Which AI-agent actions in a wealth firm require human approval?

Only the irreversible ones: moving money, sending anything external to a client or counterparty, granting access or credentials, and committing the firm. These cannot be undone, so a human gate sits on each. Everything reversible and internal, such as reading, reconciling, drafting, and preparing a step for review, can run unattended inside a guardrail. The test is reversibility, not importance.

Can AI agents run unattended in a regulated wealth firm?

Yes, for the reversible majority of the work. An agent can gather data, reconcile, draft, run internal checks, and prepare a payment or message up to the point of sending, all contained and correctable if wrong. Unattended does not mean ungoverned: the agent works inside a defined scope, fails closed, and logs everything. The human gate is reserved for the final irreversible step.

Should an AI guardrail check the input or the action?

Both, but the action is what protects the client. Input filtering, meaning screening the prompt and intent, is necessary but insufficient, because the risk is what the agent does, not what it was asked. The guardrail must bind the outgoing action: the step about to execute must match what was actually approved, or it fails closed. Governing the action is what makes an agent safe to leave running.

What is human-in-the-loop for AI agents, and why can too much of it be a problem?

Human-in-the-loop means a person approves an agent's actions. Applied to every step, it makes the agent slower than the human it was meant to help, and the efficiency disappears. The better design gates only the irreversible steps and lets an action-bound, identity-rooted guardrail carry the reversible rest, so compliance holds consistently without constant pauses.

Why would a correctly-built AI agent refuse a legitimate instruction?

Because the approval was not verified at its source. If an agent is told "this is approved" but the approval was relayed rather than given by the authorised principal through a verified channel, the correct behaviour is to refuse and surface it, not to proceed. A gate that accepts a relayed approval is not a gate. Identity at the root and fail-closed behaviour are what make the refusal correct. --- This article is produced by Serra Global (Serra GCVC OU) for informational and educational purposes only. It describes services and views on AI governance practice in wealth management and is not a personal recommendation, solicitation, or offer regarding any financial instrument or any legal or compliance advice. Firms should confirm their own regulatory obligations with qualified counsel.

Which AI-agent actions in a wealth firm need human approval, and which can run unattended?