Why it matters now
Banks and insurers are moving AI from chat assistants to agents that act: closing alerts, approving customers, routing complaints. Every action is a decision someone is accountable for.
Regulators judge those decisions the same way they judge human ones. If you can’t show what the agent saw, which rules applied and who approved it, the decision is hard to defend.
The six controls of AI agent governance
- Inventory. Know every agent, its owner and its purpose.
- Permissions. Limit the tools and data each agent can use.
- Rules before action. Check policy before an agent acts, not after.
- Human oversight. Send high-risk decisions to a named person, and keep a way to stop any agent.
- Monitoring. Score reliability and spot when behaviour changes.
- Evidence. Keep a tamper-proof audit trail of every decision.
Model governance vs agent governance
| Model governance | Agent governance | |
|---|---|---|
| Focus | Is the model sound? | Is each action allowed and correct? |
| Timing | Before release, then periodic reviews | Before and during every action |
| Evidence | Validation reports | A record of every decision |
| Change | Versioned releases | Prompts, tools and data change weekly |
Who does what
- Business teams run the agent and own its outcomes.
- Risk and compliance set the controls and check they work.
- Internal audit tests that the controls held.
- Technology connects agents and keeps them inside their limits.
How Verus helps
Verus puts all six controls in one place. It records every decision, applies your rules before the agent acts, sends risky calls to a person, scores reliability and seals each decision in a signed certificate anyone can check.