An AI chatbot can give a wrong answer. An AI agent can turn that answer into a payment, a changed risk profile, or a rejected insurance claim.
That is the difference boards, CISOs, and risk teams need to govern.
Consider a lending agent that reads a customer's documents, calls a credit API, and recommends a decision. If a document contains a malicious instruction, the problem is not only what the model says. It is what the connected tools allow the agent to do next.
The new risk is authority
Agentic risk arises when an AI workflow can access data, use tools, delegate tasks, or change systems with insufficient control. In a multi-agent workflow, one bad input can travel from document extraction to risk scoring and then to a customer decision.
The security boundary must therefore sit outside the model. Every agent needs a distinct non-human identity, narrow permissions, and independently enforced limits on what it can execute.
What Indian financial institutions should check
CERT-In published its AI Security Auditing Guidelines on 4 November 2026. Its release is a reason to review AI inventories, audit coverage, agent permissions, and incident-response plans. Institutions should check the full guideline and its applicability before treating any individual control as a binding mandate. CERT-In publication
For banks and NBFCs, assess agentic underwriting, collections, and third-party AI against the applicable RBI directions and fair-practices obligations. A vendor or autonomous agent does not remove the regulated institution's own accountability.
For securities-market participants, SEBI's Cybersecurity and Cyber Resilience Framework provides a basis for assessing covered systems, monitoring, and incident response. Check the entity's category and the current implementation requirements. SEBI CSCRF
For insurers, assess automated underwriting and claims against the applicable IRDAI governance and policyholder requirements. A rejected claim should be traceable to its evidence, policy terms, and decision owner.
For personal data, map where information travels: prompts, agent memory, retrieval indexes, logs, and vendors. Apply the relevant DPDP provisions as they come into force, alongside existing sectoral obligations.
Five controls to put in place
- Give every agent its own identity. Grant access to specific tools and records for the task, rather than sharing broad service credentials.
- Separate recommendations from execution. An independent policy gate should evaluate the exact action, customer, amount, and authority before an API executes it.
- Put a human before high-impact actions. Define approval thresholds for payments, material risk-profile changes, claims exceptions, and production changes. Give reviewers the evidence, not just an approval button.
- Build a real stop mechanism. Block tool calls, revoke credentials, suspend queued work, and test what happens to transactions already in flight.
- Preserve an independent audit trail. Link agent identity, source data, tool calls, policy checks, approvals, and outcomes across the workflow.
Short-lived signed tokens help limit exposure, but a signature alone does not prevent replay. For sensitive actions, bind authorization to the intended transaction and enforce single use.
The boardroom test
Pick one agent with access to a financial system. Ask three questions:
- Who authorized it, and what can it do right now?
- Can we show why its last material action was allowed?
- Can we stop it before the next action reaches a customer or payment system?
If the answers are unclear, the institution has an identity and control problem, not just a model problem.
Top comments (0)