Every risk officer we've sat across asks a version of the same question. Not "how smart is the agent?" but "what exactly can it do, and how do I prove what it did?" If you can't answer both in one sentence, the deployment isn't ready — no matter how good the demo was.
Autonomy is a budget, not a switch
The single most useful reframe for regulated environments: you don't turn autonomy on, you allocate it. We scope agents in tiers, and each tier is a separate conversation with risk and compliance:
Four tiers of agent autonomy
- T1 READRead & recommend — the agent drafts, researches, prepares; a human executes.
- T2 APPROVEAct with approval — the agent executes after explicit human sign-off.
- T3 LIMITSAct within limits — autonomous inside hard bounds: amounts, systems, customer segments.
- T4 REPORTAct & report — full autonomy with after-the-fact review. Rare, and earned, not granted.
Most production value in finance today lives in the first three tiers — and that's fine. A T2 agent that removes four hours of preparation from every complex case is worth more than a T4 pilot stuck in review.
What "auditable" means concretely
- Immutable action logs — every agent action recorded: the goal, the tools called with inputs and outputs, the model version, the decision path. Outputs-only logging is the most common gap we find.
- Determinism where policy demands it — workflow engines and rules engines at every point where a decision must be repeatable and replayable.
- Least privilege, agent edition — role-based access for agents exactly as for employees. An agent should hold a narrower entitlement set than the human it assists, not a broad service account.
- Versioning of everything — agents, tools, instructions and models, so "why did it do that in March?" has an answer.
Design pattern: deterministic spine, agentic muscle
Keep a governed process — BAW, or an agentic workflow with checkpoints — as the spine. Let agents work between the checkpoints. The spine gives auditors replay; the agents give the business speed.
This is also what makes EU AI Act conversations tractable: traceability and human oversight are structural properties of the architecture, not documents bolted on before an audit.
What we see fail
The same three mistakes, in estate after estate: agents granted broad service accounts "temporarily"; logs that capture what the agent said but not what it saw; and pilots that skip the entitlement conversation entirely — then stall in security review for months. Governance retrofitted after the pilot is the most expensive way to build it.
Compliance by design isn't slower
It's what gets agents past review and into production. The teams shipping agentic systems in banks and insurers today aren't the ones with the boldest demos — they're the ones whose architecture answered the risk officer's question before it was asked. That's the difference between a demo and a deployment.