Industry
Banking
Banking Services Transformation: Unlocking Exponential Value
Highlights
- The evolution of AI from assistive technology to an autonomous digital actor requires a corresponding shift in cybersecurity. Zero trust transformed enterprise security by eliminating implicit trust in users, devices, and networks.
- Zero trust for autonomous agents (ZTAA) extends the zero-trust philosophy from identity verification to decision validation. It establishes a framework in which every autonomous action is continuously assessed, governed, monitored, and justified before execution.
- Ultimately, the AI-augmented mainframe operating model must evolve beyond IT productivity gains into a unified business ecosystem, enabling banks and insurers to accelerate innovation and strengthen resilience in an AI-native landscape.
On this page
Overview
Artificial intelligence is rapidly evolving from an assistive technology into an autonomous digital workforce capable of reasoning, planning, accessing enterprise systems, invoking tools, executing workflows, and making decisions with limited human intervention. In the banking, financial services, and insurance (BFSI) industry, autonomous agents are increasingly being considered for customer onboarding, fraud investigations, compliance operations, lending decisions, cybersecurity monitoring, claims processing, and operational workflows.
As agentic AI gains traction, financial institutions must know that maximising the gains from AI adoption will not hinge on building increasingly intelligent agents alone. It will become critical to ensure that autonomous decisions remain observable, accountable, governable, and subject to human authority.
While these capabilities promise significant gains in productivity, speed, and scalability, they introduce a fundamentally new category of risk. Traditional cybersecurity architectures are designed to govern users, devices, applications, and services. Autonomous AI agents represent a new class of digital actors capable of initiating actions, influencing business outcomes, and interacting dynamically with enterprise resources. An authenticated agent can perform unsafe, unauthorised, non-compliant, or harmful actions if its objectives are manipulated, its memory is poisoned, its tools are abused, or its reasoning is compromised.
We outline the concept of zero trust for autonomous agents (ZTAA), which extends the zero trust principles beyond identity verification to autonomous decision-making. Where the traditional zero trust approach asks, 'Who is requesting access?', ZTAA asks, 'Should this autonomous decision be allowed to execute?' This shift from identity verification to decision verification marks the next phase in the evolution of enterprise security.
Under ZTAA, every AI-generated action is evaluated against organisational policy, business objectives, risk thresholds, regulatory requirements, and contextual signals before execution. Trust is no longer granted solely because an agent possesses valid credentials; trust must be continuously earned through demonstrated compliance with policy, purpose, and acceptable behaviour.
Traditional zero trust is no longer enough
Identity, context, and least-privilege access are the foundational principles of cybersecurity. The zero-trust architecture advocates against implicit trust and enforces continuous verification of users, devices, applications, and workloads.
Autonomous agents, however, challenge the assumptions on which traditional zero trust is built. Unlike conventional applications, agents can interpret objectives, formulate plans, retrieve information, invoke tools, collaborate with other agents, generate content, and execute actions that influence business outcomes. They operate with varying degrees of autonomy and can dynamically alter behaviour based on context and environmental inputs.
As a result, a legitimate and authentic agent can become a source of risk. Prompt injection, excessive agency, sensitive data exposure, misinformation, improper output handling, tool abuse, memory poisoning, and retrieval augmentation attacks can all convert a valid identity into an unsafe actor.
In financial services, an autonomous agent could initiate unauthorised payments, approve ineligible loans, suppress anti-money laundering alerts, expose customer data, manipulate financial reports, or perform actions that violate regulatory obligations. While traditional access controls can verify if an agent is authorised to access a system, they cannot determine whether the action being proposed is appropriate, compliant, explainable, or aligned with organisational intent.
The zero-trust philosophy for autonomous agents
We propose extending the zero-trust concept to autonomous agents by building a security architecture and governance model where every autonomous action is continuously authenticated, authorised, evaluated, monitored, and governed before execution.
Under this model, trust becomes dynamic, contextual, and action-specific. The control objective is not only to protect systems and data, but to govern machine decision-making itself.
In designing a zero-trust architecture for autonomous agents, financial institutions will need to extend traditional zero trust by introducing a dedicated governance and verification layer between agent intent and execution. This ensures that autonomous agents cannot directly access critical resources without passing through policy, context, risk, and oversight controls. Table 1 lists the key components of this architecture.
Component |
Purpose |
Agent identity and registry |
Establishes agent ownership, purpose, autonomy level, risk classification, approved capabilities, and lifecycle status |
Trust broker or policy decision point |
Evaluates context, risk, business impact, and policy compliance; decides whether actions are allowed, restricted, escalated, denied, or quarantined |
Policy enforcement points |
Enforce decisions across tools, APIs, enterprise applications, data sources, models, memory stores, and inter-agent communications |
Secure runtime environment |
Executes agents in controlled environments using sandboxing, resource limits, network restrictions, and secret management |
Memory, RAG, and model governance |
Protects vector stores, long-term memory, retrieval systems, prompts, templates, and approved model versions |
Observability, audit, and containment |
Captures telemetry, policy decisions, approvals, tool invocations, and provenance; supports kill switches, quarantine, and response workflows. |
Table 1: Key components of the zero-trust architecture for autonomous agents
Decision validation is at the core of ZTAA
Before an autonomous action executes, the proposed decision is evaluated across intent, identity, context, policy, risk, authorisation, monitoring, and outcome validation. Intent validation determines what the agent is attempting to achieve and whether it aligns with approved objectives of why it was deployed in the first place. Identity verification validates the agent’s identity, user delegation, tool identity, session validity, and credential scope.
For banking and financial services organisations, the shift from access verification to decision validation will enable safe deployment of autonomous agents in high-stakes financial processes.
With intent established and identity verified, we come to context assessment, wherein data, tools, systems, transaction criticality, runtime posture, and business process impact are assessed. It is worth noting that policy evaluation is a must, which means that policy-as-code and attribute-based access rules ought to be applied to the specific action, not merely the session.
Another important aspect is that of risk assessment. The model is designed to calculate behavioural, contextual, data, tool, model, and business-impact risk, after which comes the final step of action authorisation that results in one of these states: allow, restrict, human approval needed, simulate, deny, or quarantine. The model is also designed to conduct runtime monitoring and post-execution validation to observe behaviour, confirm outcomes, update behavioural baselines, and trigger incident response where needed.
By transforming security from access control into continuous decision governance, such a model is particularly useful in financial services across a variety of functions such as validating beneficiary authenticity before payment release, verifying credit policy compliance before loan recommendation, requiring investigator escalation before suppressing an AML alert, and so on.
A case in point: Stopping a fraudulent payment before it happens
Imagine a global bank where AI agents autonomously manage routine payment operations. One day, an agent receives a request to execute a USD 10 million cross-border transfer for a corporate customer. On the surface, everything appears legitimate. The customer is authentic, the agent has the authority to process the payment, and all system credentials are valid.
In a traditional security model, the transaction would proceed without delay after access verification. But under the proposed approach, the decision itself will have to be verified.
Before authorising the payment, the agent's intent, identity, business context, policy compliance, and risk profile are independently evaluated. Let us say, in this case, identity checks reveal no compromise but the broader assessment uncovers several warning signs: the beneficiary was added only hours earlier, the payment amount is unusually large, the destination jurisdiction carries elevated risk, and the transaction falls outside the customer's historical pattern. Together, these indicators will generate a high-risk score and automatically trigger human review.
The investigation reveals the source of the anomaly: a business email compromise (BEC) attack had introduced a fraudulent beneficiary account. Because the decision was challenged, the payment was halted and a multimillion-dollar loss was avoided.
This illustrates the fundamental shift introduced by ZTAA. While traditional zero trust asks, "Can the agent access the payment system?", ZTAA asks, "Should this action be allowed to go through?"
By continuously validating intent, context, policy, risk, and outcomes, this zero-trust approach transforms security from access control into decision governance, enabling organisations to deploy autonomous agents with confidence across payments, lending, AML, fraud management, and other high-stakes financial processes.
Further, autonomous agents expand risk beyond conventional application and identity threats through prompt injection, excessive agency, and unsafe tool use. Additional exposures include data exfiltration, poisoned memory or retrieval, compromised models and supply chains, and malicious inter-agent communication.
ZTAA addresses these risks through least privilege, trusted provenance, validation, scoped data access, authenticated messaging, monitoring, and approval controls. Grounding checks, human oversight, anomaly detection, quarantine, credential revocation, and kill switches help prevent, detect, correct, and contain unsafe autonomy.
Future outlook
Zero trust for autonomous agents will likely become more important as financial enterprises move from single-agent assistants to multi-agent ecosystems that coordinate, delegate, and execute across business processes and organisational boundaries. The next evolution will include machine-to-machine trust, remote attestation, confidential execution, and verifiable action provenance. The Internet Engineering Task Force (IETF) RATS defines an architecture where an attester produces evidence, a verifier appraises it, and a relying party uses attestation results to make trust decisions.
Financial institutions are on course to deploy multi-agent ecosystems consisting of customer service agents, lending agents, fraud investigators, treasury assistants, compliance agents, cybersecurity agents, regulatory reporting agents, and inter-bank settlement agents. Consequently, the future challenge will not be building more intelligent agents, but establishing trustworthy, verifiable, and governable autonomous decision-making.
As ZTAA advocates embedding verification, accountability, and continuous oversight into every stage of agent operations, boards and risk committees must establish clear boundaries that define which actions agents can recommend, execute, escalate, or never perform. High-impact activities such as payments, lending decisions, sanctions screening, suspicious activity investigations, capital markets operations, and customer-facing actions demand auditability, traceability, and controls. Equally important is ensuring that human oversight remains integral, with human-in-the-loop controls for critical decisions and autonomous process monitoring.
For security architects and technology leaders, the focus must be on operationalising trust. Autonomous agents should be managed as privileged non-human actors, governed through integrated controls spanning identity and access management, privileged access management, API security, data protection, security monitoring, and incident response. Enterprise architectures should enforce policy compliance at every tool, data, model, memory, and API boundary. At the same time, governance frameworks must align with emerging standards and regulations, including ISO/IEC 42001, the NIST AI Risk Management Framework, and evolving regulatory expectations.
For the financial services industry, ZTAA is not merely a cybersecurity architecture; it is a future-state governance model for autonomous operations. Organisations that master this capability will be better positioned to unlock the benefits of autonomous AI while maintaining trust, resilience, compliance, and accountability.