Where agents are going
The work agents are taking on is the work regulators watch most closely.
These are the workflows we build and test KPATH against. In each one the agent does the routine work, and the platform decides which actions it may take alone.
AML alert triage. Only a person files a SAR. The agent closes false positives with a written rationale and hands serious alerts to an investigation agent. It can draft a suspicious activity report, and the filing waits for a person to release it.
Sanctions screening. Holding and releasing both need sign off. On a screening hit, even a partial one, the agent holds the payment and refers it to the sanctions desk. Placing the hold needs approval and so does lifting it, so the call is never the agent’s alone.
KYC onboarding. Straight through when it is clean. A verified, low risk applicant with no sanctions or PEP match is approved automatically, with every check on the record. Any hit is escalated to a person to decide.
Wire recall. No agent pulls money back on its own. The agent works out whether a reported wire has grounds for recall. Every recall it requests waits for a person. Cases without grounds go to a manual queue and the customer is told the outcome.
Card fraud. Protective actions still get approved. Clear fraud leads to a request to block the card, which waits for approval because the customer feels it. The agent cannot refund anything. Refunds belong to a different agent with different permissions.
Trade surveillance. Hold, but never trade. The agent can flag a suspicious order, hold it against the surveillance rule it broke, and refer it to compliance. It cannot execute or cancel a trade, and releasing a hold takes a person.
Why the agent cannot police itself
The control has to sit where the agent cannot reach it.
Most agent frameworks let you write the rules into the agent. That puts the control inside the thing you are trying to control, which is the first place an attacker goes.
A prompt is not a control. An agent’s instructions can say never release a sanctions hit. A prompt injection can rewrite those instructions. KPATH enforces the limit on the call itself, outside the agent, so it holds whatever the agent has been talked into.
Least privilege, per agent. A procurement agent that reaches for a treasury transfer is refused at the call. A claims agent cannot touch payroll. Each agent reaches the systems its job needs and is refused everything else.
Agents hand work to agents. An AML triage agent passes a case to an investigation agent, which may call others. KPATH governs that chain as one piece of work, so stopping the chain stops every agent in it, and the record shows who asked whom.
Revoke one agent and the assistant is shut off, but the work it already started carries on. The assistant agent that took the customer’s request is revoked; the payments agent it started is still running; the ledger has already sent a £48,000 transfer.
Stop the chain with KPATH and stopping the chain stops the assistant and everything it set in motion, and the chain loses the credentials it was relying on. The assistant agent is stopped, the payments agent is stopped, the ledger refuses, and a containment proof shows nothing in this chain was authorised after the stop.
What the regulator will ask
Four questions every agent in a bank has to be able to answer.
Supervisors hold an agent that moves data or money to the same standard as the person who used to do the job. These are the questions that follow.
01. Who is this agent? Every call carries the identity of the agent making it, with a named owner and a risk tier. High-risk agents can be required to present a workload identity that your identity provider verifies. When an agent acts for a customer or a colleague, policy can require that the person is verified too, rather than just named in the request.
02. What is it allowed to do? Policy is set per agent and tightens with the risk tier. Actions such as moving money, blocking a card or filing with a regulator can be made to wait for a named person, while routine actions go straight through.
03. What did it actually do? Every call lands in a tamper-evident record, with approvals captured as they happened, and streams to your SIEM. The record holds who acted and what was decided, never a secret or a message body. Your auditor can check the record has not been altered without taking our word for it.
04. How do we stop it, now? Pause or kill one agent, or a whole chain of agents mid flight, credentials included. Afterwards KPATH produces a record anyone can check, showing that nothing in that chain was authorised after the stop.
Credit scoring is one of the uses the EU AI Act treats as high risk, with obligations from December 2027. Read what the Act asks of agent estates.
For the security review
What your CISO will want to know before anything goes live.
No credentials in the agent. Agents hold their own identity and nothing else. KPATH adds the real credential for each system on an allowed call, so a compromised agent has nothing that opens a door anywhere else.
Keys stay where you keep them. KPATH runs in your own cloud or data centre, or as a service we run for you. Credentials are encrypted under a key held in your own vault or key service, such as HashiCorp Vault, AWS KMS or Azure Key Vault, and traffic is encrypted in transit on every hop.
Your guardrails, inside your boundary. Content checks run through the guardrail you choose, at the point of the call and scaled to the agent’s risk tier. Host it yourself and the content it inspects never leaves your estate.
Failure behaviour you choose in advance. If KPATH itself has a problem, it either keeps applying the last decision it made for that agent and action, or refuses calls until it recovers. You pick which, and monitor mode raises the gap rather than hiding it.
Related: shadow AI agent discovery, the AI agent control plane, or the KPATH platform.