A control plane is the set of services an AI agent cannot act without: an identity, a gateway that decides what it may do, data it is entitled to see, models and vendors the bank has vetted, a runtime that bounds it, a trace that records it, and a person who can stop it — all under a governance layer that names who is accountable. No regulator prescribes the stack, but every layer answers to documents supervisors already cite, and the questions below are phrased the way an examiner, an auditor or a search engine asks them.
Who is accountable when an AI agent acts on behalf of the bank?
The bank is — regardless of how the technology performs. Supervisors have said this in almost identical terms on both sides of the Atlantic: the ECB's 'technology is neutral, governance is not', the OCC's expectation that AI applications carry risk management 'consistent with conventional model risk management', and the FSB's first four sound practices, which put strategic direction, accountability and AI-risk integration at board level. The governance layer therefore holds the agent inventory, the risk appetite for autonomy, named owners per agent, and the policy that says which control set applies to which tier — including the path the 2026 model risk guidance left open for generative and agentic AI.
CONTROLS
- A single inventory of every AI agent and AI-enabled feature, with a named accountable owner and a materiality tier
- A board-approved risk appetite for autonomy: which decisions an agent may take, up to what value, in which functions
- A written governance path for generative and agentic AI, since the 2026 model risk guidance excludes them
- Effective challenge from risk, compliance and internal audit — not only from the technology function
ANSWERS TO
- FSB AI sound practices consultation (June 2026) · FSB — Sound Practices 1–4: strategic direction, accountability, AI in the risk framework, organisational adaptability.
- Machado speech: 'Technology is neutral, governance is not' (Feb 2026) · ECB — Three governance expectations: accountability for AI outcomes, senior-management oversight, effective challenge.
- OCC Bulletin 2026-13 · OCC — Generative and agentic AI are out of scope of model risk guidance and must be managed 'through broader risk-management and governance programs'.
- NIST AI RMF 1.0 · NIST — The Govern function: policies, roles, accountability and risk tolerance as the cross-cutting layer.
- Treasury FS AI RMF and AI Lexicon (Feb 2026) · U.S. Treasury — The sector adaptation of NIST's Govern function and a shared lexicon for AI risk categories.
Does an AI agent need its own identity and access rights?
Yes. An agent that reads data and calls systems is a principal in the bank's access-control model, and it needs an identity distinct from the human who launched it and from the service account of the platform it runs on. NIST's Center for AI Standards and Innovation has made agent identity and authorization an explicit workstream — its AI Agent Standards Initiative includes an NCCoE concept paper on software and AI agent identity and authorization — and its planned SP 800-53 overlays for single-agent and multi-agent systems will tailor existing access-control baselines to agents. Least privilege, short-lived credentials and per-agent entitlements are what make the rest of the control plane enforceable.
CONTROLS
- Every agent has its own identity, credentials and entitlement set; nothing runs on a shared or human credential
- Least privilege by default: entitlements scoped to the use case, time-bound, revocable
- Delegation is recorded: which human or system authorised the agent, for what, until when
- Access reviews include agents alongside people and service accounts
ANSWERS TO
- CAISI RFI on AI agent security (2026) · NIST — Agent security RFI and the AI Agent Standards Initiative, including agent identity and authorization.
- NIST COSAiS control overlays · NIST — Planned SP 800-53 overlays for single-agent and multi-agent systems.
- 23 NYCRR Part 500 · NY DFS — Access-privilege and MFA requirements that apply to any principal, including automated ones, at New York-regulated institutions.
How does a bank limit what an AI agent can actually do?
Through a gateway that sits between the agent and every system it can act on: an allow-list of tools and APIs, transaction and value limits, mandatory approval steps for defined actions, rate limits, and a kill switch. This is the layer where the autonomy level chosen in governance becomes enforceable, and it is what supervisors mean by 'guardrails'. The OCC observed in May 2026 that banks run generative and agentic AI 'with guardrails and human-in-the-loop accountability'; the FSB's Sound Practice 10 asks for extra human-oversight measures as agents become more autonomous; and both the EU AI Act and Colorado's ADMT Act require a human able to override an automated outcome.
CONTROLS
- Allow-listed tools and APIs per agent; anything not listed is unreachable
- Value, volume and rate limits enforced outside the model, in the gateway
- Defined actions require a human approval step; the approval is logged with the reviewer's identity
- A kill switch that revokes the agent's entitlements in one step
ANSWERS TO
- OCC Semiannual Risk Perspective, Spring 2026 · OCC — Observed practice: use limited to specific cases, guardrails, human-in-the-loop accountability.
- FSB AI sound practices consultation (June 2026) · FSB — Sound Practice 10: human oversight, with extra measures for highly autonomous agentic AI.
- Regulation (EU) 2024/1689 · EU AI Act — Article 14 human oversight for high-risk systems; deployers must ensure it (Article 26).
- SB 26-189 · Colorado AI Act — Meaningful human review by trained staff with authority to override the outcome.
- CFPB Chatbots in Consumer Finance (issue spotlight, 2023) · CFPB — Customers must be able to reach a human; 'doom loops' can violate federal consumer law.
What data controls do AI agents need?
The same ones a bank's risk data already needs, plus three that are specific to agents. Retrieval has to respect entitlements — an agent may only surface what its identity is allowed to see. Lineage has to be traceable from the answer back to the source, which is the BCBS 239 discipline the Basel Committee said in January 2026 is still 'a work in progress' at many banks and on which AI depends. And the data an agent reads, remembers or is trained on has to be protected against poisoning — the FSB names agentic memory poisoning as a risk, NIST AI 600-1 names data poisoning and privacy, and Treasury's 2024 report asked for 'nutrition labels' disclosing what trained a vendor model and how customer inputs are reused.
CONTROLS
- Entitlement-aware retrieval: the agent's identity, not the platform's, governs what it can read
- Lineage from every agent output to its sources; sources carry quality and freshness metadata
- Memory and retrieval stores are inventoried, access-controlled and monitored for poisoning
- Vendor terms state what data trains the model and how the bank's inputs are used or retained
ANSWERS TO
- BCBS 239 · Basel Committee — Accuracy, completeness, timeliness and lineage of risk data — the foundation AI depends on.
- BCBS 239 Implementation Newsletter (Jan 2026) · Basel Committee — Data lineage still 'a work in progress'; AI and automation depend on the same data quality.
- NIST AI 600-1 (Generative AI Profile) · NIST — Data privacy, information security (poisoning, prompt injection) and value-chain risks of generative AI.
- FSB AI sound practices consultation (June 2026) · FSB — Sound Practice 7 data governance; agentic memory poisoning named as a risk.
- Treasury AI cybersecurity risks report (Mar 2024) · U.S. Treasury — Data supply-chain mapping and 'nutrition labels' for vendor AI.
Are AI agents covered by model risk management or third-party risk management?
Mostly the second. The April 2026 interagency model risk guidance says generative and agentic AI models 'are not within the scope of this guidance', while the traditional models an agent may call — a credit score, a fraud model, a liquidity forecast — remain fully inside it. Because almost every bank consumes foundation models through vendors and cloud providers, the third-party framework (SR 23-4 in the US, the Basel Committee's December 2025 principles and the FSB's 2023 toolkit internationally) is the one that reaches the model itself: due diligence, contractual audit and data rights, ongoing monitoring, concentration risk, and an exit plan. Vice Chair Bowman said in May 2026 that supervisors are assessing how those expectations apply to vendor-provided AI.
CONTROLS
- Every model an agent uses is classified: in scope of model risk guidance, or a generative/agentic model under the third-party and governance path
- Foundation-model and cloud providers go through full third-party due diligence, with concentration risk assessed
- Model changes by the vendor are detected and re-evaluated; the bank does not inherit a silent upgrade
- A documented exit plan per critical provider
ANSWERS TO
- SR 26-2 · Federal Reserve — Generative and agentic AI excluded from scope; traditional models remain covered.
- SR 23-4 · Federal Reserve — Lifecycle third-party risk management for vendor AI; supervisors assessing its application (May 2026).
- BCBS Third-Party Risk Principles (Dec 2025) · Basel Committee — Twelve principles including nth-party supply chains and concentration risk.
- FSB AI monitoring report (Oct 2025) · FSB — Generative AI depends on a small number of chip, cloud and model suppliers — concentration as a systemic vulnerability.
- Bowman: AI in the Financial System (May 2026) · Federal Reserve — Confirms the carve-out and names vendor AI as an active supervisory question.
What does a safe runtime for AI agents look like?
Isolated, bounded and observable. Agents execute in sandboxes with no path to production systems except through the action gateway; each run has a budget — steps, tokens, time, spend — after which it stops; memory is scoped per task and cleared or reviewed; and multi-agent hand-offs are explicit and logged rather than emergent. The reasons are on the record: NIST's agent-security RFI asks how to constrain and monitor agent access in production and names indirect prompt injection and specification gaming; the FSB lists autonomous multi-step actions, memory poisoning and AI-generated code defects as agentic risks; the ESAs want asset inventories that include AI components; and NIST's multi-agent control overlay is the least mature of its five planned overlays, which is a signal about where the unknowns still are.
CONTROLS
- Sandboxed execution; production reachable only through the gateway
- Per-run budgets for steps, tokens, time and spend, enforced by the orchestrator
- Task-scoped memory with retention rules; long-lived memory treated as a data store
- Multi-agent hand-offs are declared in the design and visible in the trace
ANSWERS TO
- CAISI RFI on AI agent security (2026) · NIST — Constraining and monitoring agent access; indirect prompt injection; misaligned behaviour.
- FSB AI sound practices consultation (June 2026) · FSB — Agentic risks: autonomous multi-step actions, memory poisoning, AI-generated code defects.
- NIST COSAiS control overlays · NIST — Single-agent and multi-agent overlays planned; the agent overlays are the least mature.
- ESA Statement on ICT risks from frontier AI models (JC 2026 25) · EBA — Continuously updated inventories of IT assets including AI/ML components; continuous monitoring.
- NIST AI 600-1 (Generative AI Profile) · NIST — Information-security risks of generative AI, including prompt injection.
What must a bank log and monitor about its AI agents?
Enough to reconstruct any action after the fact and to notice drift before it matters. That means a trace per run — inputs, retrieved sources, tool calls, approvals, outputs — retained on a schedule; evaluation suites run before release and continuously afterwards; drift and performance monitoring against the metrics agreed at approval; and alerting that a security operations team actually receives. The EU AI Act requires automatic logging and, for deployers, six-month retention; New York DFS asked in May 2026 for stronger logging and alerting; the FSB's Sound Practice 9 covers testing and ongoing monitoring; the ECB names drift explicitly; and the SEC will examine whether firms have policies to 'monitor and supervise' AI in fraud prevention, operations, AML and trading.
CONTROLS
- A complete, tamper-evident trace per agent run, retained per policy (six months minimum where the EU AI Act applies)
- Pre-release evaluations and continuous monitoring against the approval metrics; drift thresholds trigger review
- Security alerting for anomalous agent behaviour routed to the SOC
- Audit access to traces without going through the technology team
ANSWERS TO
- Regulation (EU) 2024/1689 · EU AI Act — Article 12 automatic logging; deployers keep logs at least six months (Article 26).
- DFS Frontier AI Models Industry Letter (May 2026) · NY DFS — Strengthen logging and security-event alerting; human review of AI-generated code.
- FSB AI sound practices consultation (June 2026) · FSB — Sound Practice 9: performance management including testing and ongoing monitoring.
- Machado speech: 'Technology is neutral, governance is not' (Feb 2026) · ECB — Lifecycle model governance and drift monitoring as a risk-management focus.
- Division of Examinations FY2026 Priorities · SEC — Policies and procedures to monitor and supervise AI in fraud prevention, back office, AML and trading.
- NIST IR 8596 (Cyber AI Profile) · NIST — Cybersecurity Framework profile for securing AI components and detecting AI-enabled attacks.
What does 'human in the loop' have to mean for an AI agent to satisfy regulators?
A specific person, with the competence to understand the output and the authority to change the outcome, who actually reviews it. That is the test in every document that uses the phrase. Colorado's ADMT Act asks for review 'by trained staff with authority to override'; California's regulations take a system out of the automated-decision article only if the human reviewer knows how to interpret the output, reviews it, and can change the result; the EU AI Act's Article 14 requires oversight measures that let a person understand, monitor and intervene; the CFPB says a customer must be able to reach a human. The oversight layer defines the thresholds at which an agent must stop and escalate, who receives the escalation, how fast, and how customers get recourse.
CONTROLS
- Escalation thresholds per agent and tier: value, confidence, novelty, customer impact
- Named reviewers with documented competence and override authority; review is evidenced, not assumed
- Customer recourse: a route to a human and an explanation where a decision affects a person
- Oversight metrics reported upward: override rate, escalation volume, time-to-human
ANSWERS TO
- SB 26-189 · Colorado AI Act — Human review by trained staff with authority to override; explanation within 30 days of an adverse outcome.
- CPPA ADMT, risk-assessment and cybersecurity-audit regulations · California CPPA — A genuine human decision-maker — one who understands, reviews and can change the outcome — takes a system out of the ADMT article.
- Regulation (EU) 2024/1689 · EU AI Act — Article 14: human oversight measures for high-risk systems.
- CFPB Chatbots in Consumer Finance (issue spotlight, 2023) · CFPB — Access to a human; institutions responsible regardless of technology.
- FSB AI sound practices consultation (June 2026) · FSB — Sound Practice 10: human oversight scaling with autonomy.
Every layer has a regulator watching it
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →