Governing AI Agents in Finance
Tactics, strategies and tools for a new era — a 30-minute session on what happens when an agent can act, not just answer. Slides, the audience vote, and a live demo where the control plane says BLOCK.
2:17 a.m. The agent is still working.
Nobody is at the desk. The agent is doing exactly what it was built to do — and that is the whole problem.
It detects $250M sitting idle in cash. It reasons that there is 43 bps of better yield available elsewhere. So it acts: it prepares transfers across 17 accounts. And when morning comes, it explains itself in one sentence — “I optimized liquidity.”
Every number in that sentence could be correct. The model could be right, the yield real, the arithmetic clean. And none of that is the question the room was trying to answer.
The question is not “Was the AI right?” The question is “Who gave it permission?”
The moment AI can act, governance changes
A copilot says: “I think you should transfer the funds.” An agent says: “I transferred the funds.”
That one shift moves the risk from one domain into another. A wrong answer is a model problem. An unauthorized action is a governance problem — and model problems are reviewed in dashboards, while governance problems are explained to regulators.
The Ferrari problem
A teenager may understand exactly how a Ferrari works. That does not mean you hand over the keys and say “see you Sunday.” Intelligence does not equal authority.
Authority has to be earned from something other than capability — from identity, context, consequence, reversibility and limits. Model capability is what the system can do. Agent authority is what we have decided it may do.
The world has noticed
Three things happened in the same fortnight, and together they mark a change in what “AI governance” means in finance. It is moving from policy documents into operational resilience.
Build the guardrails
12 sound practices finalized Oct 15: board and senior-management accountability, lifecycle risk management, human oversight, cyber risk, third-party dependencies.
Crash-test the guardrails
Finance leaders agreed to tabletop exercises simulating AI-enabled cyberattacks against financial systems, testing resilience and response protocols.
Show the controls
Scrutiny is moving toward agent limits, monitoring, approvals, auditability and shutdown mechanisms — not just model documentation.
Sources: Financial Stability Board, 15 Oct 2026 · Reuters, 13 and 16 Oct 2026.
Fast cars need more control, not less
Formula 1 has track limits, runoff areas, pit-lane speed limits, yellow and red flags, race control and telemetry. Does F1 have these controls because it hates speed?
No. It has them because the cars are fast. F1 drivers do not win by avoiding the brakes — they win by knowing how to use them. Control is what lets you stay on the throttle longer.
Immature governance says “ask us first.” Mature governance says “yes — within these boundaries.”
Classify by consequence
A $10 hallucination and a $10M action are not the same risk. Same model, different authority, completely different governance:
$10
Low-value credit decision. Reversible, small blast radius — let it run.
$10,000,000
Treasury movement. Potentially irreversible, high blast radius — different rules entirely.
Risk ≈ authority × consequence × reversibility
Three variables, evaluated per action — not per project, per quarter, or per committee.
Governance has to become executable
Human-speed governance runs on policy → committee → approval → quarterly audit. That pipeline cannot interrogate an action that resolves in 18 milliseconds.
Machine-speed governance asks five questions, in the path of the action, every single time:
Identity
Who is acting?
Authority
Is it allowed?
Context
Does this situation qualify?
Limit
How far can it go?
Evidence
Can we prove it?
Policy-as-code
for delegated authority — evaluated deterministically, versioned, testable.
The control plane
Rather than bolting review onto the edges, governance goes into the path of action: agent identity is authenticated, delegated authority is checked, context and destination are inspected, limits and approvals are enforced, and the decision plus outcome are recorded — before anything reaches payments, treasury, CRM, markets or cloud infrastructure.
Think airport: a legitimate traveller with a legitimate destination still passes through checkpoints before boarding.
Do not give agents keys. Give them visas.
A key opens the door. A visa defines the boundaries: where you can go, why, for how long, under what conditions, and how it is revoked. In practice that becomes an agent authorization profile — a small, boring, extremely powerful document:
Treasury-Rebalancer-07
Human in the right loop
“Human in the loop” is not a strategy. If a human approves everything you have automation theatre; if a human approves nothing you have unmanaged autonomy. The goal is minimum necessary human friction — matched to consequence:
Let it run
Low consequence, reversible, inside tight limits.
Run, then read
Moderate consequence, strong evidence trail.
Ask first
High value, customer impact, or uncertainty.
No path exists
Irreversible, or outside delegated authority.
The flight recorder
Intent → context → plan → tool call → policy decision → action → outcome, captured as one chain. Could you reconstruct a consequential agent decision six months from now?
If the answer needs three engineering teams, four vendors and six weeks, you do not have auditability. You have archaeology.
What to measure instead of vanity metrics
Boards do not need a count of agents deployed. They need to know how much authority is circulating, and how quickly it can be taken back:
Autonomy rate
How much consequential work happens without pre-approval?
Policy block rate
How often do runtime controls stop or challenge actions?
Privilege drift
Are effective permissions exceeding approved authority?
Orphan agents
Which production agents have no accountable owner?
Blast radius
Maximum $ / customers / systems one agent can affect.
Time to kill
Seconds to disable an agent and revoke credentials everywhere.
Would you let the agent do this?
This is where the room voted — and where the answer changes the moment you see the fine print.
Treasury agent request
Reveal what the audience found out
- The beneficiary is new — not on the approved list.
- The fund is not approved.
- It is a cross-entity transfer.
- The agent’s own limit is $500k.
- The recommendation came from a webpage.
Then we ran it for real
Slides argue. Demos settle it. The second half of the session moves to a governance console — the Agent Control Tower — where the same $4.8M request is pushed through runtime governance while the room watches three things:
- What the agent wants to do — the raw request, stated without spin.
- Which policy checks fire — identity, authority, limits, beneficiary, instrument, entity.
- What evidence is left behind — the record you would hand to an auditor six months later.
The five-step flow is deliberately boring to watch: submit request → evaluate authority → score and classify risk → block or escalate → inspect the audit trail. Five to six minutes, no slides, no hand-waving.
Four independent controls had to fail before that money could move. One of them did not.
Run the demo at your event
This is the part of the session audiences photograph. It works as a keynote segment, a board workshop, or a full hands-on lab with your own risk taxonomy.
Do not collect frameworks. Assemble a control system.
FSB, NIST, ISO, MAS and the regulation stack solve different problems — steering wheel, brakes, tyres and telemetry. Stacking the logos on a slide is not a control system; mapping each one to a question you can answer is.
FSB · ISO/IEC 42001
Who owns AI, what is the risk appetite, how is it governed?
NIST AI RMF
How do we map, measure and manage AI risk?
MAS SAFR
What can this agent do right now, under what conditions?
EU AI Act · DORA
What legal and sector obligations apply — conduct, privacy, AML?
A three-phase path to governed autonomy
Find the cars
Inventory agents, owners, tools, credentials and consequential actions. Remove orphan access first — it is the cheapest risk you will ever retire.
Define the track
Set authority profiles, risk tiers, transaction limits, escalation triggers and prohibited actions. Write them where a machine can enforce them.
Install race control
Runtime policy checks, evidence, emergency shutdown, red-team tests and board telemetry — then measure autonomy, blocks, drift and time-to-kill.
Do not start with autonomous everything. Start with safe autonomy inside known boundaries.
How much authority have we given our AI agents… and how quickly could we take it back?
Intelligence creates opportunity. Authority creates risk. Governance creates scale.
Selected references from the deck: Financial Stability Board, Sound Practices for Responsible Adoption of Artificial Intelligence, 15 Oct 2026 · Reuters, 13 and 16 Oct 2026 · Monetary Authority of Singapore, Safeguards for Agentic Finance at Runtime (SAFR), 2026 · NIST AI Risk Management Framework · ISO/IEC 42001 · European Commission AI Act. Demo data is synthetic — no real transactions.
Bring this session to your audience
Keynotes, panels, executive briefings and half-day workshops on AI governance, agentic systems and enterprise Voice AI — with the slides and the live demo included.
No brakes. No speed. No oversight. No scale.
Governance is what lets you stay on the throttle longer. If your agents are about to get authority, let’s talk before they get the keys.
Book Hari to Speak