivery plan

We sequence these as a single workstream, not four projects: identity first, because nothing else is measurable without it; then scoping and limits; then the supervision workflow; then the trace record, which by that point is a byproduct rather than a project.

None of this requires exotic tooling. It requires deciding, in writing and before the pilot ends, what the agent is for.