From AI Recommendations to Controlled Action in AML Workflows

Consider an AML investigation in which an AI agent assembles transaction history and KYC evidence for an internal reviewer. Preparing a recommendation does not itself authorize the agent to release those records or close the alert. In a controlled workflow, the institution defines which actions are permitted, which require a designated reviewer, and which are prohibited. The practical question is whether those rules govern the actual action – and whether the resulting records show what was authorized and what happened next.

One workflow, four kinds of action

The example below is illustrative. The institution’s own AML policy owner defines the real rules.

• Gather evidence. The agent retrieves approved alert, transaction, and KYC sources and prepares an investigation package with references to each source. Permitted.
• Hand off for review. The agent delivers the package to a designated internal reviewer. Permitted for that recipient only.
• Close the alert. A separate action with its own authority. Held until the named reviewer authorizes this specific closure against the current facts of the case. If a material fact changes first – a new beneficial-ownership discrepancy, for example – the earlier authorization no longer applies.
• Send KYC records elsewhere. A request to release customer records to an unapproved destination. Denied.

A held action may proceed after the required authorization, subject to the applicable policy checks. A denied action cannot be released by reviewer approval alone. And authorization is not proof of execution: each action moves from requested, to allowed, held, or denied, to executed – and its outcome is either confirmed or still unknown.

Where AYITA fits

AYITA is Realm’s governed runtime for regulated AI work. It sits at the point where an AI agent proposes an action, checking that request against the institution’s policies and delegated authority before execution. In an AML investigation, AYITA can permit evidence gathering, require human authorization for alert closure, or block unauthorized disclosure of customer records – while producing a verifiable record of each decision.

That control applies to the actions routed through AYITA’s enforcement path. In a real integration, the agent should have no alternative route to the case system or to customer records that bypasses the check.

What a reviewer can check

• Can each actor be identified, and can the delegation of authority between actors be traced?
• Which rules and authority applied at the moment of the request?
• What action was authorized, held, or denied – and on what basis?
• What was executed, and what evidence establishes its observed outcome?

If only the prepared package or an internal queue is confirmed, the record should say exactly that. An unknown outcome is not a completed one.

AYITA computes authorization verdicts deterministically, with no LLM calls in the verdict path. Given the same captured action request and the same recorded policy, authority, and case state, the verdict is the same, and a reviewer can recompute it. That is one assurance among three: a reproducible authorization verdict does not establish the quality of the agent’s AML analysis, and it does not confirm that an action changed an external system. Each needs its own evidence.

The market is moving the same way

On 15 October, ServiceNow announced AI Passport, a cryptographically signed credential intended to carry an agent’s authorized scope across multi-agent workflows; it is expected to become available in Q4 2026. July funding rounds for Norm AI, Onyx Security, and Hush Security point the same way, across policy reasoning, AI security, and agent identity.

Specialized controls and broader platforms are developing in parallel. Enterprises still need to verify how authority, enforcement, and evidence work together in their own workflows – and that requirement applies to any solution, Realm included.

What an AML team should test

For an AML team, the test is not simply whether an agent can prepare a useful investigation package. It is whether the institution can enforce who is allowed to act, preserve the authority behind each decision, and distinguish an approved request from a confirmed outcome. A controlled pilot should measure both operational efficiency and the quality of that evidence:

• time to assemble an investigation package and reviewer workload per case;
• actions held unnecessarily, and control exceptions;
• time for a reviewer to answer questions about a specific decision from its record;
• completeness of the evidence behind each consequential action.

The real test of governed AI is not whether an agent can explain what it did. It is whether the institution can independently establish what the agent was authorized to do, what it actually did, and what evidence supports the outcome.