Give the agent its own identity in the case management system and grant capabilities one at a time: read cases, add draft notes, attach evidence, propose status changes. Hold anything that changes a case's outcome for a named person, and refuse closure outright. Make revocation a single action, and log every call the agent makes.
What kind of system is this, and who owns the connection?
A case management system holds investigations: AML cases, fraud referrals, complaints, sanctions reviews, conduct matters. Each case has a subject, an owner, a status, evidence, notes and a decision. The system is often the firm's evidence of how a matter was handled, so whatever an agent writes into it becomes part of the record a supervisor or a court may see.
Two owners matter. The system owner, usually in operations or financial crime technology, controls access and configuration. The case owners, the investigators and their managers, own what goes into each case. The connection is approved by both, and by information security, before the agent touches live data.
What are the steps to connect it?
- Person, system owner: creates a dedicated service identity for the agent. Never a shared or human account. Every action the agent takes must be attributable to it alone.
- Person, system owner and compliance: list the capabilities wanted. Typically: read case, read evidence, search cases, add a note, attach a document, propose a status change, propose an assignment. Each becomes a separate scope.
- Person, compliance: sets the depth for each capability. Reading at depth 1. Notes and attachments at depth 2, written as drafts that the investigator accepts. Status and assignment changes held for a person. Closing a case, changing a decision or deleting anything is outside the agent's role scope.
- Person, system owner: restricts the data scope. Case types, business units and sensitivity levels the agent may see. Cases marked restricted, such as those involving staff or legal privilege, are excluded by default.
- Agent, depth 1: runs in a test environment against copies of closed cases, so you can see what it reads and writes before it reaches live work.
- Person, compliance: approves go-live after reviewing the test output and the access configuration together.
- Person, system owner: schedules access reviews and confirms the revocation route works.
| Capability | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Read case and evidence | Reads within its data scope | 1 | Setting the scope |
| Search | Finds linked cases and subjects | 1 | None |
| Notes | Writes draft notes, marked as agent drafts | 2 | Accepting into the record |
| Attachments | Attaches evidence with source | 2 | Confirming relevance |
| Status change | Proposes, held | 2 | Approving the change |
| Close or decide | Nothing | None | The investigator and approver |
Which controls apply, and what evidence does each leave?
One identity, one trail. All agent actions run under its own identity. Evidence: the system's audit log shows exactly what the agent read and wrote, separately from people.
Drafts visibly marked. Notes and attachments the agent adds are labelled as agent drafts until an investigator accepts them. Evidence: a case history that shows which text came from the agent and who accepted it, which matters if the case is later challenged.
Held changes. A proposed status change waits for a named person; the hold, the approver and the time are recorded. Evidence: every outcome-affecting change has a human approver.
Revocation tested. Disabling the service identity must stop the agent immediately, without waiting for a session to expire. Test it before go-live and after every major release. Evidence: the test record.
Read logging, not just write logging. Many case systems log changes but not views. For an agent with broad read access, reads matter too, especially for sensitive cases. Evidence: a read log for the agent's identity.
What should you measure?
- Draft notes accepted unchanged, edited or rejected.
- Held status changes approved versus rejected.
- Attempts outside scope, such as reads of restricted cases, which should be refused and should be rare.
- Time from revocation to effect, tested periodically.
- Investigator time per case, before and after.
Where does it usually go wrong?
Borrowing a person's credentials. The fastest way to connect is to let the agent use an investigator's login. It destroys attribution and should never be allowed.
Broad read access by default. Agents rarely need every case type. Granting it means a prompt injection or a misdirected query can surface sensitive matters, including cases about staff.
Agent text indistinguishable from investigator text. If the record cannot show who wrote what, the firm cannot defend its reasoning later.
Retention rules bypassed. Agent drafts that are rejected still sit somewhere. Decide whether rejected drafts are kept as part of the case history or deleted, and apply the case system's retention schedule to them like any other record.
Tipping-off risk through linked systems. An agent connected to both the case system and a customer messaging channel could reveal an investigation. Keep these capabilities separate, as discussed in whether an AI agent can investigate an AML case.
Once the connection is in place, letting an agent build case files covers the work itself. The same scoping approach applies to other operational systems, as in connecting an agent to an order management system. Market-specific expectations for compliance teams are covered in our briefs on wealth management compliance in Nigeria and in Canada, and the overall stance in AI compliance agents.
Questions people ask
Can the agent create new cases?
It can propose them, for example from an alert, as a held action. Opening a formal investigation often has consequences, such as restrictions or reporting deadlines, so a person decides.
What if the case system has no fine-grained permissions?
Put a gateway in front of it that exposes only the approved capabilities to the agent and logs every call. Do not give the agent the system's full interface because the system cannot narrow it.
Should the agent see closed cases?
Often yes, for linked-case analysis, but within the same data scope and with reads logged. Closed cases are still sensitive.