Banks Need Revocable AI Identities, Continuous Trust Models

Financial institutions are racing to deploy artificial intelligence agents that can initiate payments, approve transactions and freeze accounts. But traditional authentication frameworks assume there’s a human on the other end. As agentic AI use grows, banks are facing an authentication crisis that demands new controls.

See Also: Proof of Concept: Machine Identities Fuel Rising IAM Crisis

When an agent drifts from its intended behavior, banks need visibility into both intent and integrity, said David Barnhardt, strategic advisor for fraud and anti-money laundering at Datos Insights. Institutions must move beyond identity checks and validate delegated authority with managed, revocable digital identities for AI systems and continuous models that detect scope creep.

“Authentication will have to evolve from solely verifying identity to validating and verifying delegated authority,” Barnhardt said.

Financial institutions need managed, revocable digital identities for AI systems that embed cryptographic proof, so every action can be traced back to both the human who authorized it and the agent that executed it, he said.

The stakes extend beyond authentication. Fraud patterns are shifting as AI agents gain autonomy. Barnhardt predicts that threat actors will move from credential theft to agent compromise, which will force banks to rethink authentication and authorization at scale. He said institutions must build the ability to revoke certificates, shut down compromised agents and run parallel models that distinguish normal agent behavior from orchestrated fraud.

In this video interview with Information Security Media Group, Barnhardt also discussed:

• Weaknesses in point-in-time authentication controls;
• How can banks verify intent and integrity as agents evolve or delegate;
• How should banks prepare for emerging fraud and regulatory risks.

Barnhardt has more than 22 years of fraud mitigation in banking and payments. He previously worked at the Bank of America, Early Warning, Giact and Conduent. He holds multiple patents currently being used to identify fraud and account takeover and reduce payments.