Ask about authority, not technology. A board should ask which agents exist, what each is allowed to do and who answers for it, how that authority was earned and how fast it can be withdrawn, what happened the last time one failed, and what evidence shows the controls work. Model choice and accuracy figures matter less than these.
Why do agents need different board questions?
Because they act. A board has long overseen models that score or forecast, with people deciding what to do with the output. An agent sends, pays, files and changes records. The risk is no longer only a wrong number; it is a wrong action taken at scale before anyone looks.
That shifts the board's attention from model quality to delegated authority. The questions a board would ask about a new team with signing powers are closer to the mark than questions about an analytics project.
Which questions should the board ask?
| Question | A good answer sounds like | A warning sign |
|---|---|---|
| What agents do we run, and who owns each? | An inventory with a named business owner per agent | "IT has a list" |
| What may each agent do on its own, and what needs a person? | Capabilities listed with how far each may go | "It's supervised" |
| How was that authority earned? | Tested on our own cases before go-live, with results on file | "The vendor certified it" |
| When does authority expire, and what removes it? | Fixed review cycle; failures cut it the same day | No expiry |
| What can no agent ever do here? | A short, specific list enforced outside the agent | "It's in the instructions" |
| How fast can we stop an agent? | Minutes, by named people, without approval | "We'd raise a ticket" |
| What happened the last time an agent got something wrong? | A specific incident, its cause and the fix | "Nothing has gone wrong" |
| Can we reconstruct any single decision? | Yes, from a record of inputs, sources, checks and verdict | "We have logs" |
| Who is the accountable executive? | One named person | A committee |
| What do regulators expect of us here? | Specific duties mapped to controls | General reassurance |
"Nothing has gone wrong" is the most worrying answer. Every operation has errors. If none are reported, they are not being found.
How should the answers reach the board?
Through a regular report, not a one-off presentation. The report should show agents in service, any change in their authority, incidents and near misses, held and refused volumes, and upcoming recertifications. Our guide on reporting AI agent risk to the board sets out what to include, and the board paper template for an agent deployment covers approval of a new agent.
In banking, supervisors expect boards to oversee model risk. In the US, SR 11-7 sets this expectation for models generally; how it extends to agents is covered in SR 11-7 board and senior management oversight of agents. Under the UK's Senior Managers and Certification Regime, a named individual is accountable, which makes the "who" question concrete.
What does a good board conversation look like?
Take a building society's board reviewing its first agent, which drafts mortgage arrears letters. A non-executive asks how authority was earned. The chief operating officer answers that the agent was run on several hundred past arrears cases, scored against what the society actually sent, and certified to draft only; a collections officer approves every letter.
The non-executive asks what would remove that authority. The answer: any failed test drops it to read-only the same day, and the collections head can stop it at once. She then asks for the last error. The answer is a letter addressed to a borrower's former home, caught by the approving officer; the agent had read the property address instead of the correspondence address, and the source mapping has since been corrected. The board minutes the answers and asks for the next report to show held and rejected letter counts.
What should the board's questions lead to?
- An owned inventory, reviewed at least annually by the board or its risk committee.
- Authority mapped per capability, with expiry dates.
- An incident route that includes agent errors and near misses.
- Reconstructable decisions, tested by internal audit.
- Regulatory mapping, so the board knows which duties apply; auditors' typical document requests are listed in EU AI Act documentation an auditor will ask for.
Each question maps to part of agent governance: who sets the bounds, how they are enforced, and what the record shows.
Questions people ask
Does the board need technical AI expertise?
It needs enough literacy to test answers, not to build agents. Questions about authority, accountability and evidence do not need technical depth.
How often should the board discuss agents?
Through its regular risk reporting, with a fuller review at least annually and whenever an agent's authority expands materially.
Should the board approve each new agent?
Not usually. The board approves the policy and risk appetite; management approves agents within it. Agents that move money or affect customers' rights may warrant board or committee visibility before launch.