Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Who Approves an AI Agent's Decision to Open an Account?
A named person at the institution, because the account that opens carries a record and an obligation, and state automated-decision laws reach decisions that replace human judgment. The record has to show what that person saw before the account opened.
Opening an account is the point at which an institution decides to take on a customer, and the file behind it is the most personal a business keeps: a legal name, a date of birth, an address, a tax identifier, sometimes a passport image and a credit report. An agent is useful in that assembly: it opens the onboarding queue, copies the identity fields into the case, orders the credit pull and drafts the memo for whoever signs. What it cannot carry is the obligation that follows the account, and the person who signs does. The law now turns on where that person sits. California's automated-decision regulations define an automated decision-making technology as one that "uses computation to replace human decisionmaking or substantially replace human decisionmaking," and a significant decision as one that results in "the provision or denial of financial or lending services" (Bass, Berry & Sims, 2026). An agent that assembles a file and leaves the open to an officer stays on one side of that definition; an agent that scores the applicant and opens the account does not. Colorado's replacement statute keeps the distinction for a consequential decision and adds a three-year recordkeeping duty (Goodwin, 2026). The approval decides which duties apply and who answers for the account.
Key findings
- An account opening that an agent assembles is governed only when the values on the application screen are replaced with consistent tokens before any model reads it, so the agent files the applicant as APPL_014 and the real name, date of birth and tax identifier resolve only at the approved destination (What Is Supervised Delegation?).
- It also requires a person at the institution to approve each open, decline and hold, with a record that shows which fields that person saw on the rendered application before the decision (What Is an AI Control Record?).
- The regulatory pages reviewed say which fields an account record must hold and who may pull a consumer report, and they do not name who approves an agent's decision on the application (FINRA, Comparison, 2026).
- Shavit, Agarwal, Brundage and colleagues call human approval "a standard way to limit egregious failures," and ask that "at least one human entity is accountable for every uncompensated direct harm," which for account opening means a name attached to the decision rather than to the tool (Shavit et al., 2023).
- FINRA's 2026 annual regulatory oversight report warns of "AI agents acting autonomously without human validation and approval" (FINRA, 2025).
Who approves the decision when an agent assembles the application?
The approver is an officer of the institution, and the authority is written into a role rather than into the agent's configuration. In an onboarding process that is the officer who signs the account, a branch manager for a retail open, or a BSA officer on a high-risk file. The agent's work ends with the file. The signature is a separate act by a person whose name the bank can produce, which is the arrangement the 2023 governance paper asks for when it says that "at least one human entity is accountable for every uncompensated direct harm" (Shavit et al., 2023).
Of the 45 AI laws enacted in California, Colorado, Illinois and New York in 2025 and 2026, 4 require a person to review or approve the AI's decision (How Many AI Laws Require Human Review of AI Decisions?).
Take a business account application an agent prepared. It read the formation documents, filled the beneficial-owner section, ordered the credit report and wrote a memo recommending approval. The officer reads the memo, checks the ownership chain against the documents, and approves the open with a deposit account attached. The memo is the agent's recommendation; the account is the officer's decision.
A permission is not an approval. It says the agent may call the account-opening service, not that a person read the file. The separation-of-duties question is whether the person who approves also set the agent running, and a workflow where the operator signs fails it (Do Coding Agents Break Separation of Duties?). Risk differs by product, and Gartner's 2026 warning that uniform governance will fail argues for approval that varies with the workflow (Who Approves High-Risk AI Agent Workflows?).
What does the agent read on the screen where an account opens?
FINRA's 2003 comparison of the customer identification rule with the books-and-records rule, which says of itself that it "contains brief summaries of the rules' relevant provisions", puts the identity data in front of the open ("Prior to opening an account") and lists date of birth, a tax identification number, a telephone number, "Annual income," net worth excluding a primary residence and "The account's investment objectives" among the fields the record carries (FINRA, Comparison, 2026). A business application adds the beneficial owners, the source of funds and the funding account.
The credit report is the second read. A consumer reporting agency may furnish a report "under the following circumstances and no other," and one of them is a person that "otherwise has a legitimate business need for the information" in connection with a transaction the consumer initiated (Cornell Law School, 2026). That purpose belongs to the institution, so the pull has to be attributable to its decision and not to whatever the agent did next.
What the model receives is the whole page, because a browser draws every field for whoever is signed in. The page cannot tell a clerk from a model, so an agent that opens the applicant record holds the name, the date of birth, the tax identifier and the credit result for the rest of the run. How Do You Know Which Pages and Records an AI Agent Accessed? sets out why the page is the unit to ask about.
What do the vendors themselves say?
Two vendor documents describe a control close to the approval in the title, and both stop short of it in the same place.
1Password's blog on browser-use agents says a credential is injected "if, and only if, the human approves the access," and that "the AI agent and underlying LLM never need to see nor handle the credentials" (1Password, 2025). That is a real approval, and it governs one thing: whether the agent gets the credential. It does not describe who approves the account the agent opens after signing in.
OpenAI's help page for its agent states that with connected apps it "can access sensitive data like emails, files, or account settings," and that screenshots are not captured during a takeover, which "helps protect passwords" (OpenAI, 2026). That describes a handover for a step a site reserves for a person, and protects a password at that step. It does not describe what the model receives from an account page, and it names no approver for the account.
| What the page covers | 1Password, per its documentation | OpenAI ChatGPT agent, per its documentation | What a buyer should verify |
|---|---|---|---|
| Where the approval sits | A person approves the credential's release | A person takes over the screen for a reserved step | Whether the approval covers the decision or only the access |
| What the model holds | Not addressed | Connected apps can reach sensitive data | What the model receives from the rendered application |
Either page read as an answer to the title leaves the account unapproved.
What record has to exist after the decision?
The account record is the customer file. FINRA's 2003 comparison sets retention at five years after an account closes for the identification data and "Six years after the closing of the account" for the books-and-records version, and it tells firms to check the rules (FINRA, Comparison, 2026). Colorado's replacement act adds "recordkeeping requirements for at least three years" for a consequential decision, enforced by the attorney general with a 60-day cure period (Goodwin, 2026).
The decision record is the other one, and it answers what the approver saw. The visibility research gives three measures a record of agent work needs: "agent identifiers, real-time monitoring, and activity logging" (Chan et al., 2024). They show which agent ran and what it did, not the page the approver received, because a record of the run is not a record of the review.
The prompt-injection work states the constraint: once an agent has ingested untrusted input, "it must be constrained so that it is impossible for that input to trigger any consequential actions" (Beurer-Kellner et al., 2025). An account opening is such an action, and the two gaps a security stack leaves open, permission and accountability, meet when the file is ready to become an account, which What Two Gaps Do AI Agents Open in the Security Stack? sets out. The record is what makes the approval checkable: the tokenized fields the model read, the terms approved and the officer's name.
What does a governed environment change?
A governed environment changes what reaches the model before the decision and what the decision can be checked against. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers.The values a policy names are replaced with consistent tokens as the page renders, so an agent working an application reads APPL_014 where the legal name sat and TAX_014 where the tax identifier sat, for the whole run. Real values resolve only at the approved destination, when a named person approves the open, so the account record receives them and the model never does.
The approval is the second change. A consequential action waits for a person whose name is attached to it, and the record shows the page that person received, because in a governed environment it is the page the agent read. Who Approves an AI Agent Before It Sends Sensitive Information? makes the same argument for outbound messages, where the send is the consequential action and the approval sits on it.
The third change is the record. Every screen as the model read it, every action and every approval with a name exports to the organization's own monitoring, which turns an approval from a claim about a process into a fact about a run. An examiner can then ask what the officer saw and get an answer independent of anyone's memory.
The judgment does not change: an officer still reads the terms and signs or declines, and the decision now rests on a page the institution can reproduce.
What the record shows
An officer who signs an account approval needs evidence behind the signature, and the rules reviewed here supply part of it: the fields an account record must carry, the purposes a consumer report may serve, and the retention after a consequential decision (FINRA, Comparison, 2026; Goodwin, 2026). What the pages do not supply is the screen the approver saw, which is the one input that ties the person to the decision. A bank that records the approval and not the page has the name and not the evidence. It should test this on one product: run a single application with test values, capture what the model read at each step, then compare that capture with the approval record and the identity fields on the opened account. The difference is the exposure the approval was supposed to close.
Methodology and limitations
This page rests on two research preprints, a visibility study, two vendor documents, four sources of regulation and guidance, and one regulator report. Public documentation read in full gives a sound view of where each source applies its control, and pages read as of October 22, 2026 carry that date in Sources.
No product on this page was tested for it, and the statements about vendor behavior come from the documents as published on the dates cited. Vendor features change, and the page carries its date. The example describes a record type, a business account application with a named approving officer, not an organization. RedactSure is deploying now with enterprise and government customers. Whether a particular workflow counts as an automated decision under a state law, and which duties follow, are determinations for counsel, assessors and the organization's own compliance officers.
Frequently asked questions
Who approves an AI agent's decision to open an account?
A named officer of the institution, not the agent and not the vendor. The approval is the act that turns an assembled file into a decision, and it belongs to a role the bank can point to: the officer who signs the account, a branch manager, or a BSA officer on a high-risk file. The vendor pages reviewed describe credentials and connected apps, and neither names an approver. The bank's own procedures are the only place that name appears.
What does the model read on an account application screen?
The identity fields the page renders: legal name, date of birth, address, tax identifier, telephone and, for a brokerage record, income, net worth and investment objectives (FINRA, Comparison, 2026). A business application adds beneficial owners, source of funds and the funding account. The credit report arrives in the same session, because it is furnished for a permitted purpose and the page displays the result. Anything the page draws, the model receives for the rest of the run.
Do state automated-decision laws require a person to approve an account opening?
They reach the decision when software replaces the person. California's regulations define an automated decision-making technology by whether it "uses computation to replace human decisionmaking or substantially replace human decisionmaking," and a significant decision as one resulting in the provision or denial of financial services (Bass, Berry & Sims, 2026). Colorado's act turns on a non-de minimis factor in a consequential decision (Goodwin, 2026). An agent that assembles a file for an officer's signature sits differently from one that decides, and counsel should confirm which applies.
What record should an approval leave?
One that shows the page the approver received, the terms approved and the approver's name. The regulated records name fields and retention: five years after an account closes for identification data and six years for the books-and-records version (FINRA, Comparison, 2026), plus three years under Colorado's act for a consequential decision (Goodwin, 2026). Neither rule describes the screen, so the bank has to ask for it when the workflow is designed.
Can the agent decide and have a person confirm afterward?
That is a review, not an approval. The governance paper's test is whether the action can be reversed after the fact, and an account that has been opened, funded and issued a card is not easily reversed (Shavit et al., 2023). A confirmation records that someone looked, and it does not put a person between the file and the account, because the decision is already made.
What should a bank put in writing before an agent works applications?
Which values the model receives from each rendered screen, where the real values resolve, who approves by name and role, and what the record holds and where it exports. Add the retention period and the path when an identity check fails. Ask for the answers per screen, because an application, a credit result and a funding page show different values. The written answer is what a pilot is measured against.
How RedactSure Keeps the Applicant's Identity Off the Account Screen
An approval that names an officer proves nothing about the page that officer reviewed. FINRA's 2026 oversight report warns that "Agents may act beyond the user's actual or intended scope and authority," which is the gap a signature over an unseen screen leaves open (FINRA, 2025).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent reads the legal name, the date of birth and the tax identifier on the application and drafts the approval memo. Inside, the application renders APPL_014 and TAX_014, the memo is drafted from those tokens, the officer approves the open, and real values resolve only at the account record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
An approval record that shows the page the officer read is the one an examiner can follow. Bring one account application and see, with test values, what the model reads, who approves the open and what the record keeps. Book a demo