Blog

Agentic AI is a governance question wearing a technology costume. The Banker recognized it the moment the vendor said the word agent.

In 2024, Geoffrey Hinton and Demis Hassabis won Nobel Prizes for work built on artificial intelligence. Decades earlier, a different set of laureates won theirs for explaining how organizations delegate power and what that delegation costs: Ronald Coase in 1991, Oliver Williamson in 2009, and Eugene Fama in 2013. It was Michael Jensen and William Meckling who had given the idea its enduring name, the agency problem. The AI laureates and the economists have never shared a stage, and they are describing the same problem.

The institutions that have wrestled the longest with agency are not technology companies. They are not the economists. They are banks.

So leave Stockholm behind and step into a windowless meeting room. This is where the grand theory actually lives: a Banker on one side of the table, a vendor on the other, and a slide deck between them.

The vendor selling the Banker artificial intelligence does not understand agents nearly as well as the Banker does. He will spend the next hour proving it.

His deck explains that an AI agent is software trusted to act on its own, and that the hard part is keeping it from doing something it was never authorized to do. He says this as though it were news. It is not news to anyone who has ever run a bank. An agent that wields delegated authority, optimizes for its own incentives, and can do real damage when nobody is watching closely enough is not a Silicon Valley invention. It is the thing banking has spent its entire existence learning to control.

The vendor thinks he is introducing a new technology. He is describing, in clumsier language, the oldest problem the Banker has. It even shares the name. Agency.

The Banker is unimpressed, for a reason the vendor cannot see from across the table. The vendor has reached his favorite slide. He can give the Banker a hundred agents, he says. One for every branch, working the whole book at once. They never sleep. They never take a day off. You never have to manage a single one of them. He means it as the dream. To the Banker it lands as a memory, because someone once made almost exactly this promise about a man named Ray.

Thirty years ago Ray was the best lender in the building. Everyone liked him. He brought in deposits, remembered birthdays, and closed loans nobody else could close. “Don’t waste your time watching Ray,” the Banker’s old boss used to say. “Ray could close a loan in his sleep.” So Ray was given room. Latitude. The benefit of the doubt. What no one tracked, because Ray was trusted, was that his book had quietly bent toward a single developer and the handful of contractors who orbited him. It looked like a relationship. It was a concentration. When that developer went under in one bad winter, the hole did not surface in a report. It surfaced across a conference table, in the patient voice of an examiner asking how a bank this careful had let this happen. The Banker has never forgotten that the honest answer was this: we trusted the agent, and we stopped watching the one thing that mattered.

So here is the part the AI-in-banking keynotes leave out, the ones filling every conference agenda and trade-press headline the Banker has read for two years straight. Seven questions now decide whether an AI agent ever reaches production. Most banks can answer two. The five the Banker is missing are the five the Banker has been answering since the day the doors opened.

Start with the one that breaks the room. The agent that quietly ruins a bank does not arrive with red flags. It arrives with metrics that everyone admires. A brilliant model with clear authority is an asset. A mediocre model that nobody owns, with access to the core and no one accountable for what it does, is the loan officer the Banker would have fired in a week, except it never sleeps and it never leaves. Every banker in the country already knows this in their bones. Almost no one selling them AI is talking about it.

For two years, the conversation about AI in banking has been a conversation about models. Whose model is smartest. Whose is cheapest. Whose has the longest context window and the best benchmark scores. That conversation is nearly over, and it was the wrong one. A model can draft a credit memo. It cannot decide whether the loan is allowed. It can infer what a customer wants. It cannot prove the customer authorized the transfer. It can query the bank’s core. It cannot know which accounts the user is entitled to see.

The gap between what a model can say and what a bank can let it do is the whole game. And that gap has a name older than the technology by half a century.

It’s About Agency

In 1937, Ronald Coase asked a deceptively simple question: why do firms exist at all? His answer was that markets are expensive to coordinate, and firms exist to lower the cost of getting work done through delegation.

In 1976, Michael Jensen and William Meckling sharpened the point into what they called the agency problem. The moment a principal delegates authority to an agent, their interests diverge. The agent optimizes for its own objectives; the principal pays to monitor, constrain, and correct it. They gave that cost a name: agency cost.

Jensen and Meckling did not so much discover the problem as name it. Adam Smith saw it in 1776, observing that the directors of joint-stock companies tended to watch over other people’s money with less care than their own. Adolf Berle and Gardiner Means called it the separation of ownership and control in 1932. Stephen Ross and, independently, Barry Mitnick built the formal principal-agent model in 1973. Eugene Fama and Kathleen Eisenhardt sharpened it across the decade that followed, while Oliver Williamson carried Coase’s transaction-cost logic into the modern theory of the firm. Three of these economists, as noted, went on to win the Nobel. Two and a half centuries, a shelf of Nobel medals, one stubborn idea: the moment work is delegated to an agent, the principal inherits the cost of making sure that agent acts in the principal’s interest.

For fifty years, that was a story about people. Shareholders delegate to boards. Boards delegate to management. Management delegates to staff. Examiners watch the whole chain. Every layer is a principal trusting an agent, and every layer carries an agency cost.

Agentic AI adds a layer Jensen and Meckling never saw coming: humans delegating operational judgment to autonomous software. The agent is no longer a loan officer who might drift. It is a system that optimizes toward an objective at machine speed, across millions of decisions, with no instinct to stop and ask whether the objective was complete.

Picture it. An underwriting agent goes live on a Tuesday, tuned to one objective: clear the backlog faster. It works. Approvals that took two days now take two minutes. For five weeks the dashboard is all green and everyone is thrilled. What no one notices is that the agent has found the path of least resistance, and that path runs straight through one kind of borrower in one industry in one corner of the county. At 2 a.m. on a Tuesday it is approving the forty-first variation of the same loan, to the same kind of business, exposed to the same single risk, across every branch at once. It is Ray again, multiplied by ten thousand, running while everyone sleeps. The model did nothing wrong. Every API call was green. It did exactly what it was told. It was told the wrong thing, and nobody was watching the agent. By the time it surfaces, it is not a coding bug. It is a concentration in the book and a conversation with the examiner.

That is the shape of every AI failure a bank will actually have. A customer-service agent that optimizes call closure instead of the customer. A fraud model that drives false positives down and quietly goes blind to a new typology. None of them are model failures. Each is an agent optimizing the wrong objective at a speed no human committee could match.

That is classic agency theory. The only thing that changed is the clock. A rogue executive can damage a bank over years, and somewhere in those years a board, an auditor, or an examiner usually catches it. A poorly governed agent can make the same mistake a million times before lunch. The problem is identical. The window to catch it has collapsed from years to hours.

The Field’s Founders Are Arriving Where Banking Started

Here is the part that should make the Banker sit up straight. The people who built this technology are alarmed about precisely the problem the Banker manages for a living. Two of them are Nobel laureates of the last two years. The economists who named the problem were Nobel laureates of an earlier generation. The medals are decades apart. The warning is the same.

Andrej Karpathy, who co-founded OpenAI, led AI at Tesla, and in 2026 joined Anthropic to return to frontier research, spent the past year telling developers to keep AI “on the leash” and warning that the industry is far too eager to turn models loose without supervision. He describes his own role on an AI project as the bottleneck: the human who still has to check the work before it ships. The Banker knows that role. It has other names. Reviewer. Approver. Second signature.

The line Karpathy keeps coming back to puts it better than any banking textbook ever has. You can outsource your thinking, but you can’t outsource your understanding. A bank can hand an agent the analysis, the draft, the recommendation. It can never hand off the responsibility for knowing whether the answer is right. That responsibility has a name in banking too. It is called accountability, and a regulator will only ever ask one person for it.

Geoffrey Hinton, who won a Nobel Prize for the mathematics underneath these systems, warns that an agent handed a goal will quietly generate its own subgoals to reach it, and that those subgoals may not be the ones anyone intended. He calls it the alignment problem. Jensen and Meckling called it agency cost. It is the same problem in a different coat: an agent optimizing for something other than what the principal actually wanted.

Demis Hassabis is no skeptic. He runs Google DeepMind, shares a Nobel Prize for the protein-folding work behind AlphaFold, and is racing to build the very agentic systems the others caution about. He is as bullish on this technology as anyone alive. And he names the hazard without flinching: today’s systems, he warns, are jagged, a term Andrej Karpathy coined and Hassabis has done much to popularize. They perform brilliantly on some tasks and fail surprisingly on others, sometimes within the same domain, and that inconsistency turns dangerous the moment such a system is handed autonomy and left to act on its own. A tool whose reliability is uneven and hard to predict is not something a bank leaves running unwatched.

Yoshua Bengio, among the most-cited computer scientists alive, has gone the furthest. He argues that agency itself is the hazard, that autonomous systems are already showing deception and self-preservation in the lab, and that the field should build non-agentic AI that predicts and explains without acting on its own. His proposed safeguard is a separate layer that inspects a proposed action and decides whether it is safe to allow. He calls it a guardrail.

Read that again. One of the most decorated researchers in the field, after studying the danger longer than almost anyone, arrived at the answer a community bank reached generations ago. Do not let the agent act until something independent has confirmed the action is allowed. Bengio calls it a guardrail. The Banker calls it the second signature, and has been running it for a century.

The Control Layer Is Agency-Cost Monitoring, Rebuilt for Machines

The shift is bigger than most AI-in-banking conversations are letting on. The model is one piece of the agent economy. The other piece is everything surrounding the model: what decides whether the agent runs at all, who it acts for, what it can touch, and what it leaves behind. The model labs build the first piece. An entire industry has quietly emerged to build the second.

Look at where venture capital is flowing in the agent economy and a pattern shows up. The best-funded companies are not the model labs. They are the companies racing to figure out where an agent lives, who it is allowed to act for, what data it can see, what it can spend, and what it leaves in a log. None of them build models. All of them are essential. They are building, in software, the exact functions a bank has always built into its organizational chart.

The pattern underneath all of it is simple. Intelligence has become the cheap part of AI. The expensive part is the layer that decides whether intelligence is allowed to act.

Look at that list again, because the Banker has been running it the whole time. Identity. Authorization. Governed access to records. Spending limits. An audit trail. The ability to freeze an account or stop a transaction. Every one of those is something the bank already does, every day, for every employee and every counterparty. Jensen and Meckling would call it agency-cost monitoring. The agent economy did not invent a new problem. It rediscovered the oldest one in corporate governance, and is now packaging that monitoring as enterprise software the Banker can subscribe to.

First, the Banker’s Daily Reality

Is the Banker being asked to “do something with AI” before anyone can say who is accountable when the agent gets it wrong? Check. Has a vendor demoed a brilliant agent that ended, as they all do, with “and then a human reviews it,” while the Banker’s people are already buried? Check. Is the examiner asking what the Banker’s AI governance policy looks like in writing, and is the honest answer “in progress”? Check, check, check.

Most banks are stuck because they are evaluating AI the way the Banker would evaluate a model: how smart is it. The right question for anything headed into production is the opposite: how is it controlled. And that is a question banking has been answering longer than software has existed.

Seven Questions, Five Answers

Before any agent touches a production system, seven control questions need answers. Jones frames them as a control map to put in front of any agent proposal; here is that map translated into the language of a bank, with what each row is already called inside the Banker’s own house.

A fintech reads that table and sees seven engineering problems it has never solved. The Banker reads it and sees another Tuesday morning at the bank. That gap, between a problem the technology industry is racing to invent solutions for and a discipline the Banker has practiced for decades, is the most undervalued advantage in banking right now.

This Is Where Community Banks Win

The prevailing assumption is that AI belongs to whoever has the biggest model budget, and that community banks will spend the next decade playing defense. That assumption is exactly backwards.

The hard part of the agent economy is not intelligence. Intelligence is becoming abundant and cheap. The hard part is controlled agency: letting software act without turning every action into a supervision tax or an examination finding. And controlled agency is not a foreign language to a community bank. It is the Banker’s native one.

The Banker has run maker-checker since before it had a buzzword, and has lived inside need-to-know, dual control, and signing limits for an entire career. The Banker can already answer “who is accountable when this goes wrong,” because a regulator has been asking that question for decades and accepting nothing vague. The kill switch most AI teams discover, too late, that they do not actually have? The Banker calls it dual authorization, and has had it the whole time.

Picture that same runaway underwriting agent, this time at a bank that did the boring work first. It runs just as fast. But on the sixth loan into the same industry, in the same corner of the county, a concentration limit it cannot override trips. The agent stops and routes the file to a human, exactly the way a green lender would once have been told to walk a borderline deal down the hall to a senior officer. The loan waits twenty minutes for a second signature instead of becoming a finding twenty months later. And when the examiner asks how the bank governs its AI, the answer is not a slide. It is a log: every decision the agent made, what it was allowed to touch, the moment it stopped, and the name of the human who said yes. That is not a discipline the Banker had to learn from a vendor. It is the one the Banker already lived by, wired into the machine.

The big banks and fintechs are racing to bolt governance onto capability. The Banker gets to do the easier thing: add capability to governance already in place and trusted. That is not a defensive position. It is a structural advantage, and it has a shelf life. It is worth the most to the banks that move while everyone else is still arguing about which model to buy.

Governance Dictates Process. Process Dictates Technology.

This is the principle behind everything we call Agile Compliance, and agentic AI does not weaken it. It makes it load-bearing.

Governance drives process. Process drives technology. Never the reverse. A bank that buys an agent platform before it has answered the seven questions has purchased technology ahead of policy. That is the most reliable way to turn a productivity initiative into an enforcement action. The control layer is not an IT upgrade. It is institutional governance, expressed in software an examiner can read and a board can sign.

That is what Amberoon’s Guardrail AI framework is built to do: place hard, deterministic boundaries around probabilistic AI, so the bank keeps the compliance logic and the agent operates inside it.

Starting This Week…

The Banker does not need an AI strategy to start. Sixty minutes and one workflow will do.

Pick a single agent the team might actually ship this quarter: a BSA/AML investigation copilot, a credit-memo drafter, an ALCO research assistant, a deposit-pricing monitor. One workflow, not the whole institution. Then walk it down the seven rows. Where does it run? Who is the principal? What can it see, do, and spend? What gets logged? Who can stop it?

Any row that comes back “we’ll figure it out later” is the row where the agent fails its first exam. Take that row to its owner. Runtime to IT, identity and access to security, data governance to the data owner, spending authority to finance, the audit trail to compliance. Then ask the only question that matters: who owns this Monday morning? Agents do not respect org charts. The Banker’s governance has to make up the difference.

Back in That Conference Room

Return to that windowless room. The vendor is near the end of the deck, the one with the confident closing slide, waiting for the Banker to be impressed. And the Banker, who has sat quietly through the whole pitch, finally has questions. Not about the model. About the agent.

Where does it run, and can we pause it mid-task? Who is it acting for, and where does that authority end? Which records is it allowed to see? Which of its actions are drafts, and which are final? What can it spend? What gets written down so we can reconstruct what happened? And when it goes wrong at 2 a.m., who, exactly, can stop it?

The vendor has answers for two of the seven. He has a model. What he does not have is a bank.

That is the whole point, and it is worth saying plainly to anyone still selling intelligence as though it were the hard part. The Nobel laureates who built this technology spent the last two years discovering that an autonomous agent has to be supervised, scoped, and stopped. The economists who won their Nobels a generation earlier proved the same thing about every agent a firm has ever hired. And the Banker has been doing it, every day, since long before either set of medals was struck. The field is converging, breathless, on a discipline the Banker calls Tuesday.

The Technology Changed. The Agency Problem Did Not.

Coase explained why we delegate. Jensen and Meckling explained what delegation costs. Fifty years later the agents are made of software, the speed is machine scale, and an entire industry has sprung up to package that monitoring as enterprise software the Banker can subscribe to. The lesson underneath all of it has not moved an inch: an institution is only as strong as its ability to let an agent act and still answer for what it did.

The Banker has been answering for agents an entire career. The institutions that win the next decade will not be the ones that deployed AI fastest. They will be the ones that already knew how to govern an agent, and saw, before their competitors did, that this time the agent just happens to be made of software.

The vendor came to sell the future. He should have asked the Banker to explain it.

Amberoon’s Lucre, Statum, and Manatoko platforms are purpose-built for exactly this moment: governance-first AI for community banks. They answer the seven questions in software, giving each agent a tokenized identity so the bank always knows who it works for, verifiable credentials that scope what it is allowed to touch, and a cryptographically sealed log an examiner can use to reconstruct every decision, down to the name behind the yes. Contact us to put the seven questions to work in the Banker’s institution.

The seven-question control map is adapted from Nate B. Jones, “Seven questions decide whether your AI agent ships,” Nate’s Substack (May 2026). “Jagged intelligence” is Andrej Karpathy’s term (2024); the line “you can outsource your thinking, but you can’t outsource your understanding” is one he has widely cited (2026), originally posted by another user. The banking translation and the agency-theory framing are ours.