AI Agents and Delegated Authority: The New Control Point in Regulated Services

An assistant that explains how to change a standing order is a support feature. An agent that changes it has crossed a boundary: it has interpreted intent, used an identity, exercised a permission and altered a regulated service. The conversational interface may look almost identical in both cases. The operating responsibility is not.

This is the strategic question behind AI agents and super apps. The important control point is no longer the screen with the most functions. It is the system trusted to translate a person’s intent into authorised action across accounts, products and providers. Regulated firms need to decide whether they will own that control point, connect to it or make their services safely usable through it.

The unit of design is delegated authority

Most agent demonstrations emphasise reasoning and tool use. Production design should begin with delegated authority: who may instruct the agent, what it may do, against which resources, within what limits and for how long. That authority must be narrower than the user’s theoretical access to every connected system.

A useful action model has four levels:

1. Inform: retrieve approved information and explain options without changing a record.
2. Recommend: compare options or propose a next step, leaving the decision and action to the user.
3. Prepare: populate an instruction or transaction for explicit review and confirmation.
4. Execute: perform the action under a defined mandate, then record the result and support recovery.

Each step adds operational exposure. A firm should not move from information to execution merely because the model appears capable in a demonstration. It should earn that movement through evidence about identity, consent, task performance, exception handling and customer outcomes.

Identity and consent have to survive the conversation

Natural language is good at expressing outcomes and poor at proving authority. “Move the money to my other account” does not establish which account, the recipient, the amount, the timing or whether the speaker is entitled to act. The agent needs a trusted identity session and a structured permission service outside the model.

For payments, this is established regulatory territory. The Financial Conduct Authority: account information and payment initiation services explains that payment initiation occurs at the user’s request and with consent and authentication. The Financial Conduct Authority: Strong Customer Authentication sets expectations around checking that the person accessing an account or initiating a payment is permitted to do so.

An agent does not replace those controls. It may help collect intent, but material parameters should be converted into a structured instruction and checked by the relevant transaction service. Confirmation should show the user what will happen in plain language: resource, recipient, amount, timing, fees and whether the action can be reversed.

Consent also needs scope and duration. Permission to read balances is not permission to move funds. Permission to prepare a transfer is not permission to confirm it. An agent acting for an employee, carer or business administrator may need a different mandate from the account holder. Revocation must take effect immediately across cached sessions and queued actions.

Put policy between the model and the action

The model can interpret a request and propose an action. A deterministic policy layer should decide whether that action is available. It can check the authenticated role, action class, limits, destination, risk signals, required confirmation and current system state.

A controlled action path normally needs:

• An action catalogue: named operations with typed inputs, clear consequences and an accountable service owner.
• Least-privilege credentials: short-lived access scoped to the user, task and resource rather than a broad service account.
• Policy checks: rules applied outside the model for eligibility, limits, separation of duties and required approvals.
• Step-up confirmation: stronger authentication or explicit review when consequence, novelty or uncertainty increases.
• Idempotency: protection against repeating an instruction when the user retries or the network fails.
• Evidence: an event trail linking user intent, retrieved information, proposed action, policy result, confirmation and execution.
• Recovery: a route to cancel, reverse, dispute, investigate or compensate where the underlying service allows it.

This design limits the consequences of model error. It also makes testing tractable: the organisation can evaluate interpretation separately from authorisation and execution.

Existing obligations still apply

The arrival of an agent does not suspend conduct, data-protection or accountability requirements. In its 2026 statement, the Financial Conduct Authority: AI in financial services—shaping our approach through industry engagement says it intends to rely on existing frameworks and highlights governance, testing, monitoring, fair treatment and explanation as practical questions for firms.

Where personal data is involved, transparency cannot be reduced to a small “AI-powered” label. The Information Commissioner’s Office: transparency in AI expects organisations to explain purposes, retention and sharing. For an acting agent, useful transparency also means telling the person what the system can do, when another provider receives data, where a human is involved and how to challenge an outcome.

Fairness needs outcome testing, not confidence in a general-purpose model. The Information Commissioner’s Office: fairness in AI connects fairness with safeguards around automated decision-making and the effects on people. Firms should test whether the agent misunderstands or blocks users with different language, disability, digital confidence or account circumstances, and provide a usable alternative route.

For services offered in the EU, the organisation should also classify the agent’s intended use under the European Commission: AI Act overview. The relevant obligations depend on the role and use, not on the marketing label “agent”.

Human control must change the outcome

A person watching an automated queue is not meaningful oversight if they cannot see the evidence, pause the action or take a different decision. The Government Digital Service: Artificial Intelligence Playbook for the UK Government calls for meaningful human control at the right stages and links the required involvement to complexity, impact and specialist knowledge.

Design human intervention around specific conditions: low identity confidence, conflicting instructions, new recipients, unusually consequential actions, unavailable evidence, vulnerable-customer indicators or a failed policy check. The reviewer should receive a concise case with source material and a clear choice. If every action is sent for manual approval, the agent may add handling rather than remove it; if almost nothing is reviewed, the control may be decorative.

Test the service, not only the model

The evaluation set should include ambiguous requests, prompt injection, stale information, revoked permissions, duplicate instructions, interrupted authentication, unavailable downstream systems and requests that must be refused. Test the full path from words to system state.

The NIST: Generative AI Profile provides a cross-sector risk frame for generative systems. For an agent, teams should turn that frame into service measures such as correct intent classification, parameter accuracy, unsupported-action refusal, policy-block rate, confirmation comprehension, duplicate prevention, recovery success and incidents by action class.

Monitor changes after release. A model update, new tool, revised product rule or altered interface can change behaviour without a deliberate redesign. Keep versions of prompts, policies, tools and evaluation results so the firm can explain which configuration acted at a given time.

Choose the strategic position deliberately

Own the control point

The firm operates the trusted interface and agent. This offers direct customer context and design control, but it carries the burden of identity, permissions, connected-service reliability and cross-product recovery.

Connect to another agent

The firm exposes selected information and actions through governed interfaces. It gains distribution but must preserve consent, brand attribution, commercial terms and a defensible evidence trail across organisational boundaries.

Remain agent-ready without delegating action

The firm makes approved product information, status and hand-off routes machine-readable while retaining execution in its own controlled channel. This can be the right interim position when authority or recovery is not mature enough.

The right answer is to stop at information or preparation when the organisation cannot express permissions precisely, authenticate the actor, prevent duplicate or out-of-scope actions, reconstruct what happened or provide a credible remedy. A fluent interface does not compensate for a weak control plane.

Super-app reach may come from orchestration rather than ownership of every service. The durable advantage will belong to organisations that can accept delegated intent without losing accountability: clear authority, narrow actions, visible evidence and recovery that works when the conversation does not.

Further reading: Financial Conduct Authority: AI and the FCA—our approach; Financial Conduct Authority: Payment Services Regulations and Electronic Money Regulations; Information Commissioner’s Office: guidance on AI and data protection; NIST: AI Risk Management Framework.

Assess the use, authority and controls before building an acting AI service.