Prompts Are Not Controls

Why AI agents in regulated finance need a layer outside the model

Imagine an AI agent with access to a payments API, a customer database and an email tool. Its instructions say: do not move more than €10,000 without human approval.

That sentence lives in a prompt. A prompt is text that a model interprets, and interpretation is probabilistic. Most of the time the model follows it. In a bank, "most of the time" is not a control.

We already know how to govern actors

Financial institutions do not rely on the goodwill of people who have access to money. They rely on identity, entitlements, segregation of duties, four-eyes approval and logs. The employee may be honest and well trained, and the controls exist anyway.

Autonomous agents are a new kind of actor. Today many of them are governed by the one mechanism we would never accept for a human: a polite request.

Put the control at the action boundary

The useful place to enforce rules is not inside the model. It is between the agent and the systems it touches. Every tool call, API request and data access passes through a layer that decides, before anything executes, whether it is allowed, denied or escalated to a human.

The model can stay flexible. The enforcement does not need to be. The same request under the same policy should produce the same decision, and that decision should be replayable.

This does not make the model correct. It reduces and bounds what an incorrect action can do, and that is the property a risk function can actually work with.

Four building blocks

1. Identity. Every agent has a verifiable identity and scoped credentials, so you can answer who acted, on whose behalf and with what authority.

2. Policy. Rules are written explicitly and evaluated on every action, instead of being implied by instructions the model may or may not weigh correctly.

3. Audit. Each request, decision and reason is recorded in a tamper-evident log that risk, compliance and audit teams can read without asking an engineer.

4. Revocation. There is a way to cut an agent's authority quickly and across systems, rather than hunting through integrations one by one.

Why this matters in Europe

Frameworks such as DORA and the EU AI Act place weight on operational resilience, human oversight and traceability. A system prompt can state an intention. On its own, it cannot show a supervisor what happened, who approved it and how fast the institution could have stopped it.

Five questions before an agent goes to production

• Who is this agent, and how do we prove it?

• What is it allowed to do, written as policy rather than as instruction?

• What happens when it requests something outside that policy?

• Can we reconstruct any decision six months from now?

• How quickly can we revoke its authority?

If any of these is hard to answer, the agent probably has more access than the institution can currently govern.

What we are building

At Hardalion we are building Nexus, a governance and execution layer for autonomous AI agents in regulated financial institutions, with identity, policy, audit and a kill switch as core components. It is early, and we learn the most from teams willing to compare notes.

If you are putting agents into production, which of the five questions is hardest for you to answer today? I would like to read your answers in the comments, or at apostolos@hardalion.com.