On a recent episode of Fintech Insider, Aditi Subaral set out a simple way to decide how much freedom to give an AI agent. Ask three questions of each thing it does. Can the action be undone? Whose reputation is on the line if it goes wrong? Does a regulator care? Plenty of firms have nothing that specific, only the slogan “keep a human in the loop”, applied with the same vague caution whether the agent is tidying a calendar or drafting something a client will act on. It feels responsible, but as a working rule it does very little.

The three questions turn the slogan into a rule you can write down and defend. Client trust rests largely on the confirmation step, the moment a person checks before anything happens. Lose track of which actions need it and you either slow everything down or let the wrong thing through.

Is keeping a human in the loop actually a policy?

On its own, no. It treats every action an agent takes as if it carried the same risk, which lands a firm in one of two bad places. Either a person signs off everything, which breeds rubber-stamping (someone clicking approve forty times a day has stopped reading by the tenth) and wipes out the efficiency that justified the agent. Or the caution quietly wears away and the agent ends up doing things nobody decided it should. Putting a person on every action isn’t automatically safer, and often it only adds delay. Jordan Wilson, who hosts the Everyday AI podcast, put the better instinct more simply: “you should never give an agent more power than you can watch.” The three questions are how you decide, action by action, what you need to watch.

A policy you can defend asks three things of every action: can it be undone, whose name is on it if it goes wrong, and does a regulator care?

The three questions

Diagram showing three AI execution tiers assigned after evaluating reversibility, reputation, and regulatory risks.
This decision flow maps how firms score agent actions against reversibility, reputation, and regulation. Scoring each action avoids giving agents too much freedom without creating approval bottlenecks on routine tasks. AI-assisted diagram

Ask them in the same order every time, so the answers are easy to compare across actions.

Reversibility: can you undo it cheaply? A draft sitting in a queue is fully reversible. A payment that has left the account, a message a client has already read or a deleted record is not. The harder and more expensive the undo, the shorter the leash.

Reputation: whose name is on it if it goes wrong? An internal data tidy-up affects nobody outside the firm. Anything a client sees, or that shapes advice they receive, carries your firm’s name and judgement. The more public the consequence, the more a person belongs in the chain.

Regulatory: does a rule or a regulator care? Some actions touch suitability, client money or record-keeping, the things the FCA and frameworks like the EU AI Act are concerned with. Those carry the shortest leash of all.

Taken together, the three answers sort each action into one of three tiers: autonomous, check-in, or human-only. Some actions sit in human-only by default whatever else is true. Sending messages, making payments, signing documents and deleting data always stop for a person.

Scoring one real action: a client life-event prompt

Here’s a realistic example. An agent watching your client data notices a new child on a household record and drafts two things: a suggestion to open a Junior ISA, and a note that the client’s beneficiary nominations may need reviewing. It prepares both. It executes neither.

Run the questions. Reversibility: the drafts are reversible, but opening an account and changing a beneficiary nomination are not cheaply undone, and the agent is one step from both. Reputation: this is client-facing and shapes advice, so the firm’s name is firmly on it. Regulatory: it touches suitability, which the FCA cares about directly. Every answer points towards more oversight.

That puts the action in the middle, check-in tier, not the autonomous one. Intelliflo frames the same split as three modes, co-pilot, supervised agent and autonomous agent[3], and this is the supervised one. It drafts the suggestion and flags the review. The client decides, and the adviser signs off and carries out the client’s stated wish. The agent never submits anything for the client, and neither does the adviser without the client’s explicit agreement.

Write the map down so it holds up

The test is only worth anything written down. Build a short table and keep it where your controls live.

  1. List your agent’s most-used actions. Not every theoretical one, but the ten or fifteen it performs in a typical week. Be honest about what it already does unattended.
  2. Score each on the three axes. Reversibility, reputation, regulatory, in that order. One line each is enough.
  3. Assign a tier and a named owner. Autonomous, check-in or human-only, and the person accountable for each action sitting where it does.
  4. Fold it into controls you already have. Attach it to your overall risk assessment, the single process the FCA expects firms to run across their business model and risk appetite[1], and to the four-eyes principle your firm already uses for sign-off, where a second person approves before anything commits.

A regulator will still hold the firm responsible whatever is written down, and that’s right: under the FCA’s principles-based approach the firm owns the outcome. The map doesn’t give you immunity. It gives you the thing a regulator asks to see, a reasoned, owned judgement for each action, which is a much stronger position than a blanket slogan.

Where reversibility stops being true

The test has a limit. At the speed and scale agents work, “reversible” is a judgement rather than a guarantee. By one benchmarking estimate from Sean Wang, agents interact with data at around five hundred times the rate a person does. By the time anyone notices, a reversible action may have been repeated hundreds of times. Agents don’t always stay in their lane either: in a UK AI Security Institute incident report from August 2026, around eight per cent of monitored test runs, nineteen actions across one hundred and twenty-two runs, went outside the parameters set for them[2].

So the three questions decide how much freedom an agent gets, but someone still has to watch it. An action scored reversible still belongs in a contained set-up, walled off from live client systems, with monitoring that can catch it drifting, so it stays reversible in practice and not only on paper. (Our page on AI agent governance and risk covers containment in more detail.)

The next step is small. Take your agent’s five most-used actions this week, run each through the three questions, and write down its tier (autonomous, check-in or human-only) and who owns it.

This article is for informational purposes only and does not constitute regulated financial advice or a compliance opinion. Consult a qualified compliance professional for advice specific to your firm.

Sources

[1] FCA, ‘FG26/9: Non-Handbook Guidance on COREPRU 7 overall risk assessment’, Financial Conduct Authority, 2026. Available at: https://www.fca.org.uk/publications/finalised-guidance/fg26-9-non-handbook-guidance-corepru-7-overall-risk-assessment [Cited for the FCA’s expectation of a single overall risk assessment process.] [2] UK AI Security Institute (2026) ‘Agent incident report’, August 2026. [Cited for the figure of around eight per cent of monitored runs, nineteen of one hundred and twenty-two, going outside set parameters.] [3] Intelliflo (2026) ‘Advisers needn’t fear handing control to AI’, Intelliflo Insights. Available at: https://www.intelliflo.com/insights/thought-leadership/advisers-neednt-fear-handing-control-to-ai [Cited for the co-pilot, supervised agent and autonomous agent framing.]