The question for AI agents in finance has changed. It used to be whether an agent could be stopped. Now it is whether anyone can prove it should have been allowed.
In October, three of the largest U.S. banks drew the same line. Citi said it does not allow third-party AI agents to log into customer accounts or carry out transactions directly. JPMorgan said it will keep outside agents away from client accounts until its own protections are ready. Bank of America said it believes "a human should remain in the loop to approve money leaving an account," and will keep its restriction while it works out who is liable when an AI authorizes a payment.
Each bank used different words, but the common thread is plain: no money leaves an account on an agent's say-so without clear human accountability.
It's easy to read that as "no." I see it as a precise question.
Two different questions
Ask anyone selling agent-controls what their product does, and most answers fall into one of two questions.
The first is about access. May this agent call this tool? Is this request well-formed, inside its permissions, and free of injected instructions? This question is being answered well. Gateways, policy engines, and identity systems can intercept an agent's tool call and allow or refuse it, and the cost of doing so is falling fast.
The second is about authority. Was this action, for this amount, to this beneficiary, authorized: under which rules, by whom, and can you show it afterward to someone who wasn't there?
The first question protects the system. The second is what a bank, its examiner, and its customer need answered before money moves. They are not the same question, and a good answer to the first does not answer the second.
What proof requires
Proof is not one feature. It is a short list of things that must all be true at once.
Every applicable authority is checked, not just the one configured. A wire is governed simultaneously by law, regulation, the institution's policy, and local limits. Each holds a veto within its domain. If any one authority says no, the answer is no, and the record names which one.
In practice, each source of rules (law, regulation, institutional policy, local limits) evaluates the action independently, at the moment of the transaction. A refusal from any of them stops the action, and the record keeps every authority's answer, not just the final one, so a reviewer can see exactly which rule decided it.
The approver must be competent and must not be the requester. Banks have run dual control and signing limits for decades. An agent does not change that principle; it just adds a new kind of requester the same principle must cover.
Authority is checked again at execution. An approval given at 10:41 can be wrong by 10:52 if a limit was reached in between. The decision that matters is the one in force when the money moves.
The record explains itself. Not a log line saying an action happened, but a record naming the rule, the authority, and the reason. It should be stored so that any change can be detected, for example, an append-only log in which each entry is cryptographically linked to the one before it or write-once storage. That way, you can always check a record later against the rules in force at the time.
Each of these is old in banking. What is new is applying all of them together to a requester that is software.
A human in the loop is the right instinct
Bank of America's position that a person should approve money leaving an account is sound. But approval alone is not proof. A person can only meaningfully approve what they see: which rules applied, which were satisfied, and why this item reached them. Without that, human approval becomes a signature on a decision someone else made, and at volume it becomes a reflex.
The goal is not to remove humans. It is to ensure the human approves the right things, for the right reasons, with a record that shows both.
Why this is the question that moves agents into production
Regulators have not prescribed how to do this. The banking agencies' revised model-risk guidance placed agentic AI outside its scope this April while leaving institutions responsible for governing it. The EU AI Act requires automatic logging and meaningful human oversight for high-risk systems. FINRA's 2026 oversight report lists, among the risks of AI agents, acting “without human validation and approval,” acting “beyond the user's actual or intended scope and authority,” and outcomes that are “difficult to trace or explain.” None of them says how.
That gap is where pilots stall. An agent that works in a demonstration still cannot move money in production until someone can answer the authority question in a form an examiner will accept. Until then, the exposure stays with the bank: regulatory findings, failed audits, and customer disputes it cannot resolve.
Three questions worth asking now
For any agent your institution is piloting, or any vendor you're evaluating:
1. When an agent's action is refused, can you tell which rule, from which authority, refused it? (Not "a policy," but the specific rule and who owns it.)
2. When an action is approved, can you show who approved it, that they were entitled to, and that they were not the requester?
3. Six months from now, could you show an examiner why a specific payment was allowed, against the rules that were in force that day?
If the answers are clear, you have proof. If they aren't, you have interception, which is necessary and valuable, but it is not the same thing.
Triarcus Systems builds Cathedral, a governance architecture for autonomous systems. A working implementation runs today. info@triarcussystems.com