It means banks need a way to identify, authorise, and retire non-human actors that can act on a customer’s behalf. The critical questions are who delegated the authority, what actions the agent can take, and how that authority is constrained over time. Without that layer, agentic automation becomes an ungoverned trust extension.
What Know Your Agent adds to banking governance
know your agent turns agentic automation into a governed relationship rather than an informal shortcut. In banking, that means treating the agent as a distinct actor with an owner, a purpose, a scope of authority, and an expiry or retirement point. It also means the bank can answer the operational question that matters most: what this agent is allowed to do, for whom, and under what conditions.
That framing matters because banking governance is not only about the model or workflow, but about delegated authority. A customer-facing agent can touch payments, account information, onboarding, service requests, or other regulated actions only if the bank can prove the delegation path and keep it within policy.
For readers looking for the broader identity pattern behind this, the Agentic AI Identity Guide explains how agent identity, delegation, and retirement fit together across the lifecycle. The governance point for banks is that no agent should be allowed to operate on trust alone; it needs an explicit principal, bounded authority, and a revocation path.
How banking controls should change when an agent acts on a customer’s behalf
The control model should shift from “can the user sign in?” to “can this agent act, and on whose authority?” That requires a clear delegation record, per-action authorization, and a reviewable relationship between the customer, the bank, and the automated actor. In practice, the bank should be able to distinguish between informational actions, low-risk service actions, and higher-risk transactional actions.
That distinction is what makes consent usable in governance. If an agent can initiate a transfer, change standing instructions, or update beneficiary details, the bank needs stronger policy boundaries than for a balance check or a document retrieval task. The authority should be time-bound and scope-bound, not a permanent proxy for the customer.
Where the governance problem is specifically about how to constrain an agent’s permissions, the AI Agent Authorisation Guide is the most direct internal reference. The related external standard path is token delegation, and the delegation concept maps cleanly to RFC 8693: OAuth 2.0 Token Exchange, which is the right model when an agent needs a narrower token than the human principal.
Why the lifecycle matters more than the login
Know Your Agent is not a one-time onboarding check. Governance weakens when the agent remains active after the business purpose has ended, the permissions drift, or the underlying vendor or workflow changes without review. Banks should therefore manage agent registration, re-approval, periodic recertification, and retirement as part of the same governance chain.
This is also where auditability becomes practical. If the bank cannot show which delegation was in force at a given time, it cannot reliably explain an automated action after a complaint, fraud event, or compliance review. The lifecycle question is not just whether the agent was approved, but whether the approval remained valid when the action occurred.
For a broader control lens, the identity and access implications are also covered well by the Zero Trust for AI Agents guide, especially where standing privilege should be removed and each action should be verified. The same governance discipline is echoed in the NIST AI Risk Management Framework, which is useful when the bank needs to structure accountability, oversight, and ongoing risk treatment for AI-enabled services.
Risk and Threat Considerations
Agentic banking workflows create a trust-extension risk: once an agent is accepted as an actor on behalf of a customer, any weakness in delegation, scope, or revocation can turn convenience into unauthorised access or action. The main threat is not the model alone, but the combination of standing authority, weak policy enforcement, and poor visibility into what the agent actually did.
Failure mechanism: The bank grants the agent broad or durable authority, then loses track of who approved it, what it may do, or when the approval should end. That can lead to overreach, delegated fraud, or an unreviewable action trail if the agent is abused or misconfigured.
Impact: Customers can suffer unauthorised transactions, account changes, or exposure of sensitive banking data, while the bank inherits investigation, restitution, and conduct risk. In severe cases, weak agent governance also creates a path for prompt-driven abuse, token misuse, or hidden policy bypass inside otherwise legitimate automation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST AI RMF and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent authority and delegated action scope are central to banking governance. |
| Recommendation — Enforce least privilege and approval gates for every agent action. | ||
| NIST AI RMF | GOVERN — Govern | Banks need governance, accountability, and oversight for agentic services. |
| Recommendation — Assign accountable owners and oversight processes for each agent. | ||
| NIST SP 800-53 Rev 5 | IA-9 — Identification and Authentication (Service and System Accounts) | Agentic systems act as non-human actors that must be authenticated and bounded. |
| AC-6 — Least Privilege | Delegated agent authority should be constrained to the minimum required actions. | |
| AU-2 — Event Logging | Banks need a reviewable record of delegated actions and authority changes. | |
| Recommendation — Authenticate agent-to-system access with service-level controls. Limit each agent to the minimum actions needed for its task. Log agent approvals, actions, and revocations for auditability. | ||
Practitioner Guidance
What to prioritise: Start with the highest-risk delegated actions, not with low-risk convenience use cases. If an agent can move money, change account state, or reveal regulated data, it needs tighter approval, shorter lifetimes, and a clearer ownership model than a service agent that only drafts responses.
What to verify: Confirm that every production agent has a named business owner, an explicit scope, a revocation mechanism, and a review cadence. If any one of those is missing, the governance record is incomplete even if the technical workflow appears to work.
Practitioner takeaway: Know Your Agent is the banking equivalent of making delegation auditable, bounded, and revocable, because without those three properties an agent becomes a persistent trust extension rather than a controlled representative.
Related resources from NHI Mgmt Group
- Guide: Identity Proofing and KYC Guide
- Why is single-provider AI agent governance not enough for enterprise security?
- What does the 144:1 NHI-to-human ratio mean for IAM governance programmes?
- What makes agentic AI an NHI governance issue?
- What is the difference between attack surface management and NHI governance?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org