Maker-checker is a control in which one person prepares a transaction or change, the maker, and a different person reviews and approves it before it takes effect, the checker. Nothing the maker creates goes live until the checker releases it, and the system stops one person from playing both roles on the same item.
Why does maker-checker matter once AI agents act?
It is the most natural place for an agent to start. The agent makes; a person checks. That is depth 2 in our terms: the agent drafts, a person sends. Banks already run thousands of maker-checker flows, so putting an agent in the maker seat changes less than people expect.
The risk moves to the checker. When a person checked another person's work, they knew mistakes were possible. When an agent's drafts are right for weeks, the checker starts approving without reading. A check that is never refused is no longer a check. Making the checker's job real is the main design task.
How does maker-checker work in practice?
- The maker creates the item: a payment, a limit change, a customer record update.
- The system records it as pending, with the maker's identity.
- The checker sees the item, the evidence behind it, and what changed.
- The checker approves or rejects, with a reason for any rejection.
- The system releases approved items and logs both identities.
With an agent as maker, step three matters most. Show the checker the sources the agent used, where each fact came from, the rule or limit that sent the item for checking, and anything unusual. A checker who sees only the finished item can only approve it.
What does that look like in an example?
A microfinance bank's agent prepares disbursements for group loans once a loan committee has approved them. Each disbursement lands with the branch manager showing the approval minute, the borrower's account, and whether the account details match those captured at onboarding. One day the account on a disbursement differs from onboarding. The manager rejects it, and the reason is filed. The lesson that small loans still need full controls is drawn out in agents in microfinance: small loans, same rules.
Not every action needs a checker. Cancelling a direct debit at a customer's authenticated request may be fine for an agent alone, as discussed in can an AI agent cancel a direct debit? The cost of an error should decide.
How is maker-checker different from dual control?
Maker-checker splits a task into two roles in sequence: prepare, then check. Dual control requires two people to exercise authority together, often at the moment of action, with neither role subordinate. The terms are often used loosely, but the distinction matters for agents. An agent can be a maker. It should not be one of the two authorising parties under dual control, because that control depends on two accountable people.
Which related terms should you know?
- Four-eyes principle: another name for having a second person check.
- Segregation of duties: no single person controls a process end to end.
- Underwriting: credit decisions often use a maker-checker step above a set amount; see what is underwriting?
The limits on agents across banking are in AI agents in banking.
Questions people ask
Can an agent be the checker?
As an extra automated check before a person, yes. As the accountable checker for actions that require one, no. The check exists so that a person answers for the release.
How do you stop checkers rubber-stamping?
Show them the evidence, not just the item. Track how often each checker rejects, sample their approvals, and occasionally send known errors through to confirm they are caught.