QuestionAI GovernanceFinancial ServicesImplementation

What controls should a financial services firm set before an AI agent influences a decision?

14 October 2026

Answered by Rohit Parmar-Mistry

Short answer

A quick answer first, then the fuller context below.

Before an AI agent can influence a customer or balance-sheet decision, define what it may do, who is accountable, where human approval is required and how the firm will detect and contain a failure.

What this points to

This usually points to AI governance consulting

If this question reflects a real workflow, supplier, data or governance decision inside the firm, do not treat the answer as theory. Use it to decide whether you need a light assessment, a deeper audit, a controlled implementation path, governance support or recovery from a genuinely stalled AI attempt.

AI governance consulting Audit risk and opportunity Talk through the risks and options with Rohit

Detailed answer

The fuller context, trade-offs and practical steps behind the short answer.

Before an AI agent can influence a financial-services decision, the firm should identify the decision and its possible consequences, set the agent’s permitted actions, name an accountable owner, define where human approval is required, and establish how to detect and contain unsafe behaviour. Test those controls against realistic failure scenarios before expanding the agent’s scope.

Map the decision and its consequences

Start with the decision, not just a list of AI tools. An agent may influence credit, pricing, claims, advice, fraud checks, collections or customer communications. For each use, record what the system can change, what information it uses, which connected systems or suppliers it relies on, and what an incorrect or delayed decision could mean for a customer or the firm.

Distinguish an assistant that prepares material for a person from an agent that can take action. Include AI embedded in third-party products where its output may affect your customers or processes.

Set permissions, approval points and ownership

Specify which actions the agent may take, which it may recommend and which are out of scope. Decide where a person must review or approve an action, particularly when it could materially affect a customer’s access, claim, price or advice. Name the person accountable for the system and the decisions it influences.

Make the boundary testable. For example, record whether the agent may draft a recommendation but not submit it, change a customer record or send a customer-facing decision. Document who can change permissions and who can pause the system.

Make failures detectable and containable

Define the signals that trigger investigation, who receives them and how the team can pause the agent. Consider unexpected actions, changes in output patterns, hostile inputs, delayed detection and failures that could affect connected processes.

Keep enough decision and action history to reconstruct what happened and explain the response. Test how quickly the team could notice a problem and limit further impact, including what happens to work already in progress and how affected customers would be handled.

Test before expanding an agent’s scope

Test the specific decisions and failure paths in scope before widening permissions. Include cases with incomplete information, hostile instructions, unexpected results from connected tools and situations where a person needs to override the system. Keep test results, permission changes, the accountable owner and the approval rationale together so the decision can be reviewed later.

These steps are a practical governance approach, not a claim that one control set satisfies every legal or regulatory obligation. Controls should be chosen for the firm’s activities, risks and operating context.

How Pattrn Data can help

Pattrn Data’s AI Risk & Efficiency Audit helps firms assess AI use, identify control and implementation gaps, and set out practical next steps. If you are assessing an agent use case, you can book a discovery call to discuss the scope and readiness of the work.

Source

This article draws on Oliver Wyman’s discussion of agentic AI risk and resilience in financial services: Agentic AI in financial services: risk and resilience. The recommendations above are practical considerations, not legal advice or a statement of regulatory compliance.

Frequently asked questions

Direct follow-up answers written for searchers, buyers and internal decision makers.

Does every AI agent need human approval for every action?

Not necessarily. Define approval points according to the action, potential impact and the firm’s operating context. Record which actions require review, which are permitted and which are out of scope.

What evidence should a firm keep?

Keep the decision and permission boundaries, accountable ownership, approval rationale, relevant test results, changes to permissions and enough action history to reconstruct incidents and responses.

When should a firm expand an agent’s permissions?

Only after testing the decisions and failure paths in scope and reviewing the evidence against the intended controls. The appropriate decision depends on the firm’s use case and risk assessment.

Need help implementing this?

If this question points to a live process, policy or supplier decision, the next step is usually to turn the answer into a controlled plan. These services are the most relevant starting points.

Need More Specific Guidance?

Every organisation's situation is different. If you need help applying this guidance to a specific process, book a discovery call or take the assessment first.