Why Agentic AI Governance Has Become a Finance-Control Problem
Agentic AI refers to systems that do not merely answer questions or generate text but take multi-step actions across software environments on behalf of a user. In a finance context, that means an AI agent can pull data from an ERP, draft a journal entry, post a vendor change, run a scenario model, or trigger a wire instruction once a threshold is met. The Financial Stability Board warned in 2025 that these capabilities are arriving faster than the controls designed to supervise them, and called for tighter supervisory expectations around agentic deployments in financial services. McKinsey's 2026 State of AI Trust survey echoes the same finding: more than 60% of financial-services respondents reported at least one AI-related control gap in the prior twelve months, and roughly one in three expected agentic workloads to exceed human review capacity within two years.
Also worth reading: What are autonomous finance governance metrics and how do modern CFOs measure them? · How do you implement segregation of duties when using an FP&A agent in your finance team? · How to implement AI in finance for FP&A and operations?
For FP&A teams, the shift matters because traditional spreadsheet governance assumes a human is the actor. Once an agent can read a forecast, write to a planning system, and email a variance commentary to a controller, the audit trail, segregation of duties, and approval matrix all change shape. Governance, in this setting, is not a policy binder. It is the set of technical and procedural controls that determine which actions an agent may take, under what conditions, with what evidence, and with which human in the loop.
What "Governance" Actually Means for an Agentic Finance Stack
Governance in an agentic environment has four layers, and most failures occur because a team builds only the first one. The first layer is identity and access: every agent must have a non-human identity with scoped permissions, an owner, and a lifecycle. The second layer is action policy: a machine-readable rule set that defines which transactions, data writes, and external calls the agent is permitted to perform, including value thresholds, counterparty restrictions, and time-of-day windows. The third layer is observability: structured logs of every prompt, tool call, retrieval, and output, retained long enough to support audit and model-risk review. The fourth layer is human oversight: defined checkpoints where a named individual must approve, reject, or escalate before the agent proceeds.
Deloitte's 2025 expansion of its AI governance and assurance practice reflects this layering. The firm now sells four separate workstreams: identity and access design, policy authoring, continuous monitoring, and board-level reporting. Snowflake's 2025 financial-services AI reference architecture treats the same four layers as table stakes, and adds a fifth: data lineage, so that any number an agent produces can be traced back to the source system, transformation, and prompt that produced it. Mayer Brown's 2025 commentary on Singapore's Agentic AI Framework notes that the Monetary Authority of Singapore expects all five layers to be documented before an agent is permitted to touch a production ledger.
The Regulatory Floor in 2026
Three regulatory regimes are setting the floor for agentic AI governance in finance as of mid-2026. The EU AI Act, which entered its general-purpose model phase in 2025 and its high-risk system phase in 2026, classifies many finance use cases as high-risk, requiring documented risk management, data quality, human oversight, and post-market monitoring. The Singapore Agentic AI Framework, published by the MAS and updated in 2025, goes further on testing: it requires sandbox-based evaluation of every agent before deployment, with documented evidence of safe failure modes. The US approach remains sectoral, but the FSB's 2025 guidance and the Fed's 2024 SR 11-7 model-risk management letter are being applied by examiners to agentic systems, particularly around model inventory, validation, and ongoing monitoring.
For a US-headquartered FP&A team, the practical floor in 2026 is a combination of SR 11-7 (for any model that influences a financial decision), the AI Bill of Rights-style executive guidance, and the EU AI Act if any output touches an EU data subject. For an EU team, the AI Act is binding. For an APAC team, MAS expectations are functionally binding for any institution under its supervision, and Singapore's framework is being adopted in modified form by regulators in Hong Kong, Australia, and Japan.
How to Build an Agentic AI Governance Program in 90 Days
A realistic 90-day rollout for an FP&A team looks like this. Days 1 through 15 are inventory and scoping: list every AI tool in use, classify each by risk tier, and identify which ones have agentic capabilities (the ability to write, not just read). Days 16 through 45 are policy drafting: write a one-page agent charter per use case, define the action policy in a machine-readable format, and assign a human owner with a named backup. Days 46 through 75 are technical implementation: deploy non-human identities, wire logs into a centralized store, and build the approval checkpoints. Days 76 through 90 are testing and sign-off: run the agent in shadow mode against historical data, document failure modes, and obtain sign-off from finance, risk, and internal audit.
The most common shortcut, and the most common failure, is to skip the inventory step. Teams that jump straight to a pilot use case end up with a governance framework that fits one workflow and breaks the next three. The second most common failure is treating the policy as a Word document. A policy that a language model cannot read at runtime is not a control; it is a poster.
Comparison of Governance Approaches
| Approach | Identity & Access | Action Policy | Observability | Human Oversight | Best Fit |
|---|---|---|---|---|---|
| Spreadsheet + SOP | Manual, role-based | Document only | None | Manual review | Pre-agentic, low-risk workflows |
| RPA with audit logs | Service account | Hard-coded rules | Application logs | Exception-based | Repetitive, deterministic tasks |
| Agent platform with policy engine | Non-human identity, scoped | Machine-readable, versioned | Structured, queryable | Configurable checkpoints | Multi-step, semi-autonomous agents |
| Full model-risk framework | Identity + model registry | Policy + model card | Logs + lineage + drift | Tiered human review | Regulated, high-impact decisions |
Common Mistakes and How to Avoid Them
The first mistake is conflating model governance with agent governance. A model governance program reviews whether a model is accurate and fair. An agent governance program reviews whether an actor is permitted to take an action. Both are needed, and they overlap, but they are not the same. The second mistake is granting an agent the same permissions as the human it assists. An FP&A analyst may have read-write access to a planning system; an agent assisting that analyst should have read access to the same data but write access only to a staging table, with promotion to production requiring human approval. The third mistake is treating observability as a logging problem. Logs are necessary but not sufficient. The logs must be queryable, retained for at least seven years to match financial record retention, and correlated with the prompt, the retrieved context, and the action taken.
The fourth mistake is underestimating the cost of human oversight. If every agent action requires human approval, the throughput benefit of the agent disappears. The fix is tiered review: low-risk actions (reading data, drafting text) require no review; medium-risk actions (writing to a staging table, sending an internal email) require spot-check review; high-risk actions (posting to a ledger, changing a vendor record, triggering a payment) require synchronous approval. The fifth mistake is failing to test the failure modes. An agent that works correctly 99% of the time is a liability if the 1% failure mode is silent. Singapore's framework explicitly requires documented evidence of safe failure, meaning the system fails in a way that is detectable, reversible, and bounded.
When to Act and What It Costs
The window for voluntary action is closing. The FSB's 2025 guidance gave firms until end of 2026 to demonstrate compliance with its supervisory expectations for agentic AI. The EU AI Act's high-risk provisions became enforceable in 2026. MAS has been conducting agentic AI examinations since late 2025. A team that begins its governance program in Q3 2026 will be on the early side of the regulatory curve; a team that waits until 2027 will be remediating, not designing.
Cost varies sharply by maturity. A team starting from a spreadsheet baseline can stand up an identity, policy, and logging layer using existing cloud services for under $50,000 in implementation cost and roughly $10,000 to $20,000 per month in ongoing tooling. A team adopting a commercial agent governance platform typically pays $100,000 to $300,000 in year-one setup and $50,000 to $150,000 per year in licensing, depending on the number of agents and the volume of logged actions. A full model-risk program, including independent validation, runs higher, often $500,000 to $1.5 million in year one for a mid-sized financial institution. The cost of not acting is harder to quantify but visible in recent enforcement: in 2024 and 2025, multiple banks received public censure for AI-related control failures, with remediation costs typically exceeding $10 million.
What FP&A Specifically Should Do Differently
FP&A teams sit at an awkward intersection. They are not the first line of defense for model risk (that is typically a separate model-risk office), nor are they the first line of defense for cyber (that is typically a CISO function). But they are increasingly the team that owns the agent, because the agent lives in the planning system, the close process, or the variance analysis workflow. The practical implication is that FP&A must build its own governance muscle, even if it borrows policy templates from risk and identity infrastructure from IT.
Three actions are specific to FP&A. First, define the agent's scope in business terms, not technical terms: which accounts, which entities, which periods, which scenarios. Second, build a reconciliation step into every agent workflow, so that any number the agent produces is compared against an independent source before it is acted upon. Third, treat the agent's output as a draft, not a final, until a named human has signed off, and make that sign-off visible in the audit trail. These three actions are not glamorous, but they are the difference between an agent that accelerates the close and an agent that produces a number no one can defend in an audit.
The Honest Limits of Agentic AI Governance in 2026
It is worth being clear about what governance cannot do. It cannot make an agent accurate; that is a model and data problem. It cannot make an agent aligned with business strategy; that is a design problem. It cannot eliminate the need for human judgment on novel situations; that is a workforce problem. What governance can do is ensure that when an agent acts, it acts within a defined envelope, that the action is recorded, that a human is in the loop where it matters, and that the organization can answer, after the fact, why the agent did what it did.
The tools to do this exist in 2026. The regulatory pressure to do this exists in 2026. The talent to do this is scarce but available. What is missing in many organizations is the decision to treat agentic AI governance as a finance-control program rather than an IT project, and to resource it accordingly. Teams that make that decision in 2026 will find themselves ahead of their regulators and ahead of their peers. Teams that defer it will find themselves explaining a control failure to a supervisor, which is a more expensive way to learn the same lesson.