For most of the last two years, the hard questions about enterprise AI were about models: which one, how accurate, how expensive. That is changing. As agents move from answering questions to taking actions inside core systems, the question supervisors and security teams are asking is simpler and more uncomfortable: who is this agent, what is it allowed to do, and who answers for it?
October 2026 made that shift very visible. In the space of three weeks, regulators in three financial centres and the US standards body all pointed in the same direction. For leaders in banking, telecoms, healthcare and energy, it is worth reading the signals together.
What changed this month
On 7 October, the Monetary Authority of Singapore issued its Guidelines on AI Risk Management. Financial institutions are expected to keep inventories of their AI use, apply controls across the life cycle including human oversight, monitoring and change management, and remain accountable for third-party AI. The guidelines take effect on 7 October 2027, and MAS says it intends to consult in 2027 on additional guidance for agentic AI.
On 13 October, Reuters reported that the Federal Reserve, the OCC and the FDIC are questioning banks about their use of AI agents. According to Reuters' sources, the questions cover what limits are placed on these systems, how their actions are monitored and approved, whether agent decisions can be tracked and audited, what stops agents from exceeding their authority, whether humans stay involved in key decisions, and how banks can shut autonomous systems down. Regulators were described as still gathering information rather than prescribing answers.
On 15 October, the Hong Kong Monetary Authority announced its "ART" framework and an upcoming discussion paper on agentic AI governance exploring "intent-anchored accountability, a registry of material A.I. agents, and effective intervention mechanisms." HKMA also noted that more than 60% of use cases in the second cohort of its GenAI Sandbox explored agentic AI.
Then on 27 October, NIST's National Cybersecurity Center of Excellence published ten design tenets for agent identity management. It is the most concrete answer yet to the questions supervisors are asking.
The common thread: agents are actors, not features
Read side by side, these documents share one idea. An agent that can update a ledger, issue a refund or close a ticket is an actor in your organisation, and it needs the same treatment you give any actor with access to sensitive systems: a distinct identity, a defined scope, an accountable owner and a record of what it did.
Many early deployments skipped this. Agents were often wired up with a shared service account or a copy of a human user's credentials, because that was the fastest path to a demo. NIST names the risk directly: unique agent identities prevent "the dangerous practice of an agent broadly impersonating a human user or service account." When every agent looks like the same service account, no audit log can tell you which one acted, on whose behalf, or why.
Five controls to have in place before the questions arrive
The NIST tenets are written for both enterprise and consumer settings. For a regulated enterprise, five of them translate almost directly into the questions on a supervisor's list.
1. A registry of agents with named owners. Both MAS (inventories) and HKMA (a registry of material agents) point here. For every agent in production, you should be able to show its purpose, its owner, the systems it touches, its risk classification and its current version.
2. Zero standing privilege and task-scoped access. NIST recommends that agents hold no persistent rights when idle, and receive just-in-time, time-bounded access for a specific task. Long-lived tokens and static secrets are exactly what an attacker, or a manipulated agent, will exploit. Vendors are moving fast here: HashiCorp, for example, describes a layered model in Vault 2.2 that combines the human's permissions, a hard ceiling for the agent and ephemeral per-request authorisation.
3. Policy enforced outside the model. One of the most important tenets is the separation of reasoning from permission: the logic that decides what an agent attempts must be separate from the system that decides what it is allowed to do. As NIST puts it, "Guardrails alone are insufficient." Access decisions should be deterministic, so that a prompt injection hidden in a document cannot expand what an agent is able to touch.
4. Human review triggered by risk, not by habit. Supervisors want to know that humans remain involved in key decisions. NIST adds a practical warning about consent fatigue: if escalations fire so often that reviewers approve them on reflex, the control exists on paper only. Define thresholds by value, reversibility and customer impact, and send the reviewer enough context to make a real decision.
5. Evidence the agent cannot edit, and a way to stop it. NIST calls for append-only, tamper-evident logs held independently of the agent, linking identity, delegated intent and resulting actions. Pair that with a tested shutdown path for every agent and every class of action. "How would you stop it?" is a question you want to answer with a runbook, not a meeting.
Why this matters beyond Singapore, Hong Kong and Washington
None of these documents binds a bank in Istanbul or a hospital group in Frankfurt directly. But supervisors read each other's work, and the questions are converging. Firms subject to the EU AI Act, GDPR, KVKK or BDDK oversight already have to explain how automated decisions are made, who is accountable and where data goes. Agent identity is where those obligations meet day-to-day engineering.
It is also an architecture question that is much cheaper to answer early. Retrofitting identity, scoping and audit onto a dozen agents that already share one service account is slow and risky. Designing it in from the first agent costs very little.
How we approach it at Intelligent
This is the reason we treat governance as part of the platform rather than a layer added after launch. In the Intelligent AI OS, permissions, guardrails and audit trails are built once and reused by every agent, policy sits outside the model, and every action is recorded against the agent that took it. We deploy where the client's rules require, including on-premise, and we design each system so the client's own team can operate and govern it after handover.
The goal is simple. When a supervisor, an auditor or your own board asks who your agents are and what they did, the answer should take minutes, not a project.
Start with an honest inventory
If you are running agents today, a useful first step is a one-page inventory: every agent, its owner, its credentials, its scope and its off switch. The gaps usually show up quickly.
If you would like a second pair of eyes on yours, or want to design agent identity and audit into your next deployment from day one, book a meeting with our team at intell.web.app.
Sources & Regulatory References
- NIST: Design Tenets for Agent Identity Management Systems (27 Oct 2026)
- Reuters via Investing.com: Banking watchdogs ramp up AI scrutiny as stability fears mount (13 Oct 2026)
- Monetary Authority of Singapore (MAS): Supervisory Expectations on Responsible AI Adoption by Financial Institutions (7 Oct 2026)
- Hong Kong Monetary Authority (HKMA): "ART" Framework to promote responsible A.I. adoption (15 Oct 2026)
- HashiCorp: Securely govern human and agentic identities with Vault (15 Oct 2026)
