When AI Gains Authority: Lessons from Financial Sector Governance

An AI agent can follow every configured rule and still make decisions its institution intended to reserve for a person. A model update can change how the agent acts while leaving its permissions untouched, undermining the assumptions that made its original approval acceptable. In When AI Gains Authority: Lessons from Financial-Sector Governance, Dr. Aditya Vikram Kashyap examines how this failure can emerge between established control functions. Engineering, vendor management and access management may each approve a change within their remit while nobody assesses whether the combined deployment still satisfies its approval conditions. A worked hypothetical procurement case illustrates how an apparently successful model update can allow substantial financial commitments to escape human review without breaching individual transaction limits. Drawing on financial-sector governance, the paper distinguishes institutional approval, operational permissions, behavioural evidence and the decision to authorise continued operation. It connects these distinctions to practical responsibilities: recording approval assumptions, assessing changes against them, assigning decision authority and enforcing controls outside the model’s influence. It also examines where banking practices can be adapted to other sectors and where their institutional foundations limit that transfer. The paper offers researchers, policymakers and practitioners a concrete way to examine accountability after deployment: whether the processes changing an AI system can identify which approval conditions their changes affect, and who has authority to act on the consequences.