# Building a system that runs a bounded agent on internal tasks: research, drafting, operations exceptions inside a bank

Source: https://www.bankingnewsai.com/agentic-banking/build/generative-agentic-ai
Last updated: Sep 17, 2026

An agent is the right pattern only when the path cannot be fixed in advance and the stakes allow the model to choose it. Inside a bank that means internal, reversible work: research across documents and systems, drafting with tool access, working an exception queue. The design that supervisors have described approvingly is a bounded one: a small, named tool set, a turn and cost budget, an action envelope, full traces, and a person sampling the output. The control plane and lifecycle on this site were written for exactly this case.

## The brief (default answers)

| Choice | Answer |
| --- | --- |
| Who is affected | Staff only |
| Reversibility | Fully |
| Stakes | Low |
| Knowledge | Both |
| Verifiability | By judgment |
| Steps | Open-ended |
| Jurisdiction | United States |
| Delivery route | Through a cloud platform |

- **Pattern:** Bounded agent — The model plans its own path through a set of tools toward a goal, inside a turn budget and an action envelope.
- **Tier:** 3, Tier 3: act within an envelope — Low stakes, reversible, internal. The model may act within a defined envelope, with sampling, monitoring and a kill switch instead of per-action review.
- **Workflow shapes:** 
- **Human involvement:** The model may act within a defined envelope; people sample, monitor and can stop it.
- **Knowledge:** Retrieval over the governed document set, with a citation on every answer and a refusal when nothing relevant is found.; Tool calls to the system of record for anything live. Never retrieval for a balance, a case status or a limit.; Documents to reason with, systems to check against: the workflow decides which question goes where before the model answers.

## Decomposition

| Step | Owner | Note |
| --- | --- | --- |
| Set the goal and the envelope | human | What done looks like, which tools, what the agent may never do. |
| Plan and act | model | Tool calls within the envelope; every call traced. |
| Enforce the envelope | system | The action gateway checks identity, entitlements, value and volume before any call executes. |
| Evaluate the result | model | An evaluator pass against the goal; failures stop or escalate. |
| Sample and approve | human | Sampled review; per-action approval for anything that leaves the bank. |

## Control layer weights (0–4)

| Layer | Weight |
| --- | --- |
| governance | 1 |
| identity | 1 |
| actions | 1 |
| data | 1 |
| models | 1 |
| runtime | 1 |
| observability | 1 |
| oversight | 0.6 |

## Documents that apply

- [SR 26-2](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-26-2) — Generative and agentic AI are outside model-risk scope; broader governance applies.
- [OCC Semiannual Risk Perspective, Spring 2026](https://www.bankingnewsai.com/ai-regulation/documents/occ-semiannual-risk-perspective-spring-2026) — Supervisors observed 'measured' agentic adoption: guardrails and human-in-the-loop accountability.
- [FSB AI sound practices consultation (June 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-ai-sound-practices-consultation-2026) — Twelve sound practices, with specific attention to generative and agentic AI.
- [CAISI RFI on AI agent security (2026)](https://www.bankingnewsai.com/ai-regulation/documents/nist-caisi-rfi-ai-agent-security-2026) — The security questions being asked of AI agents.
- [NIST AI 600-1 (Generative AI Profile)](https://www.bankingnewsai.com/ai-regulation/documents/nist-ai-600-1) — Twelve generative-AI risks and 200-plus actions.
- [SR 23-4](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-23-4) — US third-party risk management, including the model provider.
- [SB 26-189](https://www.bankingnewsai.com/ai-regulation/documents/co-sb26-189) — Colorado: notice, explanation and human review for consequential automated decisions from Jan 1, 2027.
- [BCBS Third-Party Risk Principles (Dec 2025)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-third-party-risk-principles-2025) — Nth-party supply chains and concentration on cloud providers.
- [BCBS ICT Risk Management Report (June 2026)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-ict-risk-management-range-of-practices-2026) — How supervisors look at ICT and cloud dependencies.
- [NIST AI RMF 1.0](https://www.bankingnewsai.com/ai-regulation/documents/nist-ai-100-1) — The voluntary Govern, Map, Measure, Manage frame for everything model-risk guidance leaves out.

## Evals

- A golden dataset of at least 50 real cases with expected outputs, including adversarial inputs: wrong documents, unusual formats, prompts that try to change the task.
- A judge model scoring against a written rubric (accuracy, completeness, tone, citation present), calibrated against a human-scored sample every month. Threshold set from the human sample, not guessed.
- Citation checks: every factual claim resolves to a passage in the governed set; unsupported claims below 2% of answers.
- Trace evals per step, not only end to end: which step fails, how often, at what cost, so a prompt or model change can be judged step by step.
- The same suite reruns on every prompt change, model version change and retrieval change; a regression blocks the release. That is what ongoing monitoring and outcomes analysis mean in model-risk terms.

## Human gates

- An action envelope: which tools, which systems, what value, what volume, what the model may never do.
- Sampled human review of outputs and a weekly look at the exception log.
- Turn and cost budgets, logged, with an automatic stop when exceeded.
- A kill switch that any owner can pull.

## What an examiner will ask

- Where is this system in your inventory, what tier did you assign, and who signed it off?
- What counts as a model here, and what does your validation cover for the parts that are not?
- Show me the data lineage behind the retrieval set and the training or tuning data.
- What can the system do without a person, and where is that written down?
- How do you know it is still working: which evals run, how often, and what happened the last time one failed?
- What did you do about the vendor: due diligence, contract, exit plan, concentration?
- Walk me through one wrong output from production and what the customer, if any, saw.
- Who can switch it off, and has that been tested?

## What the board should hear

- What it does: runs a bounded agent on internal tasks: research, drafting, operations exceptions; the model may act within a defined envelope; people sample, monitor and can stop it.
- Pattern: bounded agent; tier 3: act within an envelope.
- Rules it answers to: 4 documents across US, each linked in the brief.
- How we know it works: a golden dataset, automated checks on every release, and human review at the level the tier demands.
- What could go wrong and who answers: the accountable owner, the kill switch, the escalation route.

## Pitfalls

- Unbounded autonomy: no turn budget, no envelope, no kill switch.
- Granting the agent the operator's own identity instead of its own.
- Assuming model-risk validation covers it; in the US it does not, so governance must.

Change any answer on the interactive map: https://www.bankingnewsai.com/agentic-banking/build/generative-agentic-ai

---

Canonical page: https://www.bankingnewsai.com/agentic-banking/build/generative-agentic-ai
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (19 authorities, 166 documents) and AI-strategy profiles of the 100 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.