Agentic AI Governance Checklist for Banks: 12 Controls After SR 26-2

Agentic AI governance is the set of controls that decide what an AI agent may see, decide, and do, and how a bank proves it afterward. Our view at HRTG: banks should govern agents like a new class of employee with system access, not like a model. Identity, scope, context, and evidence matter more than accuracy scores.

Agents are moving from pilots to production in banking. They draft, route, reconcile, and in some cases act inside core systems. The governance question has changed. It is no longer "is the answer right?" It is "was the agent allowed to do that, and can we show it?"

This checklist is built for bank risk, technology, and business leaders who need a practical starting point.

Does model risk guidance cover agentic AI in banks?

No, not directly. On April 17, 2026, the Federal Reserve, OCC, and FDIC issued revised model risk management guidance, SR 26-2, which supersedes SR 11-7. The guidance itself states that generative AI and agentic AI models are not within its scope. It says a bank's broader risk management and governance practices should guide the controls for those tools.

Vice Chair for Supervision Michelle Bowman made the same point in a May 2026 speech. She said regulators expect other risk management and governance practices to support adoption of generative and agentic AI.

That is not a free pass. It moves the burden to the bank. Without a model validation template to lean on, each bank has to define its own agentic AI governance and defend it to examiners, auditors, and its board.

What do regulators and standards bodies expect from AI agents?

Several public sources now describe agent risks in concrete terms:

• FINRA. The 2026 Annual Regulatory Oversight Report flags agents acting without human validation, acting beyond the user's intended scope and authority, and producing outcomes that are hard to trace. It suggests firms consider how to monitor agent system access, where to keep a human in the loop, how to track agent actions, and how to set guardrails.
• OWASP. The Top 10 for Agentic Applications, published December 2025, names risks such as agent goal hijack, tool misuse, identity and privilege abuse, memory and context poisoning, and cascading failures.
• Singapore IMDA. The Model AI Governance Framework for Agentic AI, launched January 2026, organizes guidance into four areas. Its factsheet lists them as bounding risks upfront, making humans meaningfully accountable, implementing technical controls, and enabling end-user responsibility.
• NIST. The AI Risk Management Framework and its Generative AI Profile give a common structure: Govern, Map, Measure, Manage.

The themes converge. Know your agents. Limit what they can touch. Keep humans accountable. Record everything.

What belongs on an agentic AI governance checklist for banks?

Use this as a working list. Each control should have a named owner and evidence an examiner could inspect.

Three items deserve extra attention in a bank.

Agent identity. Many early deployments let agents act with the invoking user's credentials, or with a shared service account. Both blur accountability. Give each agent its own identity in your identity platform, such as Microsoft Entra ID, Okta, or Ping Identity, and scope it tightly.

Permission-aware context. An agent is only as safe as the context it reads. If a connector ignores document-level permissions in systems like SharePoint, Box, or ServiceNow, the agent can surface data a user should never see. We cover this in depth in Context Engineering for Regulated Enterprises.

Evidence. Logs that only capture the final answer are not enough. Examiners will ask what the agent saw, which tools it called, and who approved the action.

How should a bank tier agent risk?

Tier by what the agent can do, not by which model it uses.

• Tier 1, inform. The agent searches and summarizes approved sources for employees. Controls focus on permissions, grounding, and citation.
• Tier 2, recommend. The agent drafts decisions or customer communications that a person reviews. Add approval logging and output sampling.
• Tier 3, act. The agent writes to systems of record, such as core banking, loan origination, or case management platforms. Require named human approval, transaction limits, and tested rollback.

Most banks should run Tier 1 at scale before opening Tier 3. In a 250-user Glean pilot at a bank, the controls that mattered most were permission fidelity and source curation, long before any agent took an action.

What are the most common agentic AI governance gaps?

• Shadow agents. Business teams build agents in productivity suites and low-code tools without registering them.
• Borrowed identity. Agents run on user or shared credentials, so logs cannot separate human action from agent action.
• Unbounded tools. An agent built to read tickets can also close them because the connector allowed it.
• Stale context. Agents answer from outdated policies because no one owns source freshness.
• Answer-only logs. The bank can show what the agent said, but not why or with what data.

Each gap maps to a control in the table. Closing them is mostly operational work, not model work.

Where does HRTG fit?

HRTG helps regulated enterprises put agentic AI governance into practice on top of an enterprise context layer. For banks using Glean, our Glean Readiness Assessment maps your sources, permissions, and agent use cases against this checklist. Foundation and Activate stand up permission-aware connectors and the first governed agents. Operationalize and Optimize add monitoring, evidence, and scale.

For customer-facing experiences, RISE, HRTG's Verifiable Experience Platform, records what each customer was shown and why, so agent-driven experiences stay auditable.

If you are building your agent governance model now, use the form below to talk with our team.

FAQ

What is agentic AI governance? Agentic AI governance is the set of policies, controls, and evidence that define what an AI agent can access, decide, and do, and how an organization proves those limits held. It covers identity, permissions, human approval, logging, testing, and monitoring.

Does SR 26-2 apply to AI agents? No. The revised interagency model risk guidance issued in April 2026 states that generative AI and agentic AI models are outside its scope. Banks are expected to govern them through broader risk management and governance practices.

What is the principle of least agency? Least agency means giving an AI agent only the autonomy, tools, and permissions its task requires. It limits the damage if an agent is manipulated or misbehaves. OWASP agentic security guidance emphasizes it for tool and privilege risks.

Should every bank AI agent have a human in the loop? Not every agent. Agents that only search and summarize can run with strong permissions and logging. Agents that change records, move money, or contact customers should require named human approval.

Where should a bank start with agentic AI governance? Start with an agent inventory and risk tiers, then fix identity and permissions before expanding agent actions. Those steps make every later control easier to evidence.