Agentic AI Governance in Banking: Why Authorization Scope, Human Checkpoints, and Multi-Agent Controls Are a Different Problem from Model Validation

Why an Agent in a Loan Workflow Is a Different Governance Problem Than a Credit Model

A credit scoring model answers one question: is this output accurate, fair, and explainable? An agent wired into a loan workflow answers that question and then does something about it — it queries a bureau, reads a document, drafts a decision, and triggers a downstream system update, all in one pass. Governance has to verify authorization at every one of those steps, not just at the final output, because the final output can be perfectly reasonable even when step three was never authorized.

I've sat in incident reviews where the output was fine and the problem was entirely upstream — an agent called a tool nobody remembered granting it access to, and the only reason anyone noticed was an unrelated downstream error. That is the agentic governance problem in one sentence: the failure is invisible until something else breaks.

Five Ways Agentic Systems Fail That Model Validation Was Never Built to Catch

Scope creep. An agent acquires capability beyond its declared scope — through prompt injection, or just through undocumented tool access nobody updated the governance record for. You find out when an unauthorized action actually fires, which is too late by definition.

Indirect prompt injection in retrieved content. The attack doesn't come through the chat input; it comes embedded in a PDF loan application or an email the agent retrieves as part of its normal workflow. Input guardrails built to screen direct user prompts don't look inside retrieved documents, which is exactly why this channel works.

Authorization chain breaks in multi-agent systems. A subagent infers its permissions from the task description the orchestrator handed it, rather than receiving an explicit grant. That's an implicit trust relationship standing in for an access control, and it fails the first time the task description is ambiguous or adversarially crafted.

Context window poisoning. Adversarial content sits dormant in a long-running conversation or workflow and activates only when a later condition lines up. Standard input monitoring checks each turn; it doesn't re-inspect everything the agent has accumulated by turn forty.

Tool-call audit gaps. Most audit trails log the model's input and output. Agentic systems need the tool call itself logged — which tool, which parameters, which result — or you cannot reconstruct what the agent actually did when an examiner or an incident review asks.

What an Authorization Scope Manifest Actually Has to Specify

This is the document that does the work a model card can't: a complete tool inventory naming every accessible tool, its read/write scope, and the systems it touches, such that any undeclared tool call is by definition a scope violation you can detect. It classifies every action as reversible or irreversible, and routes every irreversible action — a financial transaction, a customer record change, a regulatory submission — through a human approval checkpoint before execution, not after. It sets explicit delegation rules for multi-agent setups: what a subagent can inherit, what it categorically cannot, and how deep the delegation chain is allowed to go. And it defines escalation triggers — confidence thresholds, out-of-scope detection, repeated-failure counts — that are testable, not just written down.

Where This Is Heading Regulatorily, and What to Build Regardless

Indian regulators are visibly moving toward formal expectations for agentic AI governance — authorization documentation, human checkpoints on irreversible actions, orchestration-level governance, and behavioral consistency testing across equivalent task phrasings and languages are all directionally where supervisory attention is headed. Treat the specific document names and dates you see cited in vendor material, including this one, as directional rather than settled until you've confirmed them against RBI's own published text. The underlying controls are worth building regardless of exactly when a circular lands, because the failure modes they address are already live in production today.

Action Checklist: What to Build Before Your Next Agentic Deployment, Not After

1. Write an authorization scope manifest for every agent before deployment — tool inventory, reversibility classification, delegation rules, escalation triggers — and keep it in your model inventory alongside validation records, not in a separate document nobody cross-references.
2. Route every irreversible action (payments, record changes, regulatory submissions) through a human checkpoint that logs the approval, not just the action.
3. Extend your input guardrails to inspect retrieved documents, not only direct user input — indirect injection through loan PDFs and emails is the channel most banks haven't covered yet.
4. Log every tool call with its parameters and result, not just the model's final input and output, so an incident review can reconstruct the actual sequence of actions.
5. Test behavioral consistency across semantically equivalent task phrasings and across every deployed language before you trust an agent's scope enforcement in production.