Your Next AI Failure Will Pass Every Control You Have
By Maureen Doyle-Spare, Doyle-Spare Research
Simple Subscribe
Subscribe Now!
Banking has spent decades learning how to govern models. It is one of the industry’s most mature disciplines. Agentic AI now introduces a very different problem to tackle. Agentic systems reason and act across a bank’s workflows faster than any manual operation, and the promise of this innovation and scalability is real. Automating reasoning is no longer a question. For many institutions, it is becoming a business necessity. What remains unresolved is whether the bank can control the meaning its agent acts on.
Key Insight: Banks that cannot substantiate the controls governing the meaning an agent acts on risk both an inability to scale agentic AI and exposure to invisible failure. Governing the reasoning layer is what turns autonomy from a liability into an advantage.
The Age of Agent Inference
In my experience, across every kind of transformation program, the technical integration is rarely the hard part. Connecting one system to another, API to API, is usually the simplest task. The hard part is meaning, what a business term actually stands for in operational terms, not just a data dictionary, and whether that meaning stays consistent across business processes. That is where transformation gets difficult, and it is exactly where an agent now has to operate.
The risk begins in the reasoning layer, where the agent settles what business terms actually mean before it acts, and those inferences can vary across business units and platforms. A word such as cleared or approved carries a precise definition in each system that holds it, and ambiguity can exist across the ecosystem. An agent may reason those definitions into one working interpretation, and that interpretation can drift from the one the bank authorized while every contributing system remains correct.
Key Insight: Consider client onboarding. An agentic system coordinating across the know-your-customer and credit systems, as well as entitlement, resolves inconsistencies in how readiness is defined across those platforms. The agent settles on a working definition of “approved” that no human authorized. Onboarding proceeds. Controls fire. Every downstream workflow that inherits the readiness signal treats it as authoritative.
Here the systems each hold their own version of what approved means.
Source, Doyle-Spare (2026), supporting SSRN working papers.
Key takeaway: The agent did nothing wrong here. Each system it drew on was correct, and the interpretation it settled on was never reviewed by anyone. That is what makes this its own failure mode, agentic workflow drift, a meaning inferred without ownership or notification. The system did not fail. It succeeded against a meaning the bank never set.
The Failure That Stays Silent
A model that degrades usually shows it in the outputs. A failed control throws an alert. Reasoning-layer drift does neither of those. Identity checks pass and the output looks clean. The logs check out as well. The bank is exposed anyway, because the error sits somewhere those checks never examine.
No control broke. The controls did exactly what they were built to do, against an interpretation the agent had already settled on. That is why every control can pass while the bank is still wrong.
Every governance function sees a clean signal at the layer it monitors.
Cyber sees no breach. Fraud sees no misuse. Model risk sees a stable output. Compliance sees a control that fired. Each is correct at its own layer, and the error sits in the layer none of them governs.
Source, Doyle-Spare (2026), supporting SSRN working papers.
Key Insight: The institution is correct on every surface it can watch, and wrong underneath, which is the condition I call “invisible failure,” precisely because nothing surfaces it until the exposure has already accumulated.
A Blind Spot No Framework Owns
Regulators have been remarkably consistent in one respect, deferring agentic AI guidance. NIST’s AI Risk Management Framework evaluates AI across a system’s lifecycle. In April, the Federal Reserve, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corporation issued SR 26-2, replacing SR 11-7 after fifteen years (OCC Bulletin 2026-13). Footnote three places generative and agentic AI outside the guidance and directs each institution to govern those systems through its own risk and governance practices.
Need To Know: Where Regulatory Guidance Is Landing
• SR 26-2 places generative and agentic AI outside its scope and hands governance back to each institution. The responsibility is now yours.
• NIST AI RMF governs AI across the lifecycle but does not reach the meaning an agent resolves at runtime.
• The Financial Services AI RMF sets control objectives, not the runtime operating conditions those controls must enforce for agentic systems.
All have the same blind spot. Each watches the model or the system around it. None governs the meaning an agent resolves at the point of decision. The newest U.S. banking guidance goes furthest, because it makes the assignment plain. Out-of-scope is not out-of-governance, and for agentic AI this one belongs to the banks.
In the existing risk taxonomy, every risk has an owner, a detection method, and a framework, except one.
Source, Doyle-Spare (2026), supporting SSRN working papers.
Human Review Is the Ceiling, Not the Control
The blind spot is also the bottleneck. Without a way to govern meaning while the agent runs, the only guard against an unauthorized interpretation is a person reviewing the decision before it executes, or keeping Human-in-the-Loop. The gate works, but it does not scale, and it reduces the return on a fully automated workflow. A bank that stations a reviewer behind every consequential agentic decision has not deployed agentic AI. It has rebuilt manual review with more steps.
The answer is not more reviewers. It is to govern the meaning an agent acts on before it acts. The bank holds an authorized definition for the regulated terms that matter and verifies the agent’s resolved meaning against it before execution proceeds. Human judgment shifts from universal pre-approval to reviewing only the decisions that actually require it. That is the practical advantage of runtime governance.
What to Do: Adopt a Runtime Governance Model
A runtime governance model gives the institution one structure for governing agentic reasoning. The agentic governance model organizes that work into four connected pillars.
- Foundation. Set the authorized meaning first. Define the terms that matter, the Reasoning Baseline, from definitions the bank already holds, and govern only the deployments that expose enough to be governed.
- Core. Govern the meaning at runtime. A Semantic Control Plane measures how far an agent’s resolved meaning sits from the baseline and stops the action when it drifts too far.
- Integrity. Defend that layer from tampering. A governance surface is also an attack surface, which is the opening a Semantic Layer Integrity Attack exploits.
- Oversight. Keep it reviewable. Assign clear accountability and record each decision so an examiner can reconstruct it later.
Source, Doyle-Spare (2026), supporting SSRN working papers.
The reasoning layer has now become a governance surface. The question for each institution is whether it will also become a governed one.
Bottom line: Banking has always been the business of managing money. Agentic AI makes it the business of managing meaning. After an agentic decision goes wrong, what matters is not whether the controls fired, but whether the agent acted on a meaning the bank authorized. Model risk management confirms that much. Only governance at the reasoning layer can answer that question, and that governance has to run before execution, not after, because the exposure is already live and it is silent.
