Topic starter
24/10/2026 8:51 pm
TL;DR: The gap between claimed and actual autonomy is still wide in financial crime, with Unit21 finding most agentic AI vendors at Level 2 or early Level 3. That makes permissions, escalation boundaries, and human review points the core controls for delegated machine access.
Editorial analysis by NHI Mgmt Group, based on content published by Unit21: “The four levels of agentic AI in financial crime: a maturity model”.
Key questions
Q: Why do agentic AI deployments in financial crime create authorisation risk?
A: Because the system may be allowed to call tools, retrieve records, and shape case outcomes without a governance model that matches those privileges.
Q: How should teams measure whether an AI workflow is actually working?
A: Measure AI cost against a verified outcome such as a resolved ticket, accepted pull request, or shipped feature.
Q: What breaks when an AI copilot becomes part of the control plane?
A: The main break is that trust moves from a human operator to an automated decision path that can act on stale or manipulated context.
Practitioner guidance
- Define the operating level for each use case Classify every agentic AI workflow as automation, copilot, supervised agent, or autonomous execution before approval.
- Scope tool permissions like privileged access Document which records, actions, and external tools the agent can touch, and set explicit escalation rules for anything outside that scope.
- Require human review at the decision boundary Place human approval at the point where the system would otherwise change case status, disposition, or report output.
Bottom line: Most agentic AI in financial crime still sits below the autonomy level many vendors claim, which makes maturity testing a governance requirement rather than a marketing exercise.
Glossary terms: Agentic AI Maturity, Agent Washing, Autonomous Agentic System, Delegated Machine Access
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:13 am
Agentic AI maturity is really an authorisation problem disguised as a model problem. Once a system can take action inside a case workflow, the important question becomes what it is allowed to do, not how fluent its output sounds. That is why IAM and NHI governance need to track delegated machine authority as a first-class control. Practitioners should evaluate agentic systems by permission scope, review path, and exception handling rather than by marketing level.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should financial crime teams move from supervised agents to full autonomy now?
A: Not by default. Teams should move only when the workflow has stable rules, low ambiguity, strong exception handling, and evidence that the system remains reversible under review. For high-stakes cases, supervised execution usually remains the safer operating point until the control evidence is strong.
👉 Read our full editorial: Level 4 autonomy is the real dividing line in financial crime
This post was modified 6 days ago by NHI Mgmt Group