An AI agent does not need to go rogue to create a problem for a bank. It only needs the right credentials, access to the wrong combination of systems and enough autonomy to take an action nobody expected. As banks move from AI tools that answer questions to agents that retrieve customer information, update records, investigate alerts and execute workflows, a familiar security question is acquiring an unfamiliar dimension: who, or what, should be trusted with access to the bank? Giving an AI agent a digital identity may be technically straightforward. Deciding what that identity is allowed to do, how its actions are supervised and who carries responsibility when something goes wrong is considerably harder.
AI Is Moving From Advice to Action
Much of the first wave of generative AI inside banking has been relatively contained. Employees ask questions, summarise documents, generate reports or receive recommendations, while a person remains responsible for taking the final action.
Agentic AI changes that relationship.
An agent can potentially receive an objective, determine the steps required, interact with multiple applications and complete parts of a process without waiting for human instructions at every stage.
Consider a customer service agent tasked with resolving an account query. It could retrieve customer information, review previous interactions, check transaction history, update a case and trigger a follow-up workflow. An operations agent could investigate a failed payment by gathering information from several systems before determining where the exception occurred.
The efficiency opportunity is substantial because banks contain thousands of processes in which employees spend time moving between systems rather than making genuinely complex decisions.
But autonomy also changes the risk.
The question is no longer simply whether an AI model produces an incorrect answer. Banks must consider what happens when an AI system can act on that answer.
That makes the transition from experimentation to production particularly important. As Finnoex recently explored in Banks Have Plenty of AI Ideas. Getting Them Into Production Is the Hard Part, operationalising AI requires much more than demonstrating that a model works. Agentic systems add another requirement: controlling what the AI is permitted to do once it enters the production environment.
Every AI Agent May Need Its Own Identity
Banks already operate sophisticated identity and access management frameworks for employees, contractors, applications and machines.
AI agents complicate those frameworks because they sit somewhere between several existing categories.
They are not employees, but they may perform tasks previously carried out by employees. They are software, but unlike conventional applications they can potentially determine which actions to take dynamically. They may also operate across multiple systems rather than remaining inside a tightly defined application boundary.
Treating thousands of agents as generic system accounts would create obvious problems.
If several agents share credentials, determining which agent performed a particular action becomes more difficult. If an agent inherits the permissions of the employee using it, it may receive considerably more access than it actually requires.
Banks may therefore need to think of AI agents as distinct digital identities.
Each could have its own credentials, permissions, purpose, owner and audit history. The bank would know not merely that an automated process accessed an account, but precisely which agent did so, why it accessed the information and what it subsequently did with it.
Identity could become one of the foundations of agentic banking.
An Agent Should Not Inherit Everything Its Human Can Do
The principle of least privilege is hardly new to cybersecurity. Agentic AI makes its application more complicated.
Imagine a relationship manager who can view customer balances, retrieve documents, modify CRM records and initiate certain internal processes. An AI assistant helping that employee may need access to some of those capabilities, but probably not all of them.
Simply allowing the agent to operate with the employee’s full permissions could dramatically expand the consequences of an error.
Instead, banks may need extremely granular permissions.
An agent might be permitted to read transaction information but not modify it. Another could prepare a payment instruction but require human authorisation before submission. A fraud agent could investigate an alert and recommend that an account be restricted, while the actual restriction requires approval from an authorised employee.
Permissions may also need to change according to context.
An agent performing routine work could operate autonomously until it encounters an unusual transaction, high-value customer, regulatory issue or action above a defined financial threshold. At that point, authority could automatically revert to a human.
This introduces something banks have spent decades designing into financial processes: segregation of duties.
The difference is that one of those duties may increasingly belong to a machine.
Banks Need to Know Why an Agent Was There
Traditional audit logs often answer relatively simple questions.
Who logged in? Which system did they access? What record changed? When did it happen?
Agentic AI requires another layer of evidence.
Banks may need to reconstruct the chain of events that caused an agent to act.
What instruction initiated the task? What information did the agent retrieve? Which systems did it interact with? What decisions did it make? Which policy governed those decisions? Did another agent participate? Was human approval requested?
This becomes particularly important when AI agents operate across interconnected banking infrastructure.
The growing use of APIs already allows services to communicate far more dynamically across financial institutions. As discussed in Your Bank Is Becoming an API. Customers May Never Know It, customers increasingly experience banking through services assembled across multiple systems rather than a single application.
AI agents could become another orchestration layer sitting above that infrastructure.
That means observability must extend beyond individual applications. A bank may need to follow an agent’s entire journey across systems and understand not simply what happened, but why.
One AI Agent Could Delegate to Another
The governance challenge becomes even more interesting when agents begin collaborating.
A customer-service agent might ask another agent to retrieve documents. That agent could invoke a compliance service, which might interact with a third system before returning its response.
The original agent may never directly access some of the systems involved.
This creates a potential chain of delegated authority.
Banks will need controls determining whether agents can delegate tasks, which other agents they can communicate with and whether permissions can travel with those requests.
Otherwise, an agent with limited access could theoretically obtain information indirectly through another agent with broader privileges.
Machine-to-machine trust therefore becomes increasingly important.
Banks already manage service accounts, APIs and automated workloads. Agentic systems could increase both their number and their behavioural complexity dramatically.
The Bank Still Owns the Decision
There is also a more fundamental governance issue.
An AI agent cannot ultimately carry regulatory responsibility.
If an automated system incorrectly blocks a legitimate customer, mishandles personal information, makes an inappropriate credit recommendation or executes an unauthorised action, the explanation cannot simply be that the agent made the decision.
Responsibility remains with the institution deploying it.
Banks therefore need clearly identified human ownership around autonomous systems, even when humans are removed from individual transactions.
That ownership could exist at several levels: the business function responsible for the agent, the technology team maintaining it, risk teams defining acceptable behaviour and security teams controlling its access.
The objective should not necessarily be human approval for every action. Doing that would remove much of the productivity advantage of agentic AI.
Instead, banks need to decide precisely where human responsibility sits when human intervention does not.
The Kill Switch May Become a Standard Banking Control
Autonomous systems also require a way to lose their autonomy quickly.
If an employee’s account is compromised, a bank can disable credentials. AI agents need an equivalent mechanism.
But disabling one agent may not be enough.
Banks could eventually operate hundreds or thousands of specialised agents. Security teams may need the ability to suspend a particular agent, revoke a category of permissions or halt an entire group of autonomous processes if unusual behaviour is detected.
This is where AI governance and cybersecurity begin to converge.
As Finnoex examined in The Next Cybersecurity Arms Race Will Move at Machine Speed, automation is compressing the time available for organisations to identify and respond to threats. The same principle applies internally: if autonomous systems can execute actions at machine speed, controls must be capable of intervening at comparable speed.
The future AI control environment may therefore include behavioural monitoring, transaction thresholds, automatic privilege reduction and emergency shutdown mechanisms alongside traditional access controls.
AI Governance Is Becoming an Identity Problem
Banks have spent enormous effort deciding which employees can access which systems. Agentic AI introduces an entirely new population into that equation.
These digital workers will not have employment contracts, job titles or managers in the conventional sense. Yet they may have credentials, permissions, responsibilities and the ability to interact with some of the most sensitive infrastructure inside a financial institution.
The banks that scale agentic AI successfully may therefore be those that treat identity and accountability as part of the architecture from the beginning rather than controls added after deployment.
The challenge is not simply teaching an AI agent how to perform a banking task.
It is deciding how much of the bank it should be allowed to touch.
What it means for the industry
- AI agents will need identities, not just API access. Banks will increasingly need to know exactly which agent performed an action and under whose authority.
- Least-privilege access will become critical to agentic AI. Agents should receive only the permissions required for a specific task rather than automatically inheriting broad employee access.
- Auditability must extend beyond traditional system logs. Banks will need visibility into the instructions, decisions, system interactions and delegated actions behind an agent’s behaviour.
- Human accountability will remain even as human intervention declines. Institutions will need clearly defined ownership for autonomous processes and their outcomes.
- AI security and identity security will increasingly converge. Behavioural monitoring, machine identities, access controls and rapid privilege revocation could become central elements of AI governance.
- Emergency controls will be essential. As agents become capable of acting at machine speed, banks will need equally fast mechanisms to restrict or stop them.
