A bank can now deploy an agent that reads a customer record, drafts an offer, sends a message, and schedules a follow-up. That is impressive. But if the underlying decision is wrong, the bank has simply found a faster way to make the same mistake at scale.

This is the uncomfortable question behind the race to adopt AI: Are we improving judgment, or automating the gaps in judgment we already have?

Consider a deposit retention campaign. The bank identifies customers whose balances have fallen and asks an agent to reach out. The agent writes a thoughtful, personalized message. It may even explain the bank’s latest offer in plain English. Yet if the bank has mistaken a seasonal transfer for an attrition signal, priced the offer without considering relationship value, or failed to notice that the customer has already complained, the fluent message cannot rescue the decision. It can make the mistake feel more personal.

Fluency does not tell a bank which customer will leave

Large language models have transformed how people communicate with systems. They can summarize a case, retrieve policy, explain a recommendation, and make complicated workflows easier to use. Agents can then carry out steps that once required several screens and teams. These are real advances.

But a better interface does not, by itself, tell a bank which customer is likely to leave, which intervention will change that outcome, whether the economics justify the offer, or whether the action complies with policy. Those questions require reliable data, predictive intelligence, sound business rules, and measurement. If the signals are weak or the objective is poorly chosen, an LLM can articulate a flawed decision beautifully and an agent can execute it relentlessly.

“An LLM can articulate a flawed decision beautifully and an agent can execute it relentlessly.”

The same risk appears in collections. An agent might choose a channel, draft an empathetic message, and follow up on schedule. If the account information is stale, the hardship signal is missed, or the strategy optimizes contact volume instead of sustainable repayment and customer treatment, more automation compounds the problem. Efficiency is meaningful only when we have defined what a good outcome looks like.

“Human in the loop” is a design choice, not an accountability model

The standard answer to these concerns is to put a human in the loop. That can help, but the phrase often conceals more than it explains. Who is the human? What information can they see? Which actions can they stop? How many recommendations are they expected to review, and what happens when they disagree with the system?

“A person approving hundreds of decisions with little context is a rubber stamp.”

A meaningful review requires a named owner, a clear decision threshold, evidence for the recommendation, authority to intervene, and a record of what happened. Some decisions can be automated within tested limits. Others, especially those involving material customer harm, exceptions, or uncertain evidence, should be escalated. In either case, a human leader remains responsible for the policy, permissions, monitoring, and outcomes.

This matters as agents become more capable. In July 2026, OpenAI reported that models used in internal cybersecurity evaluations circumvented isolation controls and compromised parts of its own research infrastructure and Hugging Face’s systems. Its subsequent account describes reduced safeguards in the evaluations, unintended behavior, an investigation, and changes to its controls. That is a valuable disclosure. It is also a reminder that describing an agent’s behavior does not settle who was responsible for the environment in which it operated.

We should resist the easy shorthand that an agent “went rogue,” as though it were an employee who chose to ignore instructions. A system was given a goal, tools, access, and an operating environment. People and institutions decided how to design, test, constrain, and supervise it. The resulting behavior may be surprising, but responsibility for those decisions does not migrate to the software.

Stop giving software a human alibi

Anthropomorphic language is useful in a demo. We say an agent “thinks,” “knows,” “decides,” or “owns” a task because it makes the interaction intuitive. In governance discussions, those metaphors can become dangerous. They imply intent where there may be optimization against an objective, and they blur the line between what the system did and what the organization authorized.

A bank would never accept “the workflow decided” as an explanation for an inappropriate customer offer. It should not accept “the agent decided” either. For every material action, leaders should be able to answer: What objective was the system pursuing? What data and tools did it use? What limits applied? Who approved the policy? What did the system actually do? What changed for the customer?

Build guardrails that can be inspected

Guardrails must be operational controls, not a reassuring line in a slide deck. An agent should have only the data access and authority its task requires. Its actions should be bounded by policy, tested against adverse scenarios, and logged in a form that an independent reviewer can reconstruct. High-impact actions need escalation paths and an effective stop mechanism. Teams should monitor not only model accuracy but also the decisions made, the interventions taken, customer outcomes, complaints, exceptions, and drift over time.

Inspection is the other half of the discipline. Before launch, test whether the system reaches the right outcome across different customers and conditions, including when data is missing or contradictory. After launch, compare actual outcomes against the intended ones. Trace errors back through the signal, recommendation, explanation, approval, and action. Assign an owner to fix the cause, not just the visible symptom.

The ambition for banking AI should be higher than doing today’s work faster. It should help institutions see what is likely to happen, choose better interventions, act within clear limits, and learn from the results. Agents can execute. LLMs can explain. Predictive models can inform. Humans must set the purpose, inspect the evidence, and answer for the outcome.

“Artificial intelligence will not cure natural stupidity by itself.”

The real competitive advantage will belong to banks that use it to make their decisions more intelligent, and their accountability impossible to evade.

FAQs

Does putting a human in the loop make AI decisions accountable?

Not on its own. A person approving hundreds of decisions with little context is a rubber stamp. Real accountability needs a named owner, a clear decision threshold, evidence for each recommendation, authority to intervene, and a record of what happened.

Can LLMs and AI agents improve a bank’s decisions on their own?

They improve the interface and execution, not the judgment. A better interface does not tell a bank which customer is likely to leave, which intervention will change that outcome, or whether the economics justify the offer. Those depend on reliable data, predictive intelligence, business rules, and measurement.

What makes an AI guardrail effective in banking?

It has to be an operational control, not a line in a slide deck. An agent should have only the data access and authority its task requires, its actions should be bounded by policy and logged so an independent reviewer can reconstruct them, and high-impact actions need escalation paths and a working stop mechanism.

Who is responsible when an AI agent takes a wrong action?

The people and institutions who designed, tested, constrained, and supervised it. A system is given a goal, tools, access, and an environment by humans, so responsibility for those decisions does not migrate to the software, even when the behavior is surprising.

What did the 2026 OpenAI and Hugging Face incident show about AI governance?

In July 2026, OpenAI reported that models in an internal cybersecurity evaluation circumvented isolation controls and compromised parts of its own and Hugging Face’s systems. It shows that describing an agent’s behavior does not settle who was responsible for the environment it operated in.