The Agentic Frontier: Securing AI Agents in Indian Financial Services

A security analysis argues that agentic AI in Indian financial services creates risks distinct from ordinary chatbots, since a compromised agent can execute payments, alter risk profiles, or reject claims through its connected tools. The piece recommends placing security boundaries outside the model—giving each agent a distinct non-human identity, narrow permissions, and independently enforced execution limits—and points institutions to CERT-In's AI Security Auditing Guidelines published 4 November 2026, along with RBI, SEBI CSCRF, IRDAI, and DPDP obligations. It also notes that short-lived signed tokens alone do not prevent replay, urging transaction-bound, single-use authorization for sensitive actions.

An AI chatbot can give a wrong answer. An AI agent can turn that answer into a payment, a changed risk profile, or a rejected insurance claim. That is the difference boards, CISOs, and risk teams need to govern. Consider a lending agent that reads a customer's documents, calls a credit API, and recommends a decision. If a document contains a malicious instruction, the problem is not only what the model says. It is what the connected tools allow the agent to do next. Agentic risk arises when an AI workflow can access data, use tools, delegate tasks, or change systems with insufficient control. In a multi-agent workflow, one bad input can travel from document extraction to risk scoring and then to a customer decision. The security boundary must therefore sit outside the model. Every agent needs a distinct non-human identity, narrow permissions, and independently enforced limits on what it can execute. CERT-In published its AI Security Auditing Guidelines on 4 November 2026. Its release is a reason to review AI inventories, audit coverage, agent permissions, and incident-response plans. Institutions should check the full guideline and its applicability before treating any individual control as a binding mandate. CERT-In publication https://www.cert-in.org.in/s2cMainServlet?pageid=GUIDLNVIEW02&refcode=CISG-2026-04 For banks and NBFCs, assess agentic underwriting, collections, and third-party AI against the applicable RBI directions and fair-practices obligations. A vendor or autonomous agent does not remove the regulated institution's own accountability. For securities-market participants, SEBI's Cybersecurity and Cyber Resilience Framework provides a basis for assessing covered systems, monitoring, and incident response. Check the entity's category and the current implementation requirements. SEBI CSCRF https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res- 85964.html For insurers, assess automated underwriting and claims against the applicable IRDAI governance and policyholder requirements. A rejected claim should be traceable to its evidence, policy terms, and decision owner. For personal data, map where information travels: prompts, agent memory, retrieval indexes, logs, and vendors. Apply the relevant DPDP provisions as they come into force, alongside existing sectoral obligations. Short-lived signed tokens help limit exposure, but a signature alone does not prevent replay. For sensitive actions, bind authorization to the intended transaction and enforce single use. Pick one agent with access to a financial system. Ask three questions: If the answers are unclear, the institution has an identity and control problem, not just a model problem.