How do you govern an AI agent inside a regulated lender?

Why does an agent need governance when traditional software barely does?

Traditional software does exactly what it was programmed to do. An AI agent interprets: it reads a message, figures out the intent, picks a tool and writes a reply. That flexibility is what makes it useful for servicing, collections and origination, and it is also why it needs hard limits. At a regulated institution, every customer interaction can end up as a complaint, a regulator review or an internal audit. Governance is not an add-on. It is the precondition for turning the agent on.

What is the minimum governance an agent needs?

Five pieces, none optional:

• A named owner. Every agent has an internal owner — someone in collections, origination or servicing who defines what it does, what it doesn’t, and when it stops. Not the vendor.
• Written rules the agent cannot bypass. Contact hours, off-limits topics, amounts it cannot offer, when to hand off to a person. The rules live in the system, not in a prompt the agent is supposed to “remember.” A rule that isn’t enforced in code doesn’t protect anyone.
• A complete log. Every message, every system lookup, every action and every escalation is recorded with date, time, customer and reason. Without it you can’t answer a complaint or reconstruct what happened.
• Kill switch and human takeover. A person can take over any conversation, hand it back, or stop the agent entirely. The switch has to work at any hour without asking anyone for permission.
• Regular review. Conversation samples reviewed by a person, quality metrics and a standing meeting to adjust the rules. An agent nobody reviews drifts, and nobody notices.

Where does all of this show up in practice?

At InnovaBlack we handle it with two systems. Synthetic OS, the operating system each agent runs on, holds its rules, memory and monitoring, and it is what enforces the kill switch. The Agentic Office is where your team sees what every agent is doing in real time, takes over a conversation, hands it back and stops the agent. The log isn’t a report assembled after the fact; it is written the moment the agent acts.

No agent pretends to be a person. If a customer asks who they’re talking to, the agent says it is an AI agent, and a person is always available to take the case.

Which decisions should stay with a person?

The working rule: the agent can prepare, propose and execute what is already authorized; a person authorizes anything that binds the institution or changes the customer’s situation. Typical examples that stay human:

• Approving a loan, a restructuring or a write-down outside policy.
• Deciding whether a transaction is unusual and must be reported; the agent can flag it, but the analysis and the call belong to compliance (see KYC and AML with agents).
• Answering a formal complaint or a regulator’s request.
• Any case where the customer asks for a person.

Where each line sits is your institution’s decision under its own policies. Our job is to make sure the system respects it every time, not just when things go well.

What will you be able to show an auditor or a regulator?

With governance done right, in any review you can show:

• What each agent does, who owns it and which rules constrain it, in a current document.
• The full log of a conversation or a customer, with every agent action and every human intervention.
• When an agent was stopped, who stopped it and why.
• Every rule change, dated, with who approved it.

The rules that already bind your institution — collections, customer complaints, anti-money-laundering, data protection — still apply when an agent does the work. So we design each agent to comply from day one, and to have the evidence in place before anyone asks for it.

How do you keep the agent from making things up or overpromising?

Three layers. First, the agent only answers with information from your systems or approved documents; if it doesn’t have the data, it says so and escalates. Second, sensitive actions (logging a payment, changing an address, offering a payment plan) go through tools with their own validations, not free text. Third, Synthetic OS monitoring watches the agent’s activity and raises a flag when something looks off. No single layer is perfect; together they surface mistakes early and fix them with evidence.

Short answers

Who is accountable when an agent gets it wrong?

The financial institution, exactly as if an employee or a vendor had made the mistake. That is why every agent needs a named internal owner, and why decisions that bind the institution should go through a person.

Can an agent be stopped at any time?

It has to be. A well-governed agent has a kill switch that an authorized person triggers from the Agentic Office, and it cuts the agent off without depending on the vendor.

Can the agent approve a loan on its own?

It can prepare the analysis and propose a decision within rules the institution sets. Who approves, up to what amount and with which exceptions is your credit policy’s call, and the prudent design keeps final approval with a person.