The AI Control Gap: Companies Adopting AI Must Learn What Wall Street Learned The Hard Way

Samuel Kaluvuri, CEO of ApyHub, works on API infrastructure and runtime policy enforcement and holds a PhD in security assurance.

Somewhere inside a large bank, an AI agent has a name, a login ID and a manager who has to write its performance review.

This is less eccentric than it sounds, and it’s one of the more rational things I believe banking has done this year. These are institutions with serious risk functions and long memories for things that lose money quickly. Looking for a way to control software that acts on its own, they reached for the instruments they trusted: an identity, a reporting line and someone answerable for it.​

They are developing ways to manage a new kind of software, and the questions they are working through are ones other companies adopting agentic AI will increasingly need to address.​​

Why Traditional Controls Fall Short

Enterprise software has always come with controls: permissions, approval chains, segregation of duties and audit logs. That worked for 30 years because a person asked for something, another looked at it and the system did exactly what was approved.

All three assumptions have stopped being true. The requester is now software operating at machine speed, and approval no longer describes the action. When someone signs off on “handle customer onboarding,” nothing in that sentence says which systems get touched, what data leaves which jurisdiction or what the agent does when it meets a case nobody thought about. The approval covers intent, but the risk lives in the path.

Put an approval workflow in front of a system taking thousands of autonomous actions, and you have not built oversight. You have built a very fast queue of things you already agreed to.

Where Agent Control Actually Lives

So where does control over an agent actually live?

Closing Thoughts

The regulatory direction is visible. In June 2026, the Financial Stability Board warned that the autonomy of AI agents can amplify risks that materialize at great speed.