Go to home page
CONTACT
Blog
 

Agentic AI in Banking: The Control Layer Standing Between Pilot and Production

Most banks now have something agentic running somewhere. A copilot in the contact centre. A document reader in the credit team. A workflow assistant in operations. What almost no bank has is a large number of those agents running in production, in front of customers, with money and regulated data flowing through them.

The gap between pilot and production is the defining problem of enterprise AI in banking right now. Gartner expects more than 40% of agentic AI projects to be cancelled before the end of 2027, and inadequate risk controls sit alongside cost and unclear ROI as a leading cause. In our conversations with banks across the world, the pattern is consistent. The pilot works. The business case is credible. Then the risk, compliance and information security teams ask a set of questions the platform cannot answer, and the project waits.

The questions are always the same. Which agent took this action? On whose authority? What data did it see? What policy applied at the moment of the decision? Where did a human step in, and did that human have enough context to make a real decision? If a customer disputes an outcome six months from now, can we reconstruct what happened?

These are not AI questions. They are control questions, and banks have been answering them for decades for every other system they run. The agentic stack is simply the first place where they cannot answer them yet.

Three types of agentic use cases, three different risk profiles

It helps to separate agentic banking into three categories, because each carries a different blast radius and a different return.

Back office agents work on internal efficiency. Loan origination and underwriting support, reconciliation, exception handling, KYC document review, complaint triage. These dominate today because if the agent gets it wrong, an employee reviewing the output catches it. The value here is a structural shift in how a bank spends its people. A senior banking executive put it to us plainly. His institution currently runs roughly 60% of its staff on operational activity and 30% on new work. His AI plan is to invert that ratio. Customers benefit indirectly and immediately, because an underwriting decision that took four days now takes hours.

Agents in banking channels change the customer experience directly. Support assistants that resolve rather than deflect, advisory agents that personalise product guidance, onboarding and KYC journeys that adapt to the customer instead of forcing the customer through a fixed form. This is where retention and acquisition live. It is also where a mistake is visible to the customer and to the regulator, which is why most banks have not moved here at scale.

External agent connectivity is the category most banks have not planned for, and it is growing fastest. Most agentic activity today is being built outside banking channels by companies that will never hold a banking licence, and those agents need payments, account data, identity verification, and credit signals. They will source them from whichever institutions are ready to be consumed programmatically, through MCP for tool and data access and A2A for agent-to-agent negotiation. This is also the first category with a direct revenue line, because every tool call and agent-initiated transaction is a metered event that can be priced the way API products are priced today. The banks that build this connectivity first will collect distribution and revenue their competitors cannot easily take back.

The strategic point is that all three categories run on the same foundation. A bank that builds control only for back office agents will rebuild it twice.

Build, connect, control

(Source: https://wso2.com/library/blogs/wso2-agentic-enterprise-fabric/)

Think of the agentic stack as an iceberg with three layers.

The build layer is what everyone sees first. Agents, copilots, bots, workflows, AI-enabled applications. This is where the value becomes visible, and it is also the easiest part. A capable team can produce a convincing agent prototype in weeks.

Beneath it sits the connect layer, which makes enterprise systems usable by agents. APIs, governed tools, MCP servers, knowledge bases, context graphs, systems of record. Banks with a mature API and integration estate have a genuine head start here, because their core capabilities are already exposed as governed interfaces rather than buried in monoliths.

Beneath that sits the control layer, which is what makes any of it safe to run. Agent identity and attribution, an AI gateway across LLM and MCP traffic, observability and evaluation, guardrails and policy, and lifecycle management for agents themselves.

Most banks have made real progress on build and connect. It is the control layer where their agentic programmes stall. This is not a failure of ambition. It reflects a rule of thumb that has served banking well for a long time, which is that doing nothing is safer than doing something risky. The way past it is not to argue with the risk team. It is to give them a control layer they recognise.

What the control layer has to cover

WSO2 has spent decades in exactly this space. API management and identity and access management have been our core business for a long time, and banks from the largest global institutions to community lenders run mission-critical access control on our platform. That foundation is now extended by a product suite built specifically for agentic systems. Our banking reference architecture assembles these into a working control layer for financial institutions. It covers the following.

Control over the agent itself. Every agent is registered, owned, versioned and managed across its lifecycle from development to production. Every trace is captured with OpenTelemetry-compatible tracing that drills into LLM interactions, reasoning steps and tool calls, so root cause analysis takes minutes rather than weeks. Continuous evaluation runs against defined task sets at runtime, so quality drift is detected rather than discovered.

Control over the agent's connection to models. An AI gateway sits across all LLM and MCP traffic. Provides controls such as token-based routing across providers, rate and cost limits per agent and per business unit, context pruning, rate limiting and guardrails on both prompts and responses using rule-based and model-based checks. Sensitive data masking happens at the boundary, so customer identifiers never reach a third-party model unless policy permits it.

Control over agent identity. Agents are neither human users nor service accounts, and giving them borrowed credentials destroys attribution. Each agent gets its own identity that can be registered, authenticated, authorised, audited and revoked instantly. Delegated authority is explicit, so the platform always knows which customer or employee an agent is acting for and what that principal actually consented to. Human-in-the-loop approval becomes a designed control point at defined risk thresholds rather than a manual workaround.

Control over the agentic data access layer. MCP and A2A proxies govern what tools an agent can discover and invoke, with an MCP hub for controlled publication of banking capabilities to internal and external agents. Enforcement is parameter-aware. Exposing a payments tool to an agent is not the same as allowing it to release funds above a limit or to a beneficiary outside the consent the customer granted. What the agent is permitted to reach and what it is attempting to do are separate questions, and both have to be answered at the point of action.

Build it once

This control layer cannot be built ad hoc, use case by use case. It has to be built once, against a long term vision, so that every agentic use case that follows inherits it.

The layer deploys where your architecture requires, including the hybrid pattern most banks prefer, where the control plane is managed and the gateways and data planes stay inside your own perimeter.

It also does not need to replace what you already have. The layer is modular and integrates with the identity, API and monitoring systems already running in the bank. Take the components you need and leave the rest.

The banks that reach production first will not be the ones with the best models. They will be the ones whose risk teams said yes.

Next steps