Financial institutions have spent several years testing generative systems in contained settings: summarising research, drafting correspondence, answering questions over internal documents. Those experiments produced useful lessons about accuracy and hallucination, but they rarely changed the underlying risk profile of a business process. The systems recommended; people decided and acted.
That boundary is eroding. A newer class of systems—often described as agentic—can initiate tasks, call other software tools, retrieve records and, in some configurations, alter data or trigger transactions. As banks, insurers and asset managers move such capabilities from pilot projects into workflows that touch payments, credit, claims and trading, the binding constraint is shifting. The difficult question is no longer whether a model can produce a plausible answer. It is whether an institution can prove that a system which acts inside its operations is governed, auditable and reversible.
That shift matters for the Global Finance Awards 2026, where the test of governance is increasingly whether it has become operating practice rather than policy language.
From recommendations to execution: the control gap
A recommendation tool and an execution-capable agent pose different risks. A recommendation can be ignored; an action must be controlled. When a system can initiate a payment, adjust a limit, file a claim or route an instruction, the institution needs controls that operate at the point of action rather than in a policy document.
The first distinction is permission. Agents should operate within explicit transaction limits, counterparty restrictions and scope boundaries. A system that can read a customer record should not automatically be able to change it. A system that can prepare a payment instruction should not automatically be able to release it. Approval gates, dual control and segregation of duties remain relevant even when the operator is software.
The second is reversibility. Not every action can be undone, but many can be designed to be. Rollback procedures, staged execution and time-bound permissions give risk teams a way to contain errors before they propagate. An agent that can call a dozen tools in sequence needs a way to stop that sequence and restore the prior state.
The third is escalation. Human override should be designed in, not bolted on. Clear thresholds should determine when an agent must hand control to a person, and those overrides should be recorded.
The inventory problem: tracing models, prompts and dependencies
Model inventories have traditionally listed statistical models, their owners, their purpose and their validation status. Agentic systems strain that approach. A single workflow may combine an external model, a retrieval layer, prompt templates, internal data sources, third-party interfaces and downstream systems that consume the output. The model is only one component of a larger decision system.
Risk teams need a live inventory that captures versions, prompt changes, data sources, tool permissions and downstream dependencies. Without it, tracing a decision or a change becomes an exercise in reconstruction. An agent that behaves differently after a vendor updates a model or a team edits a prompt is not a stable control environment.
The inventory should also record which agents can act, not just which models can predict. That distinction helps allocate oversight, set testing frequency and determine which systems require the strongest approval gates.
Third-party risk and operational resilience
Agentic systems deepen reliance on external model providers, cloud platforms and specialised tool vendors. Existing third-party risk and operational-resilience reviews can be extended to cover concentration risk, continuity of service, data residency and exit planning. The questions are familiar: what happens if the provider changes terms, withdraws a model, suffers an outage or fails? What data leaves the institution, and under what controls? Can the workflow be migrated or suspended without disrupting critical operations?
These are not abstract concerns. An agent embedded in a claims or payments workflow becomes part of the institution’s operational chain. Its provider is therefore part of that chain too. Contracts, service-level expectations and contingency plans should reflect that dependency.
Audit evidence by design
Audit trails are often treated as a reporting output. In an agentic environment they are a design requirement. Immutable logs should record what the system did, which tools it called, what data it accessed, which human approved or overrode an action, and when. Incident escalation should be defined before deployment, not after the first unexpected action.
Board accountability also needs to be explicit. If an agent can alter records or initiate transactions, the board should understand the scope of delegated authority, the limits in place and the escalation path for failures. Governance that exists only in a policy library will not withstand scrutiny when an action is disputed.
Deployment gates and integration
Deployment gates offer a practical way to sequence permissions. Before an agent receives broader authority, institutions can test data quality, bias, explainability, monitoring and post-incident review. A system might start in a read-only mode, then move to recommendation, then to execution with low limits and human approval, and only later to broader autonomy. Each stage should have clear entry and exit criteria.
These controls work best when integrated with existing model-risk, outsourcing and resilience programmes rather than treated as a separate compliance silo. The same governance committees, the same risk taxonomy and the same incident processes can be adapted. A parallel structure risks duplicating oversight while leaving gaps between frameworks.
The promise of agentic systems is that they can reduce manual effort and compress processing times. The risk is that they can also compress the distance between an error and its consequence. Institutions that treat governance as an operating discipline—permissions, inventories, audit evidence and escalation—will be better placed to capture the benefits without losing control. The Global Finance Awards 2026 provide a timely context for judging whether that discipline is becoming visible in practice.