Start with a question a supervisor can now reasonably ask. Writing in American Banker, Lisa Matthews posed it directly: could a bank name the single human accountable for the ongoing performance of every AI agent running in its critical processes, the individual, not the committee, without first making a phone call?⁴ Most could not. That matters because when an autonomous agent makes a call that loses money or breaks a rule, responsibility has to land on a specific person. The supervisory architecture of finance was built around named humans with defined mandates. Agentic systems blur that picture. Outcomes emerge from the interplay of models, data, and tools, and no single decision-maker owns the result. Generative-AI-related lawsuits in the United States grew almost tenfold between 2021 and 2025, and standard insurance policies leave real coverage gaps.⁴ Liability stopped being theoretical a while ago.

The rulebook has not kept pace. In April 2026 the Federal Reserve and the OCC retired SR 11-7, their long-standing model-risk guidance, and replaced it with a revised version that states plainly that generative and agentic AI sit outside its scope.⁴ Read that twice. The central model-risk framework for US banks declines to cover the fastest-moving model risk in the building. Regulators are not asleep; the SEC and European authorities are actively drafting. But the EU AI Act assigns obligations according to an agent’s risk level and intended use, and a great deal of finance lands in the higher tiers.² Firms are left supervising probabilistic systems with tools designed for deterministic ones. The IMF puts it plainly: periodic model review does not work for adaptive agents. The job calls for real-time monitoring, complete audit trails, and the ability to step in the moment behavior drifts.³

A third wall gets less attention and deserves more. Agents are valuable in rough proportion to how much they can see, and information barriers exist precisely to stop certain people, and now certain systems, from seeing everything. An agent that ingests research, client order flow, and market data across a firm is powerful and, handled carelessly, a compliance incident waiting to happen. The same appetite for context that makes an agent good at synthesis makes it hazardous around material non-public information and the walls that separate advisory from execution. Building an agent capable enough to be worth deploying and constrained enough to stay compliant is genuinely hard. The difficulty lives entirely in permissions and architecture.

The last wall is the one that keeps regulators up at night. If many firms run similar agents, trained on similar data, reacting to similar signals, they may move the same way at the same instant. That is herding and amplification at machine speed, a crowded trade with no human finger on the pause button. Set that against market infrastructure built to process deterministic, legally certain instructions, and the mismatch looks structural.³ One firm’s agent misfiring is a risk-management problem. Ten thousand agents misfiring in unison is a financial-stability problem.

The front office is not bolted shut. But the real work is governance architecture, and the useful patterns are already taking shape. The IMF and others describe a recognizable toolkit: mandate-based authorization that fixes exactly what an agent may and may not do; architectural separation of the agent that decides from the system that executes; agent identity and audit trails so every action is attributable to a source; and tiered human-in-the-loop controls scaled to the stakes of the decision.³ The early adopters already run a version of this. Some investment banks let agents optimize client portfolios while a human oversight committee validates the consequential moves and sets the risk limits.⁵ The agent proposes. The human, for now, disposes.