By Ercin Dedeoglu, AI Architect.
Look. About 4,000 requests a month. That's how many calls AI agents send through one secure gateway into a UAE bank's digital banking, payments and enterprise systems [1]. Not a lab. Not a slide. A live integration platform that processes an average of 650 transactions per second [1].
That's the Mashreq pilot with IBM, announced on 12 October 2026 [1]. The agents help engineers with design, code review and troubleshooting. IBM reports up to a 60 to 70% cut in time spent on integration design and troubleshooting. Early numbers. IBM's own numbers [1][2]. Fine. Big claim, but fine.
Here's the part nobody wrote down. Fintechly put it plainly: Mashreq "hasn't said ... what controls apply when an agent's suggested change touches live payment systems" [2]. That's the WHOLE question. That's the question your board will ask. That's the question an auditor will ask.
I'm Ercin Dedeoglu. I design LLM, RAG and agentic systems for regulated banking. So let me answer it. Not for Mashreq (I have no inside view of their controls, none). For any UAE bank putting agents behind a gateway.
Three words. Remember them. The Gateway Decides.
Does The CBUAE AI Note Even Cover Agents?
Frankly, not by name. The CBUAE Guidance Note on AI and ML for licensed financial institutions (issued on 11 Feb 2026 per the rulebook) never says "agent". It never says MCP [3]. It's consumer-protection guidance. Say that out loud before anyone overclaims it.
But it covers "AI models, systems or technologies" [3]. An agent fleet is an AI system. Its tools are part of that system. So the clauses still bite. Every one of them. The honest word is "maps to". Not "requires". Keep that word straight and your compliance team will trust the rest.
I wrote the clause-by-clause read of the note itself, generative AI section included, on Hugging Face. This piece is the agent half.
Why Is The Gateway The Governance Boundary?
Because it's the ONE place every agent call has to pass. One place. The agent's reasoning happens in a model you may not fully control. The bank systems sit behind it. The gateway sits in between, and Fintechly notes it "limits and records what each agent can reach" [2].
Everything you can enforce, you enforce there. Everything you can log, you log there. Skip it and you're running Trust-By-Default. Every agent inherits whatever the last human approved. Very convenient. Very dangerous. WRONG.
The research backs this up. AgentBound, published at FSE 2026 (Proceedings of the ACM on Software Engineering), studied the 296 most popular MCP servers [4]. Its starting point: MCP servers "typically execute natively on host systems with few or no restrictions" [4]. Its answer is a declared permission manifest per server plus an enforcement engine. Policies were generated from source code with 80.9% accuracy, and enforcement added about 0.6 ms on average [4]. Least privilege. Cheap. Measurable. Tremendous.
Figure 1. The agent gateway as the governance boundary. Clause mapping is "maps to", not "requires" [3].
What Five Controls Should The Gateway Enforce?
Here's the deal. Five controls. Each one tied to a clause the bank ALREADY has to meet.
| # | Gateway control | What it means in practice | CBUAE note clause it maps to [3] |
|---|---|---|---|
| 1 | Agent and tool inventory | Every agent AND every tool it can call gets an entry: name, purpose, risk rating | 2(f), 9(c) |
| 2 | Scoped, per-call authorisation | No standing credentials. Each call carries its own scope, checked at the gateway | 2(b) |
| 3 | Update gate | New model versions, new tools, changed tool definitions are tested before they go live | 6(c) |
| 4 | Vendor audit rights | Hosted agents and third-party MCP servers come with audit and information rights | 6(e), 9(a) |
| 5 | One-switch stop | A human can cut off one agent, one tool or the whole fleet, immediately | 6(f) |
1. Inventory. The note wants an inventory of "all AI models, systems or technologies" with at least "model name, purpose, risk rating" [3]. Most banks list the model. Then they stop. Wrong place to stop. The tools are where the agent touches money. List them. Rate them. Separately.
2. Scoped, per-call authorisation. The note says LFIs "should not employ AI models that they have no control over" [3]. Control means the gateway decides, call by call, what this agent may do right now. A token that was fine for yesterday's ticket is NOT approval for today's payment change. Every call earns its own yes.
3. Update gate. The note says "automatic updates [of] their AI tools are tested before implementation" [3]. With agents, the update isn't just the model. It's a new tool. A changed tool description. A new MCP server version. Pin them. Test them. Then release them.
4. Vendor audit rights. LFIs "should remain responsible for outsourced AI functions", with audit and information rights from providers [3]. If an agent or an MCP server runs on someone else's infrastructure, that contract clause is your only window into it. Get it signed before the pilot, not after.
5. One-switch stop. The note says LFIs "should at all times retain the clear and immediate ability, with human intervention, to cease use of an AI model system" [3]. For an agent fleet that's a kill switch at the gateway. Per agent. Per tool. Fleet-wide. Tested on a schedule, not on the day of the incident.
Which Agent Tasks Can Run Without A Human Approving Each Step?
The note gives you three oversight models [3]:
- Human-in-the-loop: the AI recommends, a human approves or rejects.
- Human-on-the-loop: the AI works autonomously on routine tasks, a human monitors and can step in.
- Human-out-of-the-loop: only "for low-risk, non-material processes with appropriate controls in place."
Map agent work onto that. Reading API specs and logs to suggest a fix? On-the-loop is defensible. Drafting a mapping for an engineer to review? On-the-loop. Anything that changes a live payment path? In-the-loop. Always. Fintechly notes that banks testing agents in engineering typically keep a person approving any change before it goes live [2]. Good. Write it into the gateway policy so it isn't a habit. It's a rule.
What About Agentic AI In Banking Beyond Engineering?
Engineering assist is the easy first step. Low customer exposure. Lots of reading and searching. The hard step comes when agents touch customer-facing flows: disputes, payments, onboarding. Same five controls. Higher stakes. And for any decision that "materially affects a customer's access to financial products or services", the note's high-impact rules on transparency and human review kick in [3].
Does Running Models On-Prem Fix This?
Mashreq is "exploring a future on-premises deployment" with "locally hosted models to address data residency and regulatory requirements" [1]. Smart move for residency. But residency answers WHERE the model runs. It doesn't answer WHAT the agent is allowed to do. You still need the gateway. On-prem or cloud. Same five controls.
So What Should A UAE Bank Do First?
Pick the gateway as your control point and fill in the table above before the pilot grows. Inventory first, then per-call scopes, then the stop switch. Test the stop switch BEFORE you need it.
If you want the testing side, I keep an open LLM red-teaming checklist for banking (Zenodo DOI 10.5281/zenodo.23536860), and the full write-up is on Hugging Face.
The Gateway Decides. Make sure yours does.
Sources
- IBM MEA Newsroom, "Mashreq Pilots IBM Bob to Advance Agentic AI for Integration Engineering", 12 Oct 2026. https://mea.newsroom.ibm.com/mashreq-pilots-ibm-bob-to-advance-agentic-ai-for-integration-engineering
- Fintechly, "Mashreq Pilots IBM's AI Agents on the Integration Platform Behind Its Payments", Oct 2026. https://fintechly.com/ai/mashreq-pilots-ibms-ai-agents/
- Central Bank of the UAE, Guidance Note on the Consumer Protection and Responsible Adoption and Use of AI and ML by Licensed Financial Institutions in the U.A.E., issued 11/2/2026. https://rulebook.centralbank.ae/en/rulebook/guidance-note-consumer-protection-and-responsible-adoption-and-use-artificial-intelligence
- C. Bühler, M. Biagiola, L. Di Grazia, G. Salvaneschi, "AgentBound: Securing Execution Boundaries of AI Agents", Proc. ACM Softw. Eng. 3, FSE, Article FSE096 (FSE 2026). https://doi.org/10.1145/3808103
Top comments (0)