An AI chatbot can give a wrong answer. An AI agent can turn that answer into a payment, a changed risk profile, or a rejected insurance claim.
That is the difference boards, CISOs, and risk teams need to govern.
Consider a lending agent that reads a customer's documents, calls a credit API, and recommends a decision. If a document contains a malicious instruction, the problem is not only what the model says. It is what the connected tools allow the agent to do next.
Agentic risk arises when an AI workflow can access data, use tools, delegate tasks, or change systems with insufficient control. In a multi-agent workflow, one bad input can travel from document extraction to risk scoring and then to a customer decision.
The security boundary must therefore sit outside the model. Every agent needs a distinct non-human identity, narrow permissions, and independently enforced limits on what it can execute.
CERT-In published its AI Security Auditing Guidelines on 4 November 2026. Its release is a reason to review AI inventories, audit coverage, agent permissions, and incident-response plans. Institutions should check the full guideline and its applicability before treating any individual control as a binding mandate. CERT-In publication
For banks and NBFCs, assess agentic underwriting, collections, and third-party AI against the applicable RBI directions and fair-practices obligations. A vendor or autonomous agent does not remove the regulated institution's own accountability.
For securities-market participants, SEBI's Cybersecurity and Cyber Resilience Framework provides a basis for assessing covered systems, monitoring, and incident response. Check the entity's category and the current implementation requirements. [SEBI CSCRF](https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res-_85964.html)
For insurers, assess automated underwriting and claims against the applicable IRDAI governance and policyholder requirements. A rejected claim should be traceable to its evidence, policy terms, and decision owner.
For personal data, map where information travels: prompts, agent memory, retrieval indexes, logs, and vendors. Apply the relevant DPDP provisions as they come into force, alongside existing sectoral obligations.
Short-lived signed tokens help limit exposure, but a signature alone does not prevent replay. For sensitive actions, bind authorization to the intended transaction and enforce single use.
Pick one agent with access to a financial system. Ask three questions:
If the answers are unclear, the institution has an identity and control problem, not just a model problem.