Who Governs the Model When an Agent Runs It?
Model governance is the missing layer in the Agentic Office of the CFO.
Picture a Monday close meeting. Over the weekend, an AI agent ran the cost allocation cycle, as it was set up to do. Branch margins moved. One region went from profitable to break-even. The CFO asks a simple question: what changed?
The agent can show the cost flow. It can't say whether the driver behind it was the right one, who approved the last change to that rule, or whether the number would hold up in front of the board. Nobody in the room can either.
That moment is coming to a lot of finance teams. And it has little to do with the agent itself.
The agents are already here
This isn't a forecast. Oracle EPM now ships a Planning Agent and a Profitability and Cost Management Agent that build allocation models and trace cost flows in natural language. Other platforms are doing the same. In Deloitte's year-end CFO Signals survey, more than half of CFOs put integrating AI agents among their top three finance transformation priorities for 2026 (Journal of Accountancy).
The same CFOs are less sure about control. In Deloitte's second-quarter survey, only 43% said they felt fully confident in their AI governance (CFO Dive). And a separate Deloitte study found that only 14% of finance leaders want fully autonomous agents making critical decisions (Constellation Research).
So the appetite is real, and so is the hesitation. Both are reasonable.
The platform governs access. Someone has to govern the logic.
Platform agents work within the permissions and policies you set. That is access control, and it matters. But it answers a different question from the one the CFO asked on Monday.
A profitability model is a chain of judgment calls: which driver allocates IT cost, how funds transfer pricing curves are built, what counts as a direct cost of care. Those calls were made by people, often years ago, and many were never written down. When a person runs the model, those gaps get caught in review, at least sometimes. When an agent runs it, the gaps run faster.
Three things change once an agent operates the model:
Speed multiplies errors. A wrong driver used to distort one month. Now it can distort every scenario the agent runs before anyone looks.
Agents don't question the premise. A general-purpose agent executes the rule it finds. It doesn't ask whether the rule still fits the business.
Ownership blurs. If an agent proposes a change to a rule and someone clicks accept, who owns that rule now?
None of this argues against agents. It argues for governing the model before you hand it over.
For banks, the gap now has a regulatory shape
On April 17, 2026, the Federal Reserve, the OCC and the FDIC issued SR 26-2, which replaces SR 11-7 as the core guidance on model risk management. The new guidance is risk-based and scaled to the size and complexity of each bank. It also keeps the bank fully responsible for model risk when the model comes from a third party (Baker Tilly).
One detail matters here: generative and agentic AI are explicitly outside the scope of SR 26-2, and the agencies have said separate guidance will follow (EY).
Read together, that leaves a regional bank in an awkward spot. As I wrote in SR 26-2 Redrew the Line, the new guidance pulls the FTP curve into the model inventory and pushes many cost allocation engines out, while the risk stays. The agent that now runs those models has no supervisory framework yet. Until it does, the bank has to decide for itself how that agent is governed. This isn't legal advice, and each bank's model risk team will draw the line differently. But waiting for the rule is not a control.
What better model governance looks like
Good model governance in finance isn't a binder updated once a year. McKinsey makes the same point about agentic organizations in general: governance can't stay a periodic, paper-heavy exercise (McKinsey). In a cost and profitability model, five practices make the difference.
An owner for every rule and driver. Not "finance owns the model." A named person for the IT allocation, another for FTP, another for cost of care by service line. When an agent touches a rule, its owner is the one who signs off. (I walked through this for the FTP curve in One FTP Curve, Five Decisions.)
An inventory tiered by the decision it feeds. A driver that feeds a pricing or branch-closure decision deserves more scrutiny than one that feeds an internal report. Tier by consequence, not by complexity.
Agents propose, people decide on what matters. Let agents run routine cycles and flag anomalies. Keep human approval for changes to rules and for anything that moves a critical decision.
A trail from ledger to decision. Every number should trace back through activity and cost object to the decision it supports. If the answer to "why?" is a plausible paragraph, the model isn't governed.
A review rhythm tied to the close. Review drivers when the business changes and at a set cadence during the close cycle, not when a regulator asks.
None of these needs new software. They need someone who understands both the industry logic and the model, and the discipline to write it down.
Where to start
Start with one model: the one nobody fully trusts. Every finance team has one. It's usually the profitability model, because it carries the most judgment and the least documentation.
Map who owns each rule, which decisions each driver feeds, and where an agent could operate safely today. Then fix what needs fixing before the agent scales it.
That's the work behind our Model Governance Review. It's how we start every Agentic Office of the CFO engagement, because agents are only as good as the model they run.
If your EPM platform already has agents switched on, or will soon, write to me at psanmartin@asher.company about the model you'd look at first. You'll hear back from me, not a sales team.
Pedro San Martín, Founder & Principal, Asher & Company · Chair, IMA Profitability & Cost Management SIG
