Over the past several years, banking technology organizations have optimized for AI copilots. In these programs, developers receive code suggestions, business analysts summarize documents, and contact-center staff draft replies using new AI tools. But the copilot phase is ending. The industry is moving to agentic AI systems that can plan work, invoke tools, call APIs, open tickets, run tests, coordinate collaboratively, and act across the entire technology ecosystem to drive business outcomes.
For banking executives, the agenda has shifted from how to use AI as an assistant to determining how best to manage a new population of agentic coworkers working alongside the human workforce (see sidebar “What is an agentic coworker?”). The distinction is critical. A copilot that gets something wrong creates rework. An agentic coworker that gets something wrong can change a production system, expose client data, trigger a downstream compliance event, or cause a cascading failure across a chain of dependent agents before anyone notices.
This represents a fundamentally new operating model for how work gets done in banks. Making that model work will require more than deploying capable agents. Banks must put in place the governance, accountability, enterprise context, and technical infrastructure that allows agentic coworkers to operate safely and effectively at scale. This is not just about introducing a new digital workforce; it is about reimagining work itself. As agents take on more routine execution and coordination, human roles will need to evolve toward judgment, exception handling, relationship management, and oversight. Banks must therefore redesign workflows and roles together, rather than simply inserting agents into existing processes. At the same time, they must understand that these elements are interdependent; greater autonomy, for example, demands stronger controls, clearer ownership, and better visibility into how decisions are made and actions are taken.
Five foundations for managing an agentic workforce
What follows are five foundations that together form the basis for managing this new agentic workforce—and separate the leaders who shift successfully toward agentic coworkers from those who stall in endless experimentation.
Safe autonomy and clear regulatory posture are precursors to establishing agentic coworkers
Unlike most copilots, agentic coworkers do not only suggest; they execute. And regulators are not waiting for a dedicated agentic AI rulebook to govern agentic behavior—they are applying existing supervisory expectations and signaling that institutions lacking proportionate governance will face consequences today. In this environment, the chief information officer’s (CIO’s) mandate is to define the control mechanisms for agentic execution: codifying rules that authorize agent actions, aligning them to the bank’s risk posture, and enforcing them automatically across workflows, rather than through bespoke, case-by-case analysis.
The following four imperatives form the basis for establishing these controls:
- Design for agent error, not against it. Just like large language models (LLMs), agentic coworkers potentially hallucinate. They can invent API endpoints that do not exist, misstate regulatory obligations, fabricate test outcomes, or take plausible but wrong steps in production systems. As a result, constraining agents to approved tools, environments, and scoped permissions is essential. This requires evidence before action: tests must be run, policies checked, and outputs validated against authoritative sources. And failure must be contained through rollback paths and blast-radius limits, before rolling out agentic coworkers.
- Use risk-tiered controls. Not all agents are created equal (Exhibit 1). Agentic coworkers sit on a spectrum of autonomy: At one end, they may serve purely as advisers, synthesizing information and recommending actions for human approval; at the other, they operate as executors, taking approved actions directly in enterprise systems within defined limits. As autonomy rises, the control set must rise with it. The same is true of sensitivity: An adviser working from public data does not need the same controls as one drafting a credit memo from borrower financials, or an executor agent writing into a payments or anti-money-laundering (AML) system. Each coworker should be classified by what it may do and what it may touch, so the right controls are pulled automatically from a standard library rather than designed case by case.
Agentic coworkers should be classified by how much autonomy they have, with controls applied based on the actions they take.
- Understand that regulatory obligations bind regardless of who or what performs the work. There is not yet a separate regulatory rulebook for agentic AI, and banks shouldn’t wait for one. The fundamental mandate for banks remains unchanged: Systems must be reliable, secure, and compliant. Accountability cannot be outsourced to an algorithm; existing regulations apply to activities undertaken by agentic coworkers, and ultimate responsibility rests with the organization that deploys them. For example, an agentic coworker assisting with credit decisions is strictly bound by fair lending laws; one routing payments must adhere to Bank Secrecy Act and AML standards; and one drafting client emails is subject to consumer protection regulations. In each case, the human overseeing the activity remains accountable for ensuring that the agentic coworker’s output is appropriate, controlled, and compliant.
- Build audit-ready traceability. For decisions that matter to supervisors or customers, agentic coworkers must help produce defensible decision chains detailing what data was used, what policies contributed, what action was taken, and what human approved it. Exam readiness is the ability to reconstruct who decided what, on what basis, and with what authority.
Every agentic coworker needs a governed identity—alone or in a chain
Every agentic coworker acting across a bank’s systems needs an explicit identity, a named owner, and a formal life cycle before it executes anything—the same governance any other actor, human or virtual, in the operating model would require. That accountability compounds when agents delegate to each other: A supervisor agent decomposing an AML case review or a loan package into pieces for specialist agents doesn’t remove the bank’s accountability for the combined output; it just spreads that accountability across a wider operational surface. The following five steps provide a process for ensuring that kind of accountability:
- Give every agentic coworker a unique identity. Agentic coworkers need a dedicated, least-privilege identity tied to their version, environment, and purpose—governing what they can access, whether they can write as well as read, and how fast credentials are revoked when retired. Every action an agentic coworker takes logs to that identity, which travels with the agent into any workflow.
- Give every agentic coworker a named human owner. That ownership must cover the coworker’s purpose, permissions, risk tier, incident response, life cycle, and expected business outcome. The owner will be accountable for how the coworker operates, including the controls, approval gates, and escalation paths required before it acts. Ownership should not default to a generalized “AI center of excellence”; every agentic coworker needs a clearly accountable human responsible for the result it produces.
- Maintain a registry of agents. Banks need a single record of who each agent is, what the agent accesses, who owns it, and the agent’s risk tier, tracked through a full life cycle from intent scoping to retirement. Agent sprawl is technology debt that surfaces silently until it becomes a regulatory finding.
- Make agent-to-agent trust explicit. Agentic coworkers should only accept instructions from systems that are verifiable and that they are authorized to follow. This matters because bad or manipulated instructions can travel through a chain of coworkers and cause unintended actions. Protocols such as MCP (Model Context Protocol) and A2A (Agent to Agent) can help by giving coworkers a standard way to confirm who is calling them, what that caller is allowed to request, and whether the coworker should proceed or refuse.
- Govern shared memory to the standard of its most sensitive data. A shared memory store inherits the governance requirements of its most sensitive contents—every agent with access needs the controls the strictest data in that store demands, with distributed tracing capturing every tool call and the identity behind it.
‘Human in the loop’ is a core design discipline
By now, “human in the loop” has become a checkbox on AI slide decks. But for agentic coworkers in banking, it must be an operating model designed according to risk tier and regulatory materiality (see sidebar “Case in point: How a hybrid human–agent workforce operates in practice”). The goal is to put judgment where judgment belongs and automation where consistency creates value. Banks failing to define this explicitly will bottleneck low-risk work through excessive oversight or expose high-risk workflows to unchecked autonomy. The following core principles can help executives avoid both of those outcomes:
- Define supervision modes explicitly. For high-risk or irreversible decisions such as credit adjudication, fraud disposition, or privileged access grants, the agentic coworker prepares the data and a human approves before execution. For medium-risk workflows, humans review a risk-based sample with documented methodology. For low-risk automation, humans engage on exceptions only while a named owner remains accountable. Each workflow must declare its supervision mode.
- Invest in AI talent. Effective human oversight also requires investment in the people performing it. As supervision shifts from reviewing individual actions to managing exceptions and outcomes, employees will need stronger AI fluency, critical judgment, and agent-orchestration skills. CIOs should work with business and HR leaders from the outset to redefine responsibilities, build these capabilities, and support adoption through deliberate change management—not treat workforce implications as a downstream consequence of technology deployment.
- Evolve oversight as confidence and controls mature. Human in the loop should not become a permanent approval step for every agentic coworker action; nor should it be removed too quickly. Banks should release autonomy progressively: Start with human approval for all actions during initial deployment; move to materiality-based approval once performance and edge cases are validated; and eventually shift to supervisory monitoring for mature, low-risk workflows (Exhibit 2). At each stage, autonomy should remain bounded by predefined authority limits, confidence thresholds, escalation rules, and the bank’s AI risk policy. When limits are exceeded or confidence is low, the agentic coworker should automatically escalate to a human reviewer.
Agentic coworkers earn greater autonomy and less human oversight only after their performance and controls are validated.
Enterprise context is what makes agentic coworkers effective, and keeps them from making mistakes
Prioritizing speed without the appropriate context significantly increases the likelihood that agentic coworkers produce wrong answers at scale. For example, an agentic coworker refactoring payments code without knowing architecture standards, or triaging AML alerts without understanding the bank’s risk appetite, will move fast in the wrong direction. Context spans business rules, product definitions, API contracts, data lineage, and regulatory obligations—and the reason this context has to be built rather than bought is that it is, by definition, proprietary: A bank’s AML typology library, credit policy, and risk parameters are accumulated institutional judgment that no vendor can sell because no vendor has it. That’s also why the build-versus-buy decision matters here: Banks can buy the standardized orchestration and connectivity layers but should build and own the context itself. The following steps can help ensure that agentic coworkers remain accurate and reliable:
- Treat context engineering as a structural capability. Make enterprise knowledge, such as authoritative policies and standard operating procedures, usable through governed context layers. Build semantic layers connecting business concepts and data assets so agentic coworkers reason over relationships rather than orphaned documents.
- Package context into reusable skills. Develop standardized skills for common tasks like net-asset-value validation or incident triage. Skills encode how work should be done and where authority limits apply, making behavior repeatable and auditable across teams while enabling continuous improvement as lessons from incidents and production issues get captured back into them.
- Implement layered memory architectures. Three kinds of memory keep coworkers from treating every case as if it were the first: episodic, procedural, and semantic (Exhibit 3). Episodic memory preserves what happened before: prior actions, exceptions, and outcomes for a client. Procedural memory encodes how the work should be done, including where authority limits apply. Semantic memory grounds the coworker in the bank’s own vocabulary: product codes, policy definitions, risk appetite, and regulatory citations. A write-back loop then records human corrections so the next coworker inherits the case, the method, and the language.
- Own what’s proprietary, buy what’s commoditized. Capabilities like standardized orchestration, identity management, and enterprise connectivity are increasingly available and undifferentiated—buy them. A bank’s AML typology library, credit policy context, proprietary risk parameters, and architecture standards are the opposite—judgment that took years to build and that competitors cannot replicate. This intelligence belongs in a knowledge layer the bank controls—one that will outlast any single vendor platform, feeding context into whichever orchestration layer the bank uses today or replaces tomorrow.
Three kinds of memory keep an agentic coworker from treating every case as its first.
Establish a common gateway to govern agentic activity
As agentic coworkers scale, banks cannot rely on each coworker to implement its own security, regulatory, cost, and audit controls. That creates inconsistent enforcement, invisible gaps, and fragmented evidence. Instead, CIOs need a common control layer, often implemented through an AI gateway, that sits between agentic coworkers, models, tools, and enterprise systems. This layer should enforce policy, validate identity, protect sensitive data, meter token usage, route model calls, and capture the telemetry needed to reconstruct what each coworker did, why it acted, and under whose authority. The gateway has three jobs—protect, prove, and price:
- Protect—enforce policy and data protection as infrastructure. Every prompt routes through the gateway, applying tool policies and validating identities. The gateway scans for and redacts sensitive identifiers like client names, account numbers, or know-your-customer fields before any prompt reaches an external model, enforcing data minimization consistently at the infrastructure layer.
- Prove—centralize telemetry for immutable audit trails. The gateway logs every prompt, response, tool call, and token count. When an examiner asks what data informed a decision, the gateway provides the definitive answer. Structured telemetry aggregated at the gateway provides the end-to-end trace capability required for accountability.
- Price—make token metering and model tiering an architectural asset. Token consumption compounds quickly in complex banking workflows. The gateway meters consumption, enforces token budgets, and routes simpler tasks to cost-optimized models. The right economic unit is the total AI expenditure required to produce a completed workflow result, such as the cost per case resolved to regulatory standards. Tag agentic coworker runs to the business process and value stream they support so finance and technology leaders can see cost per workflow, not a single opaque AI bill.
Building the bank around a new division of labor
The point of agentic coworkers is speed. They can research, decide, coordinate, and execute across workflows that used to wait on people and handoffs. That speed is only usable if it does not sacrifice the judgment, accountability, and trust that banking requires. By taking on routine work and coordinating complex workflows, agentic coworkers can free human capacity for higher-value activities, improve decision quality, and enable better customer outcomes. Capturing this value requires banks to make deliberate choices about where that capacity is reinvested and how work is redesigned across the human-agent workforce.
The five foundations in this article are the guardrails that make that possible. They are rules of the road toward genuine innovation. Classify each coworker by what it may do and what it may touch, and apply controls from a standard library. Give it a governed identity and a named human owner before it acts, including when it delegates in a chain. Design human oversight by risk, and release autonomy only as performance, confidence, and controls are validated. Own the bank’s context—rather than buying a substitute for institutional judgment. Route activity through a common gateway that protects data, proves the decision chain, and prices the work.
Put those rules in place, and agentic coworkers can run faster inside the standards that supervisors, customers, and the institution already hold. Skip them, and the bank will either throttle low-risk work with ad hoc review or discover that an unsupervised coworker has already acted.
