What is an AI agent, and how does it differ from a chatbot or a copilot?
A chatbot answers in text. A copilot sits inside a tool a person already uses and suggests a reply or summary for them to accept or edit. An agent is given a goal and a set of tools; it decides which tool to call, reads the result and carries on until the task is done or it must stop. The Open Worldwide Application Security Project (OWASP) calls this agency: a large language model (LLM) system that calls functions or other systems through tools, using each output to direct the next call.
The difference matters for risk. A chatbot's worst output is a wrong sentence; an agent's is a wrong action, such as a refund issued, a record changed or an email sent. So most of the design work is about tools: which ones the agent has, what each may touch, and which calls wait for a person.
Which finance and operations jobs suit an agent today?
Good first jobs share a shape: high volume, a clear definition of done, inputs the agent can read, and an output a person can check quickly.
- Document intake and know your customer (KYC) pre-checks: extract fields from identity and address documents, compare them with the application, flag expiry, mismatches and missing pages, and hand the reviewer a pack. The term page on KYC and know your transaction (KYT) checks explains where they sit.
- Ticket triage and drafted replies: classify the request, pull the account details the policy allows, find the help article and draft a reply for a person to approve.
- Reconciliation exceptions: for each break between the ledger and a bank or payment-provider statement, gather both sides, propose the likely match or cause, and queue it for a person to post.
- Research summaries: summarise filings, news and internal notes with a link to every source, so the reader checks rather than trusts.
Poor first jobs are those where the output is the decision: approving credit for a person, closing a sanctions or fraud alert, or telling a client what to buy. Those need heavier governance, and some are classed as high-risk in law. The guide on AI trading assistants covers the last one.
Which actions need which control?
OWASP's guidance on excessive agency turns least privilege into specifics: limit the tools an agent may call, and what each may do in other systems, to the minimum necessary; act in the context of the user the agent works for; and enforce authorisation in the downstream system instead of letting the model decide. For high-impact actions, a human approves first.
In finance those approvals sit at three points: before money moves, before a client is told something that matters, and before a record of truth changes.
| Action type | Example | Control |
|---|---|---|
| Read | Look up an account, a ticket or a policy. | Read-only credentials for that agent, only the fields the task needs, every read logged. |
| Extract or classify | Pull fields from an identity document; tag a ticket's topic. | Tested against labelled cases before release; low-confidence cases go to a person. |
| Draft | Write a reply, a case note or a summary. | A person approves or edits before anything leaves the firm. |
| Propose a record change | Match a reconciliation break; update an address from a verified document. | Maker-checker: the agent proposes, a person approves, the system of record enforces the rule. |
| Move money | Issue a refund, release a withdrawal, adjust a balance. | Never the agent alone: a person approves in the payment or ledger system, within limits it enforces. |
| Tell a client | Send a status update, a decision or a document request. | Pre-approved templates for routine messages, a person for the rest, and clients told when they deal with AI. |
| Read untrusted content | Process an emailed attachment, a web page or a client's free text. | Treated as data, never as instructions; no high-impact tools in the same run. |
| Stop or escalate | Hand the case to a person with the reason. | Always allowed and counted in monitoring. |
Prompt injection is why the untrusted-content row exists. OWASP puts it first in its 2025 list: instructions hidden in a file or a web page can change what the model does, and it is unclear whether fool-proof prevention exists. So contain it: an agent reading a client's upload should not, in the same run, hold a tool that moves money.
How do you test an agent before production and audit it afterwards?
- 01 Build a test set from your own cases Past documents, tickets or breaks with known outcomes, personal data removed where possible, awkward cases kept in: blurred scans, angry clients, partial matches.
- 02 Set pass marks before the first run Decide per task what accuracy and which errors are unacceptable. A wrong refund and a clumsy sentence are different failures.
- 03 Attack it Add messages and documents that try to instruct the agent, and check that tool limits hold when the model is fooled.
- 04 Shadow first, then act behind approval Let the agent work alongside staff without acting, compare results, then switch on actions behind approval. Widen autonomy only where the numbers allow.
- 05 Rerun on every change A new model, prompt, tool or data source makes a new system. Rerun the test set and keep the results with the release.
Every run should leave a record: the request and who made it, the data retrieved, each tool call with its parameters and result, the output, who approved or rejected it, and the model, prompt and tool versions. That record lets a reviewer rebuild a decision and supplies the next evaluation set.
What do regulators and standards expect?
Few rules target agents yet; firms apply general AI and model-risk texts to each use case. This summary is not legal advice; check with counsel for your licences and markets.
Singapore: the Monetary Authority of Singapore (MAS) issued Guidelines on AI Risk Management on 7 October 2026. They apply to all financial institutions and all forms of AI, in proportion to risk: keep an inventory of AI use, assess each use case's risk materiality, and apply life-cycle controls including testing, human oversight and change management. Institutions remain accountable for third-party AI. MAS cites agentic AI systems that access tools as a reason to keep reviewing controls, and plans to consult on further agentic AI guidance in 2027. The Guidelines take effect on 7 October 2027; institutions may meet the life-cycle controls (Section 5) and AI capability and capacity expectations (Section 6) by 7 October 2028.
European Union: Annex III of the AI Act, Regulation (EU) 2024/1689, lists as high-risk AI systems intended to evaluate the creditworthiness of natural persons or set their credit score (fraud detection excepted), and those intended for risk assessment and pricing for natural persons in life and health insurance. After the AI Omnibus entered into force on 27 July 2026, those rules apply from 2 December 2027, per the European Commission's page updated 19 October 2026. For high-risk systems, Article 12 requires them to technically allow automatic logging over their lifetime, and Article 14 requires that the people assigned to oversight can, as appropriate, disregard, override or reverse its output and halt it. The Commission also says people using systems such as chatbots should be made aware they are interacting with a machine.
United Kingdom: the Prudential Regulation Authority's model risk principles (SS1/23, current version effective 23 April 2026) are relevant to UK-incorporated banks, building societies and PRA-designated investment firms with internal model approval to calculate regulatory capital. They cover models that inform business decisions, including vendor models, regardless of technology, and include the risks of AI techniques such as machine learning.
Standards: the US National Institute of Standards and Technology (NIST) released its voluntary AI Risk Management Framework on 26 January 2023, organised around four functions: Govern, Map, Measure and Manage; NIST says version 1.0 is now being revised. OWASP's Top 10 for LLM applications supplies the security vocabulary.
What to ask a custom AI agent development company
- Which tools will the agent have, what can each do in our systems, and under whose credentials does it act?
- Where does a person approve, and is that enforced by our systems or only by the agent's instructions?
- Which of our cases will the test set use, and what pass marks do you propose before release?
- How do you test for prompt injection, and what can the agent still do if it is fooled?
- What does the per-run log contain, where is it stored, and can our compliance team read it without you?
- Which models do you use, where is our data processed, and can a model change without a new evaluation?
- What evidence will you give us for our AI inventory and risk assessment, and who owns the code, prompts and test sets at handover?
Where EntropyX Labs fits
EntropyX Labs builds custom AI agents and copilots for finance and operations teams: agents that pursue a goal through tools and leave an audit trail, support and operations copilots that answer from your own knowledge base, document and KYC pipelines, and live voice-to-text and translation. Each build begins by choosing the workflow or two where an agent would make a real difference, and writing down what it must never do. A prototype is scored against a test set; production adds explicit tool permissions, prompt-injection testing, a sandbox phase before an agent acts, per-run audit logs that record the model, prompt and tool versions, and a person to fall back on for anything consequential. These controls are standard in every build. In production for clients today: SignalDesk's research agent, live translation and voice in EntropyX Chat, the support copilot in EntropyX Tickets, and KYC and document AI pipelines.
Models are chosen per workflow: frontier models where they perform best, open models where data has to stay on-premises. Agents can work inside EntropyX Chat, your customer relationship management (CRM) system, your ticketing desk or behind application programming interfaces (APIs) your systems call. In EntropyX Tickets the support copilot drafts replies from your knowledge base and the ticket's own context, and a person approves it before it is sent. SignalDesk applies the pattern to market research: it calls only the tools an operator enables, shows a tool trace with every answer and does not place trades.
Work is a fixed-scope project or a monthly retainer, with milestones agreed in writing; at handover you receive the source code, documentation and deployment scripts. EntropyX Labs is a technology provider, not an adviser, and gives no investment advice. Which workflows to automate, which systems an agent may touch, who approves consequential actions and how long logs are kept remain your decisions.
Sources and further reading
- OWASP Gen AI Security Project: LLM06:2025 Excessive Agency — Read 13 November 2026: agency is the ability to call functions or interface with other systems via extensions (tools); agent-based systems make repeated calls to an LLM using previous output; limit extensions and their permissions to the minimum necessary; execute extensions in the user's context; require human approval of high-impact actions; enforce authorisation in downstream systems (complete mediation)
- OWASP Gen AI Security Project: LLM01:2025 Prompt Injection — Read 13 November 2026: first entry of the 2025 list; indirect prompt injection through external sources such as websites or files; unclear if there are fool-proof methods of prevention; least privilege, human-in-the-loop controls for privileged operations, segregating untrusted content
- MAS: MAS Sets Out Supervisory Expectations on Responsible AI Adoption by Financial Institutions (7 October 2026) — Read 13 November 2026: Guidelines on AI Risk Management issued 7 October 2026; apply to all FIs and all forms of AI in a risk-proportionate manner; inventories, risk materiality, life-cycle controls including testing, human oversight, monitoring and change management; agentic AI systems that operate autonomously and access tools; agentic AI consultation planned for 2027; FIs remain accountable for third-party AI; effective 7 October 2027, Sections 5 and 6 by 7 October 2028
- MAS: Guidelines on Artificial Intelligence Risk Management (7 October 2026) — Read 13 November 2026: para 1.8, effective 7 October 2027; Sections 3 and 4 from 7 October 2027; Sections 5 (AI Life Cycle Controls) and 6 (AI Capability & Capacity) by 7 October 2028
- European Commission: AI Act (regulatory framework for AI), last updated 19 October 2026 — Read 13 November 2026: AI Omnibus entered into force 27 July 2026; Annex III high-risk rules apply from 2 December 2027; people using AI systems such as chatbots should be made aware they are interacting with a machine
- AI Act Service Desk (European Commission): Regulation (EU) 2024/1689, Annex III — Read 13 November 2026: point 5(b) creditworthiness evaluation or credit scoring of natural persons, except systems for detecting financial fraud; point 5(c) risk assessment and pricing for natural persons in life and health insurance
- AI Act Service Desk (European Commission): Regulation (EU) 2024/1689, Article 12 Record-keeping — Read 13 November 2026: high-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system
- AI Act Service Desk (European Commission): Regulation (EU) 2024/1689, Article 14 Human oversight — Read 13 November 2026: people overseeing a high-risk AI system must be able to disregard, override or reverse its output and interrupt it through a 'stop' button or similar procedure that brings it to a halt in a safe state
- Bank of England PRA: SS1/23 Model risk management principles for banks — Read 13 November 2026: relevant to UK banks, building societies and PRA-designated investment firms with internal model approval; applies to models used to inform business decisions, including vendor models, regardless of technology; covers risks of AI in modelling techniques such as machine learning; current version published and effective 23 April 2026
- NIST: AI Risk Management Framework — Read 13 November 2026: released on 26 January 2023; intended for voluntary use; AI RMF 1.0 is being revised
- NIST AI 100-1: Artificial Intelligence Risk Management Framework (AI RMF 1.0) — Read 13 November 2026: the Core is composed of four functions: GOVERN, MAP, MEASURE and MANAGE
This guide is engineering and product guidance from EntropyX Labs, a technology provider. It is not legal, regulatory or investment advice.