Deep Dive AI governance & agentic risk
Agentic AI is moving from pilot to authority. Governance has not caught up.
The difficult question is no longer whether an agent can complete a task, but who has delegated it the right to act — and who can prove, pause or revoke that authority when conditions change.
MAS and industry partners publish the SAFR white paper on runtime safeguards for AI agents in finance.
IIF and EY survey 65 institutions: formal governance is widespread, supplier-model assurance remains difficult.
Oliver Wyman argues that governance must extend from the model to the whole workflow.
Four recent sources approach agentic AI from different vantage points: an industry-developed regulatory framework, a sector survey, and two operating-model analyses. Read together, they point to the same practical gap. The issue is not whether an agent can generate an answer; it is whether the institution has made its authority, boundaries and intervention rights demonstrable in the live workflow.
Model-risk frameworks were built around a division of labour: the model performs and a human decides what to do with its output. Agentic systems do not always stop at an answer. They can use tools, call the next system and take bounded action across a workflow. That moves governance from a question about model performance to a question about delegated authority.
The unit of control is not the model.
Oliver Wyman’s analysis of agentic AI in financial-crime compliance makes the distinction directly. A traditional model can be assessed through its inputs, methodology, outputs and limitations. An agent operates through an orchestration layer, prompts, tools, data access, permissions, human oversight and an audit trail. The behaviour that matters is shaped by their interaction, so governance has to address the workflow as a whole.
The practical design is risk-based. Controls should reflect financial exposure, process criticality and reversibility—not the apparent sophistication of the underlying model. Every material agent needs a written charter: its objective, scope, delegated authority, prohibited actions and required human decision points.
Require a signed charter—objective, scope, delegated authority and human checkpoints—before any agent with standing authority goes live.
QuestionCould the team produce, this week, a charter for every agent with standing authority to act on a customer, a payment or a case file—and name who signed it?
Use the rulebook before it becomes a rule.
Singapore’s MAS, together with financial institutions and fintechs under its BuildFin.ai initiative, published the Safeguards for Agentic Finance at Runtime (SAFR) white paper on 3 July. It is an industry-developed framework for AI agents carrying out financial tasks safely, securely and reliably—not a binding supervisory rule.
That formal status matters, but it does not make the framework optional as an operating reference. SAFR makes the relevant runtime questions concrete: when an agent must pause, what needs to be recorded, and where a human must review or intervene. Those are useful control tests whether or not a firm operates in Singapore.
Treat SAFR as a working checklist. Map live agentic deployments against its runtime safeguards now, rather than waiting for a future incident or supervisory intervention to expose the gap.
QuestionAgainst SAFR’s own runtime safeguards, which live agentic deployments would pass today—and which would the firm rather not test yet?
A policy is not proof of control.
The eighth IIF-EY Global Survey on AI Use in Financial Services, covering 65 institutions, finds formal risk-management processes in place at essentially all firms that already have AI in production. On paper, governance is not the gap this survey documents: most firms can point to a structure, an owner and a policy.
The harder gap is independent assurance of third-party and vendor-supplied models. Restricted access to model architecture and engineering detail, limited visibility of model updates and retraining, and difficulty assessing performance independently all make supplier evidence incomplete. A firm can describe a governance framework without being able to demonstrate how a supplier model or agent behaves in its own environment.
Treat vendor documentation as an input to validation, never as validation itself. Require independent evidence for every third-party agent in production.
QuestionFor every vendor-supplied agent in production, can the firm produce evidence of independent validation—not the vendor’s own documentation—on request?
An agent cannot wait for the next committee.
McKinsey’s 11 September analysis is about AI-accelerated cyber risk rather than agentic deployment, but the operating-model parallel is useful. It cites industry tracking data estimating that mean time-to-exploitation for critical vulnerabilities has compressed from roughly 23 days in 2025 to around 20 hours in 2026. The precise estimate will vary; the direction of travel is clear while remediation authority remains diffused across IT, legal and business functions.
One bank example in the piece traces an 11-day exposure window not to a missing patch, but to nobody holding standing authority to approve one quickly. The same structural mismatch applies to an agent that needs pausing, reconfiguring or shutting down. A committee that meets on a fixed cycle cannot govern something that acts continuously.
Name a single accountable role, not a committee, with standing authority to pause or reconfigure a live agent outside the scheduled governance cycle.
QuestionWho holds that authority today, and how long would the decision actually take if it were tested this afternoon?
Attackers now move at machine speed, but organisations make decisions at committee speed.
Delegated authority is an enterprise control.
These layers do not sit inside one function. Cyber, compliance, procurement and vendor management each own a piece of the agent-authority question. A charter without supplier assurance behind it is a formality; a named escalation owner without a workflow-level control map has nothing reliable to escalate against.
The board question is therefore not whether agentic AI can work. It is whether the firm can show who delegated each material agent’s authority, where its boundaries sit, and who can revoke that authority without waiting for the next meeting.
For the board
Three questions worth asking this quarter
- 01
Can the team produce, this week, a signed charter for every agent with standing authority to act on a customer, a payment or a case file?
- 02
For every third-party or vendor-supplied agent in production, is there evidence of independent validation beyond the vendor’s own documentation?
- 03
Who holds standing authority today to pause or reconfigure a live agent outside the scheduled governance cycle, and how long would that decision actually take?
Sources