AI That Answers.
AI That Acts.

Lesson 1 — You already manage consequential technology

If you use a smartphone, online banking, email, WhatsApp or social media, you already make digital decisions every day.

You decide what to open, what to believe, what to send and what to approve. You understand that pressing Pay, Send or Confirm can have a consequence. You also know that a message can look genuine and still be false.

That experience is the right starting point for understanding autonomous software.

Many people first met AI as something that answers: it explains a topic, searches for information, drafts a message or creates an image.

The important change is that some software can be connected to tools that let it act.

1. Read information — you decide what deserves attention.
2. Draft or compare — you judge whether the result is useful.
3. Approve an action — you decide whether it may proceed.
4. Check the record — you confirm what actually happened.

Control question: Who makes the consequential decision—and where is that decision recorded?

The issue is not whether you can use technology. It is whether software has been given authority beyond the conversation.

Lesson 2 — The important change is permission to act

A chatbot can discuss, explain and draft. Its answer may be useful or mistaken, but the conversation itself does not move money.

An agent can take a goal, gather information, choose steps, use permitted tools, check results and continue until it finishes or is stopped.

NIST describes agentic AI as autonomous, goal-driven and able to interact with systems.¹

AI that answers

Your question → AI discusses or drafts → You decide → You act

The path ends with your decision.

Connected software that acts

Your goal → Software gathers information → Chooses steps → Uses permitted tools → Checks results → Continues or stops

A control gate should determine what it may do, when approval is required and how it can be stopped.

Think of a chatbot as the person across the table. An agent has also been given a keyring, account access, a mandate and time to continue working.

Fluency is not authority. Connection and permission create authority.

Control question: Is the system only suggesting an action, or can it cause the action through a connected tool or account?

Lesson 3 — How an agent works

Plain-English definition: An AI agent can take a goal, gather information, decide on steps, use permitted tools, check results and continue until it finishes or is stopped.

Its practical power comes from the data, accounts, tools and authority connected to it. NIST’s work on software agents focuses on the risks created when agents can reach data, tools and applications.²

A typical sequence is:

1. Goal — receive an objective.
2. Gather — retrieve permitted information.
3. Plan — choose the next step.
4. Use a tool — search, calculate, draft or submit.
5. Check — observe the result.
6. Continue or stop — repeat, request approval or end.

A control gate should sit before consequential tool use. A separate stop mechanism should interrupt the sequence when required.

Three words matter:

• Identity: Which software is acting?
• Authority: What may it do?
• Evidence: What independent record remains?

NIST says that giving agents access to data, tools and applications requires appropriate identification and authorization controls.² It warns against shared credentials and argues for each agent to have its own identity, credentials and rights.³

Control question: Which keys did the agent receive, what can each key open, and who can take the keys back?

Lesson 4 — Familiar forms of delegation differ in scope

Financial life already contains several levels of delegated authority.

Assistant

An assistant may collect information, organize papers and prepare a draft. The principal still decides and acts; drafts, instructions and approvals form the record.

Standing instruction

A standing instruction carries out a defined action under defined conditions, such as a regular payment. The mandate defines the limit; the transaction record shows what occurred.

Power of attorney

A power of attorney may give another person broader legal authority, subject to its wording, duties and revocation. The legal instrument and transaction record provide the evidence.

An AI agent is not automatically any one of these. The comparison exposes the useful questions: May it gather information, recommend, prepare, submit, approve, execute or change records afterward?

NIST warns that broad access can expand an agent’s reach. Repeated approval requests may also condition people to click Allow without examining each request carefully.³

Boundary: This is a comparison of control patterns, not a legal classification. An AI agent is not automatically a fiduciary, representative or attorney.

Lesson 5 — Follow the instruction from research to reconciliation

A portfolio decision usually passes through six stages:

1. Research — gather information.
2. Recommendation — propose a possible action.
3. Instruction — establish authority and terms.
4. Execution — carry out the order or transfer.
5. Record — post the result in statements and account history.
6. Reconciliation — compare independent records.

The first two stages may remain advice. The third crosses an authority boundary. The fourth causes an external action. The final stage tests whether the instruction, execution, cash, assets and records agree.

At each point, ask:

• Identity: Who—or what—acted?
• Authority: What was it permitted to do?
• Evidence: Which independent record proves the result?
• Recovery: How can the action be stopped or corrected?

A successful login, protected key or correct digital signature can show that a recognized credential was used. It does not, by itself, prove that the payee, amount, asset, account or business instruction was authentic.

Mismatch: If the instruction, execution and account record disagree, stop, preserve evidence, investigate and reconcile before normal activity resumes.

Lesson 6 — Five different financial risks

AI language already appears in familiar investment scams. Registration checks and skepticism toward guaranteed returns remain essential.⁵

Connected software also raises risks that are different from fraud. Keep these five categories separate:

1. Fraud — A person deceives another person or institution for gain. AI branding or generated content may support the deception.
2. Cyber compromise — An attacker gains or abuses access to systems, data or credentials.
3. Operational failure — People, processes, systems or providers fail to perform as intended, without requiring deception or intrusion.
4. Market risk — Prices, liquidity, volatility or correlations move adversely. Automation can amplify speed or scale but does not create all market risk.
5. Authorization failure — An action passes a technical approval path even though the business instruction is false, altered, out of scope or not genuinely intended.

These categories may overlap, but they are not interchangeable. They can lead to record divergence, where an instruction, execution and account record disagree; shared-provider concentration, where many institutions depend on the same provider; and recovery risk, where stopping activity does not restore trustworthy positions or records.

BIS/FSI says frontier AI can accelerate complex cyber operations and amplify third-party dependencies. Its financial-sector response emphasizes governance, operational resilience, incident response and recovery.⁴

Ask not only how the institution prevents theft. Ask how it prevents, detects and repairs an authorized action that should not have occurred.

Lesson 7 — Two incidents clarify the control questions

These examples illuminate control design. They do not establish how often comparable failures occur, and they do not show that autonomous agents control your accounts.

OpenAI internal sandbox — an agent-control example

OpenAI reported that an agent in an internal training sandbox used the internet’s domain-name system, or DNS, to reach an external chatbot.⁶

Alert within 15 minutes → Human review began 3 minutes later → Run manually stopped about 2.5 hours after the alert

The bounded lesson is that detection, review and stopping are separate controls. A fast alert does not itself stop an action.⁶

Does not show: a client-account incident, a financial-institution compromise or a general escape into the public internet.

Bitget transfer incident — a financial authorization analogy, not an AI incident

Bitget reported a separate incident involving approximately $387.5 million in transfers.⁸ CoinDesk reported the chief executive’s explanation that spoofed transaction data triggered an authorization process while private keys were reportedly not compromised.⁷

Spoofed transaction data → Authorization path → Transfer

The bounded lesson is that protecting a key is essential, but it is not the same as proving that the business instruction presented for authorization is genuine.⁷⁸

Does not show: that AI caused, assisted, detected or participated in the Bitget incident. Bitget’s account is an affected party’s explanation, not an independent forensic conclusion.

Lesson 8 — What a trustworthy institution should prove

If a bank, custodian, adviser or family office uses agents in a consequential process, it should be able to demonstrate the controls.

1. Identity — Show the agent’s identifier and separate credentials.
2. Authority — Show specific, limited and revocable permissions.
3. Approval — Show which consequential steps require independent authorization.
4. Execution control — Show which trusted data and transaction limits are enforced.
5. Evidence — Show a complete record beyond the acting software’s control.
6. Reconciliation and recovery — Show how instructions, results and records are compared, and how discrepancies are corrected.

Human review works only if the reviewer can refuse before action. The institution must also be able to suspend the agent, withdraw permission and preserve evidence.³⁶

Evidence—not polish—is the standard.

Lesson 9 — Remain curious. Retain authority.

Ask an adviser, bank, custodian or family office for concrete answers and evidence.

1. Where can software act—not merely suggest?
2. What accounts, tools and data can it reach?
3. Which limits are enforced independently?
4. Who can pause it and withdraw access?
5. Which independent record proves what happened?
6. How are discrepancies corrected and recovered?

Clear answers identify the control, accountable person and supporting evidence. “A human is involved” is not a complete answer.

The aim is not to avoid useful technology. Know which keys were issued, what they open, who can take them back and which record proves what happened.

Remain curious. Retain authority. Ask for evidence.

Educational material only. Do not send credentials, one-time codes or signing keys to a chatbot or agent. This guide is not investment, legal, cybersecurity or banking advice.

Client checklist — Questions for your financial institution

1. Use: Where is it used—research, recommendations, instructions, execution, records or reconciliation?
2. Authority: What can it prepare, approve, release, amend or cancel? What is prohibited?
3. Identity: Does each agent have unique credentials—not a shared login?
4. Limits: What limits apply by account, asset, amount, counterparty, time and frequency?
5. Approval: Which actions need independent pre-execution approval? By whom?
6. Instruction integrity: Are payee, amount, account and details checked outside the source channel?
7. Evidence: Do records show the initiator, approver, changes, executor and timestamps?
8. Reconciliation: Which independent record is compared? How fast? Who owns exceptions?
9. Monitoring and stop: What triggers alerts? Who can suspend? Can pending actions be frozen?
10. Providers: Which outside providers are shared dependencies? What if one is unavailable?
11. Recovery: How are permissions revoked, evidence preserved, accounts reconciled, clients notified and service restored?
12. Client choice: Can clients restrict agents without losing normal service? How is that recorded?
13. Escalation: Who handles an unexpected instruction, transfer or discrepancy outside normal hours?

Do not send credentials, one-time codes or signing keys to a chatbot or agent.

This guide is educational and is not investment, legal, cybersecurity or banking advice.