Trust, Risk and Quality in Agentic Finance [Testμ 2026]

From Recommending to Acting

The moderator framed the shift that made the panel necessary. For years AI recommended the trade, flagged a fraud event or suggested a next best action. Agents now investigate a dispute, initiate a transaction, interact with a customer, make decisions across a workflow, or write and deploy code.

The scrutiny he named was specific: individual states for insurance, plus FINRA, the SEC and the Office of the Comptroller for banks. That is his explanation for why the vertical is risk averse and a laggard on the newest technology, always waiting for regulation to catch up.

Three practitioner perspectives were in the room: insurance and participant claims, wealth management and independent advisory, and quality engineering over digital money-flow software.

The moderator works for TestMu AI, the conference host, so his framing of the sector is a vendor view rather than neutral analysis.

A Reversible Claim Fix

Krystyna Sylyvonchyk offered a rule of thumb: the more real money and the more regulation involved, the more agents are still consulting rather than doing actual work. Work is delegated only where it is not life-threatening for people or for the business.

Her worked example is a claim for a duplicate transaction posted to a client or participant account with evidence attached. The agent analyses the contract, analyses the claim, and looks at the transaction history.

The concrete case was 15 dollars posted twice. Obvious enough that the claim is truthful, and small enough that the agent can revert the transaction itself.

Two conditions make that safe. Gates cap how large the transaction amount can be, and anything the agent does must be reversible, which protects the customer and the company at the same time.

The moderator added an insurance aside: assurance is the science of looking backwards, and with AI there is nothing behind you to look at, only forward.

Autonomy as a Spectrum

Trincy Thomas does not work directly on disputes, claims or payments. Her area is the software that helps the business track digital money flows and present better offers to users.

Her core claim is that agent autonomy is not binary. Agents first support a person by gathering information, analysing it and making a recommendation for a human to review.

Once the team is confident the agent makes good decisions, it decides by itself, but inside boundaries defined by a subject-matter expert or the person assigned to the task. Only when that becomes reliable is it allowed to act on the decision, execute a process, make a change or trigger another decision.

Their starting point was code review. Agents made review suggestions, resolved them, added commits as a resolution, kept a human in the loop, ran sanity checks and could block a release, with reliance growing as trust grew.

The framing she pressed matters for anyone who thinks this is somebody else’s problem. They are not literally moving money, but they are making decisions about money-related data and executing processes that eventually affect the transaction trail. The same progression is happening across industries; what differs in financial services is the level of risk and the controls needed around those actions.

Three Layers of Action

Preetham Sunilkumar challenged the framing. In wealth management the most important thing an agent acts on is not the transaction, and there is a lot of marketing noise conflating agents with automation.

Rules-based systems have routed transactions and flagged fraud since the 1990s. What is new is models that reason about context, chain multi-step decisions together, and take actions that are then gate-kept by humans.

On the middle layer, an adviser historically spent hours pulling client performance data, stress testing financial models, forecasting six months out and running tax estimates before a review meeting. That 10 or 20 hours of prep, a spoken range rather than a measured figure, now compresses into minutes.

On the third, any marketing or advertising material an adviser puts in front of a client goes through a formal marketing regulatory review under FINRA rules, which he put at 5 to 10 days on an industry average. He cited no source for that baseline.

His conclusion is the panel’s cleanest sentence: agents are earning operational trust rather than consequential trust.

Governing Before Rules

Governing while regulation evolves is, in his words, the oldest problem in financial services. Derivatives, ETFs, high-frequency trading and robo-advisers each moved faster than the rule book, and each time the industry self-governed first and met the regulator halfway when the rules landed.

He was precise about the current regulatory position. The most sophisticated governance framework in financial services is the Federal Reserve’s model risk management guidance, designed for statistical credit models and never written for large language models or agentic solutions. FINRA has issued guidance on AI use and the SEC is watching AI in investment advice closely, but there is no specific enforceable regulation on autonomous agents yet.

The consequence he drew from that gap: institutions building governance right now are writing the first draft of what the regulation will eventually look like.

His first approach is to treat every agent as a regulated actor. Every agent action generates an audit trail, every decision carries documented logic, and every workflow touching a client account has a defined human review threshold, the point at which the agent stops and a person signs off.

The second is to adopt the supervisory framework that already exists. The first question to ask about anything in production is who is supervising it, and the answer is you, which forces a design where every agent capability can be supervised, explained and defended to a regulator.

The third solves for non-determinism by defining the boundaries of acceptable behaviour: what the agent must always do, what it must never do, and how far it can drift in between. His summary was to stop waiting for the regulation and act as though it has already arrived.

Documenting Agent Limits

Krystyna Sylyvonchyk brought the QA-seat angle. Accessibility compliance is the live regulatory pressure her teams feel, everyone is trying to use AI agents for it, and the standards update every year.

Her team rescans and reruns their applications daily, which she said makes a real difference to staying compliant as requirements shift.

Trincy Thomas noted the same pace on the model side, with different models and different versions within them sometimes arriving monthly.

Her practice mirrors manual testing. Just as a tester writes test cases and submits them to a developer, a UAT owner or a stakeholder for review, you document what the AI is allowed to do in that moment.

What to capture: what the agent has access to, which systems it can use, what it cannot do, which prompts were used, and which model was associated with it. Enough to rebuild the same setup and reproduce the same or a similar result.

The payoff arrives when the regulation changes and you can give a proper answer each time, accepting that results sit on a continuum rather than being binary.

Certifying Non-Determinism

Certification does not disappear when the system stops being deterministic. Trincy Thomas’s position is that the certification criteria change. Traditional systems allowed you to say that for this input the expected answer is X; an AI system may not produce that exact answer every time.

The first move is the golden data set, the representative data set covering the scenarios, rerun whenever a model or a related criterion changes.

Instead of asserting one right answer, define what good looks like as a range, work out how to measure it consistently, and set a threshold you are willing to accept.

Results are then evaluated against a defined rubric: accuracy, completeness, whether the right decision was made, and whether the agent followed all the required rules.

Keeping a human in the loop early is the validation mechanism that makes the rest reliable. Sample the AI’s decisions, compare them with human decisions, and track agreement or override rates, which turns certification into an ongoing process rather than a one-time event.

Krystyna Sylyvonchyk offered a useful contrast. Ten years ago QA never discussed format or schema validation and focused only on values. Now, because a test result can differ on every run, schema and property validation has become a standing requirement in API and general software testing.

AI Judges and Fire Drills

The failure mode Krystyna Sylyvonchyk named is human, not technical. As agents get more accurate with each version, teams start assuming the agent is right and checking feels pointless, not because people are lazy but because the repetitiveness bores and burns them out.

Her courtroom model comes from her legal background. The first AI does the work as the representing legal team, and a second AI acts as the defence, checking the original work for evidence, inconsistencies and problems.

The human then sits as the judge over the original work plus the findings and decides which are legitimate. That puts the person on the spot to judge rather than to review, which she described as closer to an interactive game than to reading ten pages of AI-produced script.

She also suggested testing the human. Managers can deliberately fabricate a false result into the output and present it to reviewers, so the team knows any task might be a check and stays careful. Her analogy was the fire drill, exercised regularly so people remember what they are looking for.

The moderator’s counterpoint is fair: in a big office building the alarm goes off and nobody lifts their head. The shared risk is a false sense of trust that the AI is handling it, with the irony that AI is meant to raise quality and accuracy yet somebody still has to verify it.

Trincy Thomas’s parallel mechanism is label-driven scoring. Accepted output carries one label and rejected output another, the labels produce a quality score, and below the threshold you add more human review while above it you reduce the number of reviewers needed.

Shadow Mode Deployment

Preetham Sunilkumar’s addition to the human-in-the-loop question was to make shadow mode deployment a mandatory event before any agent gets real autonomy.

The comparison is agent against the real existing human process, not agent against agent. It is explicitly not about replacing the person, but about running both in parallel for a definite period.

Duration is an organisational choice. He cited some organisations using 30 days and others a quarter, offered as examples rather than as a standard.

What it produces is measured accuracy, flagged divergence and studied failure cases, showing where human intervention is required and where it can be withdrawn. In his words it works like a throttle you can move up or down, but only after you have measured.

The moderator read it as an optimisation exercise, because running the processes in parallel also shows where the value is greater on the human side and lets you sharpen both.

The Flight Recorder

He opened this answer honestly: most institutions are not fully audit-ready for AI, not for lack of trying, but because the audit playbook for non-deterministic systems has not been written in full. Traditional audit assumes you can reconstruct exactly what happened and why. With agents you can reconstruct what happened, and why gets complicated fast.

Financial services audits have always been about evidence of supervision and control. Regulators are not only asking whether the system worked, but whether you knew it was working and how you knew, and that second question is where AI creates a new challenge.

His first layer is what gets logged, and output alone is not sufficient. Log the full decision context: the input the agent received, the prompt or instructions it operates on, the model version active at that moment, the data sources used, through to the output with timestamps, plus every human touch point where a person intervened, reviewed, approved, overrode or escalated.

The second layer is the model biography: which model you are using, what data it was trained on, what behavioural tests were performed, who approved it into production, and what changed if the model switched between two client interactions. The third is continuous production monitoring for model drift, output distribution shifts and performance degradation, because a single post-deployment evaluation is not enough.

A clean inventory of every AI system touching a regulated workflow should be ready before an examiner asks, covering purpose, inputs, outputs, human oversight mechanisms and model versions. So should a change management process for versioning, validating, approving and deploying model updates. So should the escalation record: what happened when an agent failed or behaved unexpectedly, what triggered the human review, and how it was resolved.

One constraint runs through all of it. The explanation has to be yours, not another AI’s account of what the first one did.

The Bar for Autonomy

Autonomy scales to reversibility. Low-risk reversible actions can act automatically with monitoring and an audit trail. Higher-impact actions add limits, approvals and human review. For irreversible or safety-critical actions she would not want that autonomy at all and would require a human to act.

Her first test is whether you can actually test it, through representative evaluations, adversarial testing and failure mode analysis. If you cannot measure it reliably you cannot release it autonomously, which she called non-negotiable.

The second is whether it matches your risk appetite. Testing might show 95 percent accuracy, an illustrative figure rather than a measured result, and 95 percent means one in 20 decisions was wrong: probably acceptable for low-cost or reversible actions, not for compliance or safety-critical decisions that cannot fail.

The third is whether you can defend it. Show the test results, the rubric, the data, the thresholds and how you monitor it in production. Reproduce the conditions of a past decision to investigate later, roll back, and have a kill switch. If any of the three is a maybe, you should not release.

Her summary is the argument the whole panel converged on. You do not need to prove the agent is perfect, only that its behaviour is contained, failures can be detected, recovery is possible and you know how to pivot. Trust is the outcome of that evidence, not a substitute for it.

Preetham Sunilkumar added the point he thinks is under-discussed. Agent solutions today are not only inside financial workflows, they are inside the engineering teams that build financial platforms: code review, test generation, intelligent incident handling and AI across the product development life cycle from research to deployment.

Lessons and Never-Agains

Preetham Sunilkumar’s best practice was learned the hard way: build the constraint spec before the capability spec. Define what the agent is never allowed to do, what decisions it must always escalate, and which guardrails are non-negotiable regardless of how confident the model appears.

He paired it with parallel testing, with the human and the agent doing the same work, and a warning not to treat go-live as a launch event. Keep a shadow phase, which pays back in flagged divergence and detailed failure cases.

Trincy Thomas’s early mistake was focusing on what the agent should do and missing what else it could do, which created a set of problems. Define the negative cases explicitly.

Her other early approach was majority voting: running the same agent on the same criteria multiple times and taking the most common answer as a pass. It sometimes worked, and for certain products and scenarios it was not at all reliable.

The team grew organically into what they later learned was called a confidence score, then learned that low confidence does not mean wrong or ignorable, after something prioritised as a low bug turned out to be relevant. She now goes back to the rubric, defining positive and negative scenarios and performance criteria up front the way a manual tester would, rather than trial and error that wastes time and tokens.

Krystyna Sylyvonchyk’s never-again is the most quotable of the three: do not train agents on clean, perfect data. Real customers enter uppercase, lowercase and three spaces, and if you trained on perfect data you struggle to tell an actual problem from a harmless variation. Feed in as many real, diverse and imperfect problems as you can get.

Q & A Session

The closing question did not come from this session’s audience. The moderator said a handful of questions had come through, then put a talent question to the panel that had surfaced in a session he moderated the previous day.

• What are the critical skills the engineering community needs to develop that will serve them well over the next five to ten years?

  Trincy Thomas: Stay open to change. Within months, people who knew nothing about AI became more expert than she was, so sample what is new and check whether you should be adopting it. She cited a recent conference where her team used two models to make a decision while another team used sixteen, at around ten dollars a decision, and got a more reliable answer they never had to revisit. That comparison is a second-hand anecdote about an unnamed team, with no vendor, model or workload identified.

  Preetham Sunilkumar: Technology, product and operations will converge, so whichever of the three you come from, build skills in the other two.

  Krystyna Sylyvonchyk: Become the master chef of your own kitchen. With AI agents standing in for the specialist stations, quality people need infrastructure and architecture knowledge rather than a single specialty.

This session was part of Testμ Conf 2026, which ran across three days of sessions on agentic engineering and quality. Registrations for the next edition are already open on the Testμ Conference 2027 page.