AI agents in banking · Control plane

Eight layers every agent
in a bank runs on.

Last updated Sep 6, 2026 · Updated as regulators move

A control plane is the set of services an AI agent cannot act without: an identity, a gateway that decides what it may do, data it is entitled to see, models and vendors the bank has vetted, a runtime that bounds it, a trace that records it, and a person who can stop it — all under a governance layer that names who is accountable. No regulator prescribes the stack, but every layer answers to documents supervisors already cite, and the questions below are phrased the way an examiner, an auditor or a search engine asks them.

The eight control layers an AI agent in a bank runs onLAYERWHAT IT DECIDESANSWERS TO0Governance and accountabilityWho owns the outcomeFSB AI sound practices consultation (June 2026)Machado speech: 'Technology is neutral, governance is not' (Feb 2026)OCC Bulletin 2026-131Identity and entitlementsWho the agent isCAISI RFI on AI agent security (2026)NIST COSAiS control overlays23 NYCRR Part 5002Action gatewayWhat the agent may doOCC Semiannual Risk Perspective, Spring 2026FSB AI sound practices consultation (June 2026)Regulation (EU) 2024/16893Data and knowledgeWhat the agent may knowBCBS 239BCBS 239 Implementation Newsletter (Jan 2026)NIST AI 600-1 (Generative AI Profile)4Models and vendorsWhat the agent thinks withSR 26-2SR 23-4BCBS Third-Party Risk Principles (Dec 2025)5Runtime and orchestrationWhere the agent runsCAISI RFI on AI agent security (2026)FSB AI sound practices consultation (June 2026)NIST COSAiS control overlays6Observability, evaluation and auditWhat the bank can seeRegulation (EU) 2024/1689DFS Frontier AI Models Industry Letter (May 2026)FSB AI sound practices consultation (June 2026)7Human oversight and escalationWhen a person steps inSB 26-189CPPA ADMT, risk-assessment and cybersecurity-audit regulationsRegulation (EU) 2024/1689POLICYENFORCED IN CODEPEOPLE
Figure 1 · The control plane. Governance sets the policy; layers 1–6 enforce it in code; human oversight closes the loop. Right column: the primary documents each layer answers to.

Who is accountable when an AI agent acts on behalf of the bank?

The bank is — regardless of how the technology performs. Supervisors have said this in almost identical terms on both sides of the Atlantic: the ECB's 'technology is neutral, governance is not', the OCC's expectation that AI applications carry risk management 'consistent with conventional model risk management', and the FSB's first four sound practices, which put strategic direction, accountability and AI-risk integration at board level. The governance layer therefore holds the agent inventory, the risk appetite for autonomy, named owners per agent, and the policy that says which control set applies to which tier — including the path the 2026 model risk guidance left open for generative and agentic AI.

CONTROLS

  • A single inventory of every AI agent and AI-enabled feature, with a named accountable owner and a materiality tier
  • A board-approved risk appetite for autonomy: which decisions an agent may take, up to what value, in which functions
  • A written governance path for generative and agentic AI, since the 2026 model risk guidance excludes them
  • Effective challenge from risk, compliance and internal audit — not only from the technology function

ANSWERS TO

Does an AI agent need its own identity and access rights?

Yes. An agent that reads data and calls systems is a principal in the bank's access-control model, and it needs an identity distinct from the human who launched it and from the service account of the platform it runs on. NIST's Center for AI Standards and Innovation has made agent identity and authorization an explicit workstream — its AI Agent Standards Initiative includes an NCCoE concept paper on software and AI agent identity and authorization — and its planned SP 800-53 overlays for single-agent and multi-agent systems will tailor existing access-control baselines to agents. Least privilege, short-lived credentials and per-agent entitlements are what make the rest of the control plane enforceable.

CONTROLS

  • Every agent has its own identity, credentials and entitlement set; nothing runs on a shared or human credential
  • Least privilege by default: entitlements scoped to the use case, time-bound, revocable
  • Delegation is recorded: which human or system authorised the agent, for what, until when
  • Access reviews include agents alongside people and service accounts

ANSWERS TO

  • CAISI RFI on AI agent security (2026) · NISTAgent security RFI and the AI Agent Standards Initiative, including agent identity and authorization.
  • NIST COSAiS control overlays · NISTPlanned SP 800-53 overlays for single-agent and multi-agent systems.
  • 23 NYCRR Part 500 · NY DFSAccess-privilege and MFA requirements that apply to any principal, including automated ones, at New York-regulated institutions.

How does a bank limit what an AI agent can actually do?

Through a gateway that sits between the agent and every system it can act on: an allow-list of tools and APIs, transaction and value limits, mandatory approval steps for defined actions, rate limits, and a kill switch. This is the layer where the autonomy level chosen in governance becomes enforceable, and it is what supervisors mean by 'guardrails'. The OCC observed in May 2026 that banks run generative and agentic AI 'with guardrails and human-in-the-loop accountability'; the FSB's Sound Practice 10 asks for extra human-oversight measures as agents become more autonomous; and both the EU AI Act and Colorado's ADMT Act require a human able to override an automated outcome.

CONTROLS

  • Allow-listed tools and APIs per agent; anything not listed is unreachable
  • Value, volume and rate limits enforced outside the model, in the gateway
  • Defined actions require a human approval step; the approval is logged with the reviewer's identity
  • A kill switch that revokes the agent's entitlements in one step

ANSWERS TO

What data controls do AI agents need?

The same ones a bank's risk data already needs, plus three that are specific to agents. Retrieval has to respect entitlements — an agent may only surface what its identity is allowed to see. Lineage has to be traceable from the answer back to the source, which is the BCBS 239 discipline the Basel Committee said in January 2026 is still 'a work in progress' at many banks and on which AI depends. And the data an agent reads, remembers or is trained on has to be protected against poisoning — the FSB names agentic memory poisoning as a risk, NIST AI 600-1 names data poisoning and privacy, and Treasury's 2024 report asked for 'nutrition labels' disclosing what trained a vendor model and how customer inputs are reused.

CONTROLS

  • Entitlement-aware retrieval: the agent's identity, not the platform's, governs what it can read
  • Lineage from every agent output to its sources; sources carry quality and freshness metadata
  • Memory and retrieval stores are inventoried, access-controlled and monitored for poisoning
  • Vendor terms state what data trains the model and how the bank's inputs are used or retained

ANSWERS TO

Are AI agents covered by model risk management or third-party risk management?

Mostly the second. The April 2026 interagency model risk guidance says generative and agentic AI models 'are not within the scope of this guidance', while the traditional models an agent may call — a credit score, a fraud model, a liquidity forecast — remain fully inside it. Because almost every bank consumes foundation models through vendors and cloud providers, the third-party framework (SR 23-4 in the US, the Basel Committee's December 2025 principles and the FSB's 2023 toolkit internationally) is the one that reaches the model itself: due diligence, contractual audit and data rights, ongoing monitoring, concentration risk, and an exit plan. Vice Chair Bowman said in May 2026 that supervisors are assessing how those expectations apply to vendor-provided AI.

CONTROLS

  • Every model an agent uses is classified: in scope of model risk guidance, or a generative/agentic model under the third-party and governance path
  • Foundation-model and cloud providers go through full third-party due diligence, with concentration risk assessed
  • Model changes by the vendor are detected and re-evaluated; the bank does not inherit a silent upgrade
  • A documented exit plan per critical provider

ANSWERS TO

  • SR 26-2 · Federal ReserveGenerative and agentic AI excluded from scope; traditional models remain covered.
  • SR 23-4 · Federal ReserveLifecycle third-party risk management for vendor AI; supervisors assessing its application (May 2026).
  • BCBS Third-Party Risk Principles (Dec 2025) · Basel CommitteeTwelve principles including nth-party supply chains and concentration risk.
  • FSB AI monitoring report (Oct 2025) · FSBGenerative AI depends on a small number of chip, cloud and model suppliers — concentration as a systemic vulnerability.
  • Bowman: AI in the Financial System (May 2026) · Federal ReserveConfirms the carve-out and names vendor AI as an active supervisory question.

What does a safe runtime for AI agents look like?

Isolated, bounded and observable. Agents execute in sandboxes with no path to production systems except through the action gateway; each run has a budget — steps, tokens, time, spend — after which it stops; memory is scoped per task and cleared or reviewed; and multi-agent hand-offs are explicit and logged rather than emergent. The reasons are on the record: NIST's agent-security RFI asks how to constrain and monitor agent access in production and names indirect prompt injection and specification gaming; the FSB lists autonomous multi-step actions, memory poisoning and AI-generated code defects as agentic risks; the ESAs want asset inventories that include AI components; and NIST's multi-agent control overlay is the least mature of its five planned overlays, which is a signal about where the unknowns still are.

CONTROLS

  • Sandboxed execution; production reachable only through the gateway
  • Per-run budgets for steps, tokens, time and spend, enforced by the orchestrator
  • Task-scoped memory with retention rules; long-lived memory treated as a data store
  • Multi-agent hand-offs are declared in the design and visible in the trace

ANSWERS TO

What must a bank log and monitor about its AI agents?

Enough to reconstruct any action after the fact and to notice drift before it matters. That means a trace per run — inputs, retrieved sources, tool calls, approvals, outputs — retained on a schedule; evaluation suites run before release and continuously afterwards; drift and performance monitoring against the metrics agreed at approval; and alerting that a security operations team actually receives. The EU AI Act requires automatic logging and, for deployers, six-month retention; New York DFS asked in May 2026 for stronger logging and alerting; the FSB's Sound Practice 9 covers testing and ongoing monitoring; the ECB names drift explicitly; and the SEC will examine whether firms have policies to 'monitor and supervise' AI in fraud prevention, operations, AML and trading.

CONTROLS

  • A complete, tamper-evident trace per agent run, retained per policy (six months minimum where the EU AI Act applies)
  • Pre-release evaluations and continuous monitoring against the approval metrics; drift thresholds trigger review
  • Security alerting for anomalous agent behaviour routed to the SOC
  • Audit access to traces without going through the technology team

ANSWERS TO

What does 'human in the loop' have to mean for an AI agent to satisfy regulators?

A specific person, with the competence to understand the output and the authority to change the outcome, who actually reviews it. That is the test in every document that uses the phrase. Colorado's ADMT Act asks for review 'by trained staff with authority to override'; California's regulations take a system out of the automated-decision article only if the human reviewer knows how to interpret the output, reviews it, and can change the result; the EU AI Act's Article 14 requires oversight measures that let a person understand, monitor and intervene; the CFPB says a customer must be able to reach a human. The oversight layer defines the thresholds at which an agent must stop and escalate, who receives the escalation, how fast, and how customers get recourse.

CONTROLS

  • Escalation thresholds per agent and tier: value, confidence, novelty, customer impact
  • Named reviewers with documented competence and override authority; review is evidenced, not assumed
  • Customer recourse: a route to a human and an explanation where a decision affects a person
  • Oversight metrics reported upward: override rate, escalation volume, time-to-human

ANSWERS TO

Every layer has a regulator watching it

6 curated AI stories for banking executives · Every morning · Free

Subscribe to BankingNewsAI →