How Financial Firms Are Defining Boundaries for AI Agents

At AI Engineer New York, Anthropic’s Keon Shahab used a trade-break investigation agent to illustrate a boundary: the agent would recommend an order amendment for human approval, rather than make the amendment itself ¹. For anyone deploying AI agents in financial services, that example raises a practical question for risk and engineering leaders: what authority can you justify giving an agent, and what evidence supports that decision?

The account covered predictions about future agent capability, an illustrative human-approved trade-investigation workflow, and controls for limiting what agents can do ¹. It did not report that financial firms broadly let agents make investment or trading decisions on their own ¹. A prediction about capability is not evidence that a task is ready for production.

What was described—and what was predicted

Joseph Kim, OpenAI’s Head of ChatGPT for Financial Services, described a usefulness threshold: an agent should be capable and reliable enough to save time ¹. He predicted that by 2027 agents would be good enough for investment-idea generation and trading, and that the financial industry would rely less on Excel and PowerPoint ¹. Those are forecasts, not reports of current deployments.

Two Sigma’s John Feminella said the firm had implemented guardrails and shared capabilities intended to let teams use agents without hindering their work ¹. The account describes some controls, including auto-mode classifiers that handle routine calls and send the requests most likely to matter to a person ¹.

Shahab’s trade-break example involved an agent recommending an order amendment for a person to approve, rather than making the amendment itself ¹. The account presents this as an example of a workflow, not as a report that it is live in production ¹.

Analysis: Weigh each claim by what it is. A prediction informs planning. An illustrative workflow can inform design. A reported control can inform evaluation. None, by itself, proves that an agent is reliable enough for a particular use case.

Autonomous AI decisions in finance: which tasks are on the table?

Investment-idea generation and trading were Kim’s predictions about future capability, not reports of current practice ¹. Shahab’s trade-break example is narrower: an agent investigates a break and recommends an order amendment, with a person approving the proposed change ¹.

Anthropic announced Claude for Financial Advisors, which lets financial advisors connect their systems to Claude and a set of workflow skills ¹. The account does not specify which decisions those skills make independently, so it should not be treated as evidence of autonomous financial decision-making ¹.

These examples suggest three distinct levels of authority:

• Investigation — gather and organize information about an issue.
• Recommendation — propose a next step, such as an order amendment.
• Execution — make the change in the underlying system.

The trade-break example distinguishes recommending an amendment from making it ¹. Analysis: Firms can apply the same distinction to their own task inventories. “Assist with trade breaks” is too vague to define permissions. “Prepare a proposed amendment without permission to write to orders data” is a task that can be scoped. For a broader look at where those permission lines can sit, see agents and access limits.

AI agent oversight in finance: separating routine work from consequential action

Feminella warned that requiring approval for everything can create approval fatigue: people may fail to pay full attention to every decision they are asked to approve, and blanket approval can hold back innovation ¹.

The account describes Two Sigma’s approach as using auto-mode classifiers for routine calls, classifiers for ambiguous cases, and deterministic rules for clear cases; the most important requests are routed to a person ¹.

Analysis: That is a tiered review model, not a universal policy. Deterministic rules may suit clear cases; classifiers may help with ambiguous ones; a person can review important requests. The account does not set universal thresholds for when each approach applies ¹.

For each task, it helps to define explicitly what the agent may do:

• Observe — read information without changing it.
• Prepare — assemble a draft or proposed action.
• Recommend — explain a suggested next step.
• Request approval — present a defined action to a reviewer.
• Execute — make an approved change.

These labels are a working framework, not a standard reported at the event. Their value is in distinguishing an agent that drafts an amendment from one that writes to an orders system.

Financial AI agent safety: what controls can limit an agent’s authority?

Shahab described a three-part trust layer: identity and permissions; sandboxing and approval before action; and checking whether the agent continues to work when variables change ¹.

Bloomberg’s Andrey Rybka described scoped identities and credentials, controls over tool calls, outbound-traffic restrictions, audit trails, budgets, and kill switches ¹. Kim framed traceability and human review as product-design questions, including what users need to control, review, or approve ¹.

Analysis: Taken together, these controls suggest scoping access across several dimensions, such as the agent, user, tool, data operation, and destination. A system that reads order data need not have permission to write to it. An agent allowed to call one internal tool need not have unrestricted outbound access. These are implications of the controls discussed, not requirements that every firm at the event reported following ¹.

Some of these controls, such as budgets and restrictions on API keys, can sit at an enterprise AI gateway layer. Others, like write permissions on an orders system, have to be enforced in the systems themselves. Handling credentials carefully matters too; one related discussion explains why keeping credentials out of an agent’s context is not enough on its own.

A practical control review should ask:

• What identity and credentials does the agent use?
• Which tools and data operations are allowed?
• Which actions require approval before they happen?
• Which outbound destinations are permitted?
• Are actions and attempted tool calls logged?
• Can a budget limit or stop mechanism contain unexpected activity?

Teams building these checks may also want to read about runtime governance for always-on agents.

The examples point to a disciplined starting point: define the task, specify the agent’s authority, and decide where human review is required before granting access to consequential systems ¹.