AI Agents Are a New Risk Type

When an AI agent processes a payment, files a compliance report, or routes an inference request to the cheapest available model, which risk category does it fall into?

The obvious answer is model risk. The agent runs on a model, so the existing frameworks (SR 11-7 in the US, SS1/23 in the UK) should cover it.

But those frameworks assume the model is a component inside a human-driven process. Somebody submits inputs, the model produces outputs, a person reviews them.

AI agents break that loop. They choose their own inputs, call their own tools, and in some configurations select which model to run mid-task.

That isn't a new instance of model risk. It's a different kind of risk. Token spend is a cost line that can grow 20x in twelve months without anyone approving a purchase order. Agent identity is an authentication problem with no regulatory framework. Model routing is vendor risk for a supply chain that reconfigures itself weekly.

Token spend is a new cost line

Most operational costs in finance are either fixed (headcount, rent) or variable in predictable ways (transaction volume times per-unit cost). Token spend is neither.

Companies on Ramp saw AI token spend grow 20.7x between June 2025 and June 2026. A year earlier, that line item didn't exist. Now it's growing faster than any finance team can forecast.

The cost varies per request and scales with the complexity of the task, not the volume of transactions. A simple classification call might cost a fraction of a cent. A multi-step agent workflow with tool calls, retrieval, and chain-of-thought reasoning can cost dollars. Same API, same vendor, wildly different price depending on what the agent decides to do.

Brex data shows companies add their first open-compute vendor within five months of their first OpenAI or Anthropic API charge. Five months from "trying the API" to managing a multi-vendor inference supply chain, often before finance has a GL code for it.

The gap is structural. Engineering teams treat token costs as infrastructure. Finance teams see them as SaaS subscriptions. Neither framework captures a cost that's variable per request, grows geometrically, and shifts overnight when somebody swaps a model.

Agent identity is an unsolved auth problem

When a human employee processes a payment, the institution knows who they are, what they're authorized to do, and how to revoke access if something goes wrong.

When an AI agent processes a payment, those questions have competing answers but no standard. BLIK pre-authorizes through the banking app. Catena Labs issues scoped cryptographic tokens. Visa, Mastercard, and Ant International are building a joint trust framework that hasn't shipped yet.

Existing authentication stacks are built for humans. OAuth tokens, session cookies, multi-factor challenges. An agent that needs to call a payments API, retrieve account data, and file a regulatory report operates across multiple services with different credential scopes in a single automated chain. If the agent's behavior drifts outside its intended scope, there's no session to terminate in the usual sense.

The standards bodies are moving. Google shipped A2A for agent-to-agent communication. Visa published a Trusted Agent Protocol. FIDO is building an identity standard for non-human actors.

But the OCC hasn't published guidance on agent authorization, and the Fed hasn't addressed it. The gap between what agents can do today and what regulators have frameworks for is widening.

Model routing is vendor risk

Early adopters had one model provider, one contract, one set of terms. Today, inference gateways like OpenRouter route requests across 400+ models, choosing the cheapest or fastest option per call.

Ramp's Router claims 40% cost savings by matching each inference request to the best model for the job. That's rational optimization. It's also a supply chain decision made at API speed, with no procurement review per transaction.

The risk taxonomy problem: model routing creates vendor dependencies that shift continuously. The model that handled your compliance summarization yesterday might be deprecated next month. A routing change can introduce accuracy drift, bias shifts, or compliance gaps, and the decision is automated.

In traditional vendor risk management, you evaluate a vendor, sign a contract, and review annually. Model routing makes that cycle meaningless. Your effective vendor can change between the time you send a request and the time you get a response.

The regulatory gap

Existing risk frameworks were designed for systems where humans review outputs, models are versioned and validated, and vendors change quarterly at most. AI agents operate in a world where the human is optional, the model can change mid-task, and the vendor stack reconfigures itself.

The OCC's model risk guidance (SR 11-7) was published in 2011, when "model" meant a regression in a spreadsheet. The EU AI Act classifies risk by use case but doesn't address the compound risk of an autonomous agent that selects its own models, tools, and execution paths.

Financial institutions will need to treat agent risk as its own category, the way model risk separated from operational risk after SR 11-7. Token spend needs cost controls that track per-request variability. Agent identity needs auth standards built for non-human actors. And model routing needs a vendor framework that can keep pace with a supply chain that reconfigures itself daily.

The question is whether those frameworks arrive before or after the losses that motivate them.