They should not wait for a dedicated AI rulebook before governing the system. The better approach is to apply broader risk principles now, then bind AI data, access, and lineage evidence into the existing governance programme. That keeps accountability intact while the regulatory perimeter continues to evolve.
Why banks should not wait for a perfect AI rulebook
When model-risk guidance does not yet name agentic ai, the right response is not to stand still. Banks already have enough governance machinery to manage new AI behaviour if they treat the system as a supervised, evidence-backed control problem. The key is to govern the autonomy, data use, and decision boundaries now, rather than waiting for a future label to make the risk real.
That means the control question shifts from “is there a dedicated rule for this exact system?” to “can we explain who authorised it, what it can touch, and what evidence proves it stayed inside bounds?” For agentic systems, those answers matter more than the product category.
In practice, this is where a clear distinction between AI agents vs agentic AI helps. A bank does not need to treat every AI feature as an autonomous actor, but once a system can take actions, chain steps, or use tools, governance has to move beyond model output review and into action-level control.
What to bind into existing governance
The most durable approach is to extend current governance with three evidence lines: the data the system can see, the access it can use, and the lineage that shows how outputs and actions were produced. Those are not cosmetic additions. They are the audit trail that lets risk, compliance, and technology teams test whether the system is behaving within approved purpose, scope, and accountability boundaries.
That also means capturing delegated authority explicitly. If an agent can act on behalf of a human, access a tool, or trigger a downstream workflow, the bank should record the principal, the approval basis, and the expiry or revocation condition. An Agentic AI Identity Guide is useful here because it frames identity, registration, delegation, and retirement as lifecycle controls rather than as an abstract AI concern.
For the access side, banks should treat agent permissions as a bounded authorisation problem, not a static configuration problem. The useful control question is whether each action is constrained by task, context, and time, so that the system cannot accumulate standing power simply because it is useful. That is exactly the logic behind AI Agent Authorisation Guide, where least privilege, just-in-time access, and per-action decisions are central.
How to keep accountability intact while the perimeter evolves
Accountability survives uncertainty when the bank can show three things: a human or committee owned the decision to deploy the system, a control owner can explain the operating envelope, and evidence exists to reconstruct what happened when the agent acted. That is why logging, attribution, and incident-ready observability belong in the governance design from the start, not as a later monitoring enhancement.
Where an agent can write, trade, approve, recommend, or retrieve sensitive information, the bank should require a clear kill-switch path and periodic validation that revocation actually works. If access cannot be stopped quickly, then the organisation has not really governed autonomy, it has merely documented it. For operational follow-through, AI Agent Observability, Audit and Incident Response Guide is a strong fit because it ties logs, attribution, anomaly signals, and response actions together.
The governance programme should also preserve lineage. If the bank cannot trace which inputs, retrieval sources, prompts, policies, or tool calls shaped a decision, then the system may be functioning, but it is not governable at audit depth. The practical standard is simple: if a reviewer cannot reconstruct the chain of authority and evidence after the fact, the system should not be treated as low risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST AI RMF set the technical controls, while ISO/IEC 27001:2022 and ISO/IEC 42001:2023 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Agentic systems rely on credentials and tokens that must be rotated and revoked. |
| AC-6 — Least Privilege | The question is about bounding agent authority within existing governance. | |
| AU-2 — Event Logging | Banks need evidence of agent actions, approvals, and lineage for accountability. | |
| Recommendation — Manage agent credentials with rotation, revocation, and expiry controls. Constrain agent actions to the minimum privileges needed for each task. Log agent actions and governance decisions with enough detail to reconstruct events. | ||
| NIST AI RMF | GOVERN | The subject is AI governance in the absence of AI-specific model-risk rules. |
| Recommendation — Establish accountable AI governance that extends existing risk controls to agentic systems. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Agentic systems require explicit access boundaries and approval for system use. |
| A.8.15 — Logging | The answer depends on lineage and reconstructable evidence for autonomous actions. | |
| Recommendation — Define and enforce access rules for agent actions and supporting systems. Capture logs that support attribution, review, and incident reconstruction. | ||
| ISO/IEC 42001:2023 | 6.1 — Actions to address risks and opportunities | Banks must treat agentic AI as a governed risk even without a dedicated rulebook. |
| 9.1 — Monitoring, measurement, analysis and evaluation | The answer requires measurable evidence that agent behaviour stays within bounds. | |
| Recommendation — Use risk treatment actions to extend governance to agentic AI. Measure and evaluate agent behaviour against approved operating limits. | ||
Practitioner Guidance
What to prioritise: Start with systems that can already touch customer data, internal workflows, payments, trading support, or case handling. Those are the places where autonomy turns into material exposure fastest, and where a weak governance response is hardest to unwind.
What to verify: Confirm that every agent has an owner, every privileged action has a policy basis, and every high-impact step leaves evidence that can be reviewed independently of the model vendor or application team.
Decision rule: If the system can act outside a purely advisory role, govern it as an operational actor with bounded authority. If it cannot produce usable lineage and revocation evidence, treat that as a control gap, not a documentation gap.
Practitioner takeaway: Banks do not need perfect AI-specific guidance before acting, but they do need a defensible control story now, one that makes autonomy observable, authority bounded, and accountability testable.
Related resources from NHI Mgmt Group
- What makes agentic AI an NHI governance issue?
- Why do generative and agentic AI create problems for traditional model risk management?
- Why do agentic AI workloads increase governance risk compared with normal model calls?
- Why do AI coding tools create governance and cost risk when they connect directly to external model providers?