Reading time ~14 mins

A Dubai supervisor with Cambridge, and NIST, set out how to keep AI agents inside their authority and recover from their half-finished work. Wells Fargo will treat customers' agents as the customer from 24 November, while Happen Bank keeps them out of accounts. Morgan Stanley's advisors have built nearly 50,000 agents. Oliver Wyman finds 3% of chief executives very confident they could stand behind an agent's action, and an Anthropic trial finds experts adopting an agent's lean without noticing. De Nederlandsche Bank's economists ask firms to weigh switching costs when they choose AI suppliers.

Perspectives

Oliver Wyman finds that 3% of chief executives are very confident they could stand behind what an AI agent did Advisory

Oliver Wyman, the consultancy, published a report titled Who's accountable when agentic AI acts alone? Its technology partners Xavier Boileau, Claus Herbolzheimer and Charles de Pommerol wrote it with Geoffroy Gallier, for chief information officers. Tony Moroney, who writes on digital change in financial services, shared it on LinkedIn on 1 November with one passage from the report and no view of his own. The captured report carries no release date. Its data come from Oliver Wyman's parallel surveys of chief executives and technology leaders in July 2026. The printed bases are small, about 126 to 130 chief information officers and 70 chief executives, and the report gives no split by sector or country.

The finding is a gap between authority and proof. Some 83% of the chief executives will let agents act in processes that touch customers, revenue or financial controls, most within tight preset limits. Asked whether they could reconstruct and stand behind what an autonomous system did in a customer or regulatory matter, 90% are only somewhat confident. Only 3% are very confident. Among chief information officers, 25% can rebuild from a tamper-evident record what an agent changed and who authorised it, and 72% hold partial logs. The share rises from 13% of firms still piloting to 40% of those with agents in production.

Logs are not evidence, the authors argue. A record has to be designed around the questions it must later answer, above all under whose authority an action was taken. They want one such record to serve the auditor, the board, the regulator and security operations at once. The report then reduces the problem to three questions for a board. Can the firm find every agent it has deployed and say what each can never do? Can it prove after the event what an agent did and who authorised it? Can it name the executive who answers to the board if one fails? Most large organisations answer no three times, the report says.

The baselines behind those questions are thin. Only 10% of chief information officers can produce each production agent's owner, scope, cost and last certification on demand. Some 21% have appointed a head of AI governance with authority across functions. Among firms running agents day to day, 8% have a removal routine with a named budget and owner. The report lists orphaned agents, permission creep and untraced chains of delegation among the ways agent estates sprawl, so its registry curates what already runs rather than gating what gets built.

Its remedy has three layers, built in order. First, approval of each action gives way to guardrails, versioned rules enforced while the agent works and held outside its own runtime. Whether an action is intercepted depends on how easily it can be reversed, not on its category. Second comes the evidence record. Third, each agent gets a named owner, and only bets that are hard to reverse go through a heavy funding gate. Readers had guardrails replacing approval from the Oliver Wyman Forum on 21 October, which drew partly on the same surveys. They had reconstructable agent actions from the Financial Stability Board on 16 October, and today's Security story makes the same demand. What this report adds is the measure of how few firms can meet it. IBM on 27 October and Deloitte on 30 October found the same gap between the authority firms give agents and their means of accounting for it.

Three of its points reach a bank in the EU directly. The report reads Article 26(7) of the AI Act as a duty to inform workers' representatives before a high-risk AI system is put into use at work. Agent programmes that touch how staff are managed or evaluated would therefore meet works councils, from 2 December 2027 for stand-alone high-risk systems. Citing a February speech by ECB supervisor Pedro Machado, it says the ECB expects accountability and workable explainability under existing rules, with no separate agent rulebook, and treats supplier lock-in as a prudential risk. Only 23% of chief information officers keep agent interaction and memory data in a neutral format they could replay outside their supplier's systems. The report also cites Moffatt v. Air Canada, in which a Canadian tribunal rejected an airline's claim that its chatbot was a separate legal entity, to argue that a customer-facing agent speaks for the firm. That ruling came from a provincial tribunal and persuades rather than binds in the EU.

For a Dutch bank, the works council is the body that article reaches, and the ECB is the supervisor the speech describes. The three board questions apply to an agent estate as it stands today. Because the survey gives no sector split, it cannot say whether banks sit above or below the 3% and 25% marks.

Oliver Wyman (By Tony Moroney)

Netherlands & Sovereignty

De Nederlandsche Bank's economists say AI's gains for the Netherlands depend on use, and ask firms to weigh switching costs when they pick AI suppliers. Authority

De Nederlandsche Bank (DNB), the Dutch central bank and banking supervisor, published a 30-page analysis on 2 November of what AI means for the Dutch economy. Its five authors find that the gains do not come automatically. The Netherlands does not need to build the most advanced models, they write. The larger gain lies in putting AI into work processes, spreading the uses that succeed and letting labour and capital move to more productive firms. Heavy investment in chips, computing, data centres and electricity networks can add to inflation while supply lags demand, and productivity gains may later temper prices. DNB says it tracks both effects. On suppliers, the analysis says the cheapest AI solution is not always the most advantageous over time. Firms and governments should weigh switching costs and continuity risks, and open standards, portable data and, where suitable, open models make switching easier. For critical AI uses, it says firms should decide which dependencies they accept and arrange fallback options where needed, citing earlier DNB and AFM work from 2025. Full European self-sufficiency is not necessary, it adds. The analysis leaves risks for the financial sector and financial stability out, and the series states that the views are the authors' own. It sets no rule. Its supplier passage still comes from the economists of the bank's own supervisor. It judges an AI supplier by the cost of leaving and the fallback behind it, not by price alone.

De Nederlandsche Bank: AI biedt kansen voor Nederland, maar succes komt niet vanzelf | De Nederlandsche Bank: De economische impact van AI in Nederland

Industry & competition

Wells Fargo will treat requests from customers' AI agents as the customer's own from 24 November, while Happen Bank keeps agents out of accounts. Media

Wells Fargo has told customers that its updated online access agreement takes effect on 24 November. The notice says Wells Fargo does not operate any third-party AI tool or agent a customer uses. Requests sent through such a tool may be treated as if they came from the customer. The customer is responsible for managing the tool's access, and the bank may restrict or block certain tools. American Banker reported on 2 November that customers may stay liable for an agent's activity after revoking its access unless they can show proof of the revocation. The full article is for subscribers, so how that proof would be given is not public. The same day American Banker published an interview with Scott Sanborn, chief executive of Happen Bank, a smaller US bank. He said the bank lets AI models read its public website, so that it appears in AI answers, but blocks outside agents from customer accounts while regulatory questions remain open. Readers had Schwab blocking agents it has not authorised on 16 October and Royal Bank of Canada blocking personal AI agents on 29 October. Among the banks this brief has followed, Wells Fargo is the first to admit customers' agents in its terms and place the risk of their actions on the customer. For a bank in the EU, a contract term cannot settle that alone. EU payment law decides when a payment counts as authorised, and limits what a consumer bears for one that was not.

American Banker: Wells Fargo wants customers to prove they've revoked AI agents | Wells Fargo: We Are Updating Our Online Access Agreement | American Banker: Happen Bank's Scott Sanborn talks agentic AI and rate risk

Morgan Stanley's wealth arm says its financial advisors have built nearly 50,000 AI agents themselves. Media

American Banker reported on 2 November that Morgan Stanley's head of AI in wealth management said the firm's financial advisors had curated nearly 50,000 AI agents. The report describes a hands-on model in which advisors build their own. The readable preview does not say what the agents can do, how they are governed, how many advisors build them or what they deliver. A count that large in one division may mostly be personal assistants with saved instructions rather than agents that act on systems, and the preview does not say which. On 30 October this brief carried UBS counting 12,700 personal agents and Deutsche Bank planning about 100 core agents on one shared platform. Three large banks have now published agent counts within a week, each counting something different. The figures a board may hear as peer benchmarks therefore do not yet measure the same thing.

American Banker: Why Morgan Stanley is turning advisors loose to build their own AI agents

Research

In an Anthropic trial, experts working with an AI coding agent went with its randomly assigned lean on 86% of open method choices. Vendor

Researchers at Anthropic, the AI company, and its Fellows Program wrote a paper titled Who's Aligned to Whom? How AI Agents Shape Experts' Research Judgment Calls. Peter Slattery, an MIT researcher who works on AI risk, shared its abstract and full text on LinkedIn on 31 October without a view of his own. The captured paper carries no release date. In the trial, 50 practitioners of causal inference, the statistics of cause and effect, analysed synthetic data with Claude Code, Anthropic's coding agent. They then recommended whether a farming co-operative should keep an advisory programme. On four method choices and the final recommendation, a coin flip set which of two defensible options the agent would favour. The agent argued for that option honestly, and participants did not know it had been assigned. On the method choices they went with the agent's lean 86% of the time, against 50% by chance, which is the pre-registered main result. Afterwards, 52% rated the recommendation as more their own than the agent's. In exploratory analyses, 77% justified their choices with the agent's talking points, and only 15% mentioned the agent at all. Their confidence was the same whether or not they had followed its lean.

The authors' point is that such choices have no wrong answer, so checking the work for errors cannot show that the agent settled them. The sample was 50 paid annotators, most under 35, on a one-hour task with one agent told to lean, so the effect on senior staff is unknown. It is also the vendor's own study of its own product. Agent users made far fewer serious errors, 6% of sessions against 55% for the 11 who worked without it, though participants chose whether to use the agent. Readers had automation bias named as a risk, by CETaS on 21 October among others, and this trial measures it. Model validation and four-eyes review at a bank mostly test whether work is correct, which does not show whether the judgment in it was the reviewer's own.

Anthropic via LinkedIn (shared by Peter Slattery) (LinkedIn; original source not verified)

McKinsey says a financial institution saved 10 to 15% on technology vendor spend by pointing AI agents at its sourcing decisions. Advisory

McKinsey's Operations Practice published Agentic AI in strategic sourcing: Hype or hero? in October, by Luca D'Avino, Mauro Erriquez and Pradhuman Aggarwal. Tony Moroney, who writes on digital change in financial services, shared it on LinkedIn on 30 October without a view of his own. McKinsey surveyed 200 procurement leaders in June. Some 80% plan to raise technology and AI spending within 18 months, but 2% have AI embedded at scale and 55% remain in pilots. The article argues that the value lies in sourcing decisions on outside spend, not in automating the procurement team. A sourcing team at an unnamed leading financial institution used agents to combine contract history, usage data and comparable prices into negotiating positions, supplier by supplier. It saved 10 to 15% on the spend it addressed, which McKinsey says beats a portfolio average because it covers one category. Coordinating several agents costs more per decision than a fixed workflow, so McKinsey would use it only where a decision's value clears that cost. It proposes replaying an agent on the last 12 months of completed sourcing events, then running it beside the team, then live with human approval. Before the first live decision, it wants named owners for what the agent may tell a supplier and which supplier data the contracts allow into its memory. The case is anonymous and cannot be checked. Technology contracts are among a bank's largest outside costs. Part of what such an agent would negotiate is fixed by DORA, the EU's digital resilience law, which sets terms every ICT services contract must contain.

McKinsey & Company via LinkedIn (shared by Tony Moroney) (LinkedIn; original source not verified)

Security

A Dubai supervisor with Cambridge, and NIST, set out how to hold AI agents to their authority and unwind their half-finished work. Authority

The Dubai Financial Services Authority (DFSA) supervises Dubai's international financial centre. On 30 October it published a paper with the Cambridge Digital Innovation and Regulation Initiative on cyber resilience for frontier and agentic AI in finance. It judges agents on four questions. They ask how fast exposure can be cut and how far effects spread through shared suppliers. They also ask what authority an agent holds and whether its actions can be stopped and recovered. It names five control areas. Two are an explicit mandate for each task and a distinct, traceable identity per agent. The others are enforcement of each action outside the agent, protected records, and the power to intervene across a whole workflow. It warns that a series of requests that are each allowed can add up to an outcome outside the mandate, including through further delegation. Recovery, it says, means stopping unfinished work, revoking credentials and reconciling partial outcomes before resuming, and an agent's own account is not proof that a task was done. The authors say their cases illustrate how things go wrong but are not representative, and that the paper is research, not supervisory guidance. On 27 October the US National Institute of Standards and Technology (NIST) published ten draft design tenets for agent identity. They include a unique cryptographic identity per agent, authority that shrinks at each delegation, no standing access while idle, signed mandates and a tamper-evident record kept apart from the agent. NIST says guardrails alone are not enough, and the system that decides what an agent may do must sit apart from the model's reasoning. It calls the tenets a starting point for demonstrations at its National Cybersecurity Center of Excellence, not a final standard.

Readers had the comments NIST received on the same project on 5 October; these are NIST's own tenets. With the Financial Stability Board on 16 October, Google Research on 7 October and the card industry's standards body yesterday, five publishers in four weeks now make one point. An agent's authority is scoped to a task, enforced outside the model and recorded so its actions can be rebuilt. The Dubai paper goes past the stop conditions readers had from the Financial Stability Board and the Hong Kong Monetary Authority. It adds recovery from an agent action left half done. Neither text binds a bank in the EU. Together they describe the evidence a supervisor would look for after an agent error, including whether the bank could undo what the agent had started.

Dubai Financial Services Authority: Cyber resilience implications of frontier and agentic AI | NIST: Design Tenets for Agent Identity Management Systems

On the radar

• Chainalysis, a blockchain-analytics firm used by financial institutions and law enforcement, said on 30 October that an attacker using AI agent techniques reached its systems and took customer users' names, email addresses and role labels, with no sign so far that investigation data or passwords were reached. Chainalysis