Agentic AI has moved rapidly up the supervisory and professional agenda in 2026, featuring in GARP risk coverage, in professional bodies' AI workstreams, and - notably by omission - in the carve-out language of the newly revised US interagency model risk guidance.
Agentic AI risk management is the problem of governing systems that do not merely produce an output but pursue an objective: planning multi-step tasks, calling tools, reading and writing to systems, and adapting their approach based on what they encounter. A predictive model answers a question. An agent does something. That distinction sounds philosophical; operationally it changes almost everything about how the system can fail and how it must be controlled.
It is telling that the 2026 revision of US interagency model risk guidance explicitly acknowledges generative and agentic AI as raising questions beyond its scope, and that supervisors on both sides of the Atlantic are treating agentic deployment as a distinct examination topic. The regulatory framework for agents is being written after the deployments have begun - which means firms need internal answers now.
Why classical validation breaks
Model validation as practised under model risk frameworks assumes a mapping from inputs to outputs that can be sampled and tested. Agents violate the assumptions one by one.
The output is a trajectory, not a prediction. An agent's work product is a sequence of actions - query this system, transform that data, send this instruction. Two runs from the same starting point can take different valid paths. Testing the endpoint alone misses the failure that matters: a correct answer reached via an action that should never have been taken. Validation must therefore examine trajectories - the sequence of decisions - not just outcomes. Readers of my commentary on the CAS claims-extraction research will recognise the principle: validate the sequence, not the endpoint.
The action space is open-ended. A credit model can only ever output a score. An agent with system access has an action space bounded by its permissions, not by its design intent. The control that matters is the permission boundary, and it must be enforced outside the agent - in the systems it touches - not by instructions inside a prompt that adversarial inputs can override.
Errors compound. A mistaken belief formed at step two propagates through every subsequent step, often coherently. Coherent wrongness is more dangerous than visible breakage, because it passes casual review.
The environment talks back. Agents ingest content from the systems and documents they work on. Any of that content can contain instructions - prompt injection is an environmental hazard for agents, not just a user-input problem. In insurance and banking, where agents read claims files, broker submissions and customer correspondence, the adversarial-input surface is enormous and partly controlled by counterparties with financial interests.
The control set that works
Bounded permissions, enforced externally. Least-privilege system access; separate identities for agents; no shared credentials with humans; irreversible actions gated behind human approval or removed from the action space entirely.
Trajectory logging and sampling review. Every action logged with its rationale; a sampled fraction of full trajectories reviewed by humans against a defined error taxonomy - wrong action, right action on wrong object, unnecessary action, missing action. Aggregate action-level accuracy is the KPI; endpoint accuracy alone is vanity.
Blast-radius design. Assume the agent will one day act wrongly at machine speed. What is the maximum harm before detection? Rate limits, spend limits, scope limits and kill switches convert an unbounded tail into a priced one. This is classical operational risk thinking applied to a new actor.
Environment hardening. Treat all ingested content as untrusted. Strip or sandbox instructions found in documents; require that changes of objective come only from the authenticated principal, never from working material.
Versioned identity. An agent is a model plus a prompt plus a toolset plus permissions. A change to any of the four is a model change and triggers re-validation. Firms that version only the underlying model will change agent behaviour without noticing they have done so.
Materiality tiering for agents
The tiering logic from AI model risk governance applies with one addition: autonomy is now the dominant axis. A useful scale runs from suggest (human executes), through execute-with-approval, to execute-and-report, to fully autonomous. Each step up the scale multiplies the consequence of the same underlying error rate. A modest extraction error rate is tolerable in a suggestion tool and intolerable in an autonomous payments agent. Governance intensity should track the autonomy level and the reversibility of the action set - and promotion up the autonomy scale should itself be a governed change, with evidence requirements, not a product decision.
Where insurers and banks should start
Start with the inventory question: which processes already contain agentic components, including inside vendor products? Most firms undercount, because agents arrive embedded in software rather than as declared projects. Then impose the external permission boundary and logging on what exists. Only then argue about frameworks. An agent you have not inventoried, bounded and logged is not being governed at all, whatever the policy document says.
The firms that get this right will not be the ones with the longest AI policies. They will be the ones that treated agents the way good risk management has always treated a new counterparty with system access: identify it, limit it, log it, and never rely on its own account of what it did.
Key Takeaways
- Agentic AI produces trajectories of actions, not predictions - validation must examine the sequence of decisions, not just endpoints.
- The binding control is the externally enforced permission boundary; instructions inside the prompt are not a control surface.
- Prompt injection is an environmental hazard: agents in insurance and banking read documents authored by parties with financial interests.
- Blast-radius design - rate, spend and scope limits plus kill switches - converts an unbounded tail into a priced one.
- An agent is model + prompt + toolset + permissions; a change to any component is a model change requiring re-validation, and increased autonomy is itself a governed change.
Frequently Asked Questions
What is agentic AI risk management? The governance of AI systems that autonomously plan and execute multi-step tasks - calling tools, reading and writing to systems - rather than producing a single prediction. It extends model risk management with trajectory validation, externally enforced permission boundaries, blast-radius limits and re-validation triggered by changes to the agent's model, prompt, tools or permissions.
How do you validate an AI agent? By reviewing sampled full trajectories against an action-level error taxonomy, testing behaviour under adversarial and injected content, verifying that permission boundaries hold when instructions attempt to exceed them, and measuring failure modes at each autonomy level - not by scoring final outputs alone.
Does existing model risk guidance cover agentic AI? Only partially. The 2026 revision of US interagency model risk guidance explicitly notes that generative and agentic AI raise questions beyond its current scope, and UK supervisory frameworks are similarly principles-based rather than agent-specific. Firms therefore need internal standards for agentic systems ahead of explicit regulatory ones.