Agentic AI Autonomy Limits: What OSFI Asks Banks to Decide

The July 2026 Technology Risk Bulletin Makes Autonomy a Governance Decision and Management Literacy a Control

by Sam Rogers
7 min read
analysis
governance
risk-management
executive
regulated-industries
Agentic AI Autonomy Limits: What OSFI Asks Banks to Decide

This article is for educational purposes and does not constitute legal advice. Federally regulated financial institutions should consult qualified counsel about how OSFI's expectations apply to them.

An autonomy limit that nobody in the room could recognize being crossed is a wish.

OSFI Made Autonomy a Decision

In July 2026 the Office of the Superintendent of Financial Institutions published a Technology Risk Bulletin titled Generative and Agentic Artificial Intelligence: Implications for Technology, Cyber Security, and Operational Resilience. It applies to Canada's federally regulated financial institutions, and it maps its practices to guidelines those institutions already answer to: B-13 on technology and cyber risk, E-21 on operational risk and resilience, and B-10 on third-party risk, with a pointer to E-23 for model risk.

The bulletin draws its line between the two technologies in the first sentence. Generative AI "enables content creation," while agentic AI "introduces autonomous reasoning and execution." Its footnote defines agentic systems as agents that "autonomously reason, plan, make decisions and take actions without human intervention."

Then, under the heading on governance and strategic accountability, it asks institutions to "define ownership across the AI lifecycle and establish limits on autonomy."

That's a regulator telling the institutions it supervises that how much autonomy an agent gets is a decision the institution must make and own. Nothing in the bulletin says what the limit should be. The number is left to the institution, and so is the harder question, the one we'd want answered first: who could tell whether it's holding?

Three Instructions in One List

The autonomy instruction doesn't stand alone. It sits in a six-item list of governance measures, and the company it keeps matters more than its position.

The first item is "strengthen senior management literacy." The third is "integrate AI risks into the enterprise risk management framework," covering cyber, technology, model, and third-party risks, "to ensure consistent identification, aggregation, and mitigation of interconnected risks." The fifth is the autonomy limit. The sixth asks institutions to "implement AI harnessing alongside human oversight to maintain accountability and prevent unintended actions."

The paragraph above the list explains why literacy leads. OSFI writes that "AI systems can act with limited human oversight" and that "gaps in senior management understanding can lead to over-reliance on vendor-provided assessments, limiting effective scrutiny of AI behaviour."

Read the three together and the dependency is explicit. An autonomy limit is a risk appetite statement. A risk appetite statement is only real once it sits inside the enterprise risk framework with escalation triggers attached, which the bulletin also asks for. And the framework only works if the people who own it understand the system well enough to scrutinize it themselves instead of accepting the vendor's account of it.

The rest of the bulletin repeats the pattern at the operational layer. Institutions are told to "treat AI-generated outputs as inputs to decision-making rather than definitive outcomes," to "ensure human oversight with accountability for material or high-impact decisions," and to "apply approval checkpoints for high-impact actions." Every one of those controls terminates in a person.

What Setting a Limit Actually Requires

Consider what complying with that one line asks an institution to decide.

Where does the agent stop and a person start? For which action classes? Under what conditions does an exception route upward, and to whom? What does the person at the checkpoint need to see, and how long do they have? And when the agent's proposal is fluent, well-structured, and wrong in one load-bearing detail, is the person at the checkpoint the kind of person who notices?

The infrastructure half of those questions has answers. The bulletin lists them: unique non-human identities, least privilege, scoped permissions, tool allow-lists behind API gateways, logged and reviewed agent activity. AWS has gone as far as naming rubber-stamp approval as an anti-pattern of routing everything through human review, which I covered in an earlier post.

The people half has no answer in the bulletin, because the bulletin is a technology risk document. It names the dependency and stops. The sentence about over-reliance on vendor assessments describes the failure precisely: an institution that can't evaluate agent behavior on its own ends up letting the vendor set the autonomy limit by default, then signs the vendor's checklist as if it were the institution's own decision.

Literacy Isn't a Course

The word OSFI chose is literacy, and in most institutions that word gets routed straight to the training function. A module will be built. Completion will be tracked. Completion will be reported to the board as evidence that the first governance measure is in hand.

That's the failed proxy. Training ≠ Capability. Self-Assessment ≠ Behavior. A completion record shows that a senior manager sat through an explanation of tool chaining and prompt injection. It doesn't show what that manager does when an agent's summary of a credit file arrives with a confident figure that doesn't match the source document. The bulletin is asking for the second thing, because the second thing is what "effective scrutiny of AI behaviour" means in practice.

Gartner's forecasts of agent counts inside enterprise applications, and of how many current agentic projects will reach production, vary by report and I won't repeat the figures, but the direction isn't in dispute. Output volume rises. Verification rigor falls unless something holds it up. False confidence rises. Human review becomes performative, drift accumulates, and liability emerges. That's the operational drift sequence, and OSFI's escalation triggers are only useful if the people watching for them can see them.

When new systems are introduced, execution is audited. Behavior is not. The bulletin's own logic says behavior is the control.

What a Financial Institution Can Observe

Most of the bulletin belongs to programs PAICE doesn't run and shouldn't. Identity and access for agents, harnessing, secure development, third-party notification obligations, and continuity testing are Infrastructure-vector work, and AI Posture is one framework for describing maturity at that layer. How the bulletin sits against statutory and supervisory instruments elsewhere is a Regulation-vector question; EveryAILaw carries statutory reference and obligation categories for that layer, a starting point and not a determination of what applies to a given institution. Where an agent's action has already become a public matter, a proceeding, or an enforcement determination, AI Incident Law records it.

The one instruction the bulletin leaves without a measurement is the one about people, and that's the People vector. PAICE (People + AI Collaboration Effectiveness) measures how a professional behaves when AI output is uncertain, incomplete, or wrong. The assessment presents realistic work with seeded errors of the kind an agent would produce, confident and plausible and unvalidated, and scores whether the person catches them, verifies the claim that carries the decision, escalates when something can't be confirmed, and corrects rather than defends. A manager who sounds fluent about agentic risk but approves the seeded error scores lower than a terse one who stops it.

Those results serve as literacy evidence and as a basis for deciding who sits at a high-impact checkpoint. They're also private by architecture. Scores attach to hashed identifiers, no conversation text is retained, and individual results are structurally unavailable to the institution rather than withheld by policy. The institution sees the reliability of its cohort of approvers. It doesn't see which vice president missed the error. That person does.

OSFI has asked every institution it supervises to decide how much autonomy its agents get. The ones that answer well will first find out how their people behave when the agent is wrong, and set the limit where that behavior can hold it.

Want to know whether the people at your approval checkpoints can hold the autonomy limit you set? Learn about PAICE for organizations or take an individual assessment to see it firsthand.

Curious but short on time?

Take the 3-minute PAICE Pulse — a quick confidence check that maps how you see your own AI collaboration posture. No login required.