The Signal & The Noise · Vol. 09
We want AI agents for their speed, and we lose that speed the moment we try to check everything they do. Let them run free, and nobody answers for what happens. In the same week, the UAE government and the world's banking supervisors showed where to begin.
Last week Omar Al Olama, the UAE's Minister of State for Artificial Intelligence, explained in Dubai how half of the federal government's work is to be done by AI agents within two years. That pace is exactly why we want agents. They take on work that costs people days, they keep going while we sleep, and that is what this whole technology was made for: speed.
One of the senior consultants in our Excellence Centre shows what that feels like in practice. He works with a handful of agents at once and makes around fifty changes a day, where a colleague used to manage one or two. Every change has to pass a second pair of eyes, as it should. Only nobody genuinely reads fifty changes a day. So they get signed off, or the work sits waiting for someone who has the time. The speed the agents are there for is lost the moment we try to check them.
Shortly before, I saw the other side, at a young company here in the region with a beautifully built solution. A great deal of good, hard work had gone into it, and it looked impressive. But there was no foundation underneath, and so the agents had complete freedom: they could do anything and were allowed to do anything, without knowing any limits. That is where the greatest risk sits, and not only for the people who build such a solution. Whoever uses it also answers for something they cannot see. What an agent like that does is often impossible to follow and hard to interpret, let alone explain to a client or a regulator.
Between those two scenes sits the split that every organisation working with agents now finds itself in. Check everything, and your speed is gone. Let everything go, and nobody answers for what happens. So the question is where you begin.
The minister gave this country's answer. Every agent in the federal government plugs into a single control tower, everything it does is logged, and people and AI keep checking that it stays within its authority. Where agents belong has been worked out in advance: around seventy per cent of services can take them, the rest cannot, and if a decision affects someone's livelihood, that is a red line. He also said who answers for it: "the responsible entity is not the AI agent; it's the institution that has deployed the AI agent." That is speed with the limits attached, decided before the big work begins.
For those of you reading in Europe, Africa or Asia: this split lands on the table of every organisation that works with agents, and here it is being answered now. At Samture we work on exactly that layer: the place where it is recorded what an agent may do, when it has to ask a person and where its answer comes from, in a form that a person can check and the agent itself can read.
In the boardroom, meanwhile, the conversation about AI is mostly about who leads it. At the end of September Gartner presented its latest CEO survey. 52 per cent of CEOs want to deploy AI agents aggressively as part of their workforce, up from 39 per cent a year earlier. Two thirds expect all technology to come under a single "super-tech leader", and one in five thinks the CIO role will have disappeared by 2030.
There is a lot of talk about titles, and I understand why, because a title is visible and you can draw it on an organisation chart. An agent, though, does not read an organisation chart. It does what its environment allows, at the pace its environment allows.
Two days after the minister spoke, on 15 October, the Financial Stability Board published its final guidance on AI in financial institutions. The FSB brings together the central banks and supervisors of the G20, so this is not a regional voice. What struck me is that it names both sides of the split.
On signing off, it is clear. Human oversight only counts when it is meaningful: people need the ability, the authority and the incentive to intervene, "as opposed to oversight that is nominal or driven by 'tick-the-box' compliance". On freedom, it is just as clear. "AI agents do not reason like humans and may interpret pre-defined goals in unexpected ways", so relying on their good intentions is not a policy.
Its answer lies in between. The limits belong in the design from the start, in what the FSB calls "the layer where decisions are made about what an agent can and cannot do". With that come triggers, set in advance, for when an agent must ask a person for approval, for instance above a certain amount or before a step that cannot be undone. What falls within the limits may go fast. What falls outside goes to a person, and then that person has something real to judge.
So a government in the Gulf and the world's banking supervisors arrive at the same place in the same week. Who answers for an agent is a design question, and you answer it before the agent goes live.
Look at the Gartner survey again through that lens. In the middle of their own presentation sits the question: the hype is steering investment towards AI, but who makes sure the infrastructure is ready? In their overview of who owns what, that very layer has no box of its own.
Their figures show what that costs. One in five AI projects delivered a positive return this year. Cutting people to get that return anyway does little: in a public Gartner survey from May, the reduction in staff was about the same at organisations that did and did not see a higher return. The return sat with the organisations that invested in how people steer their autonomous systems.
Steering needs a place. What the agent may do, what the words in its instructions mean, where its data comes from and what it has done. That is the layer without an owner, and it is also the layer that decides whether the other four projects will deliver anything.
Back to the region, and to the banks, where this split is felt most sharply. The four-eyes principle is the backbone of internal control there, and with agents it comes under pressure from two sides at once. Read everything, and the work stands still. Sign everything off, and it has become a rubber stamp.
Since February the Central Bank of the UAE has expected banks to be able to explain how their AI reaches a decision, and it holds the bank itself responsible, even when the work is outsourced. With the FSB guidance alongside, that expectation becomes very concrete. Can you show which rule an agent followed, and that the rule was there before it acted? Once the context and the rules are captured before the work begins, the review is about the rules rather than every single change. Then the four eyes keep their meaning, and the bank keeps its pace.
The banks here move fast, and that is a lead, as long as that layer is in place first.
I realise not everyone wants to hear this, but humour me for a moment. Take one agent, or one automated step, that your organisation runs or plans to run, and answer three questions on a single page. What may it never do? At what point must it ask a person? And where is that written down? If the answer to the last question is a policy document that people read, rather than something the agent itself reads, you have found the place to begin. This one is for inside your own walls; nobody needs to report anything back.
If you would like to see what this could mean for your own processes, a first impression is at samture.com/solutions, for banks at samture.com/banking, and I am happy to set aside half an hour for it.
The minister put it in one sentence, and it holds wherever an agent goes to work: the responsibility lies with whoever deploys it. What the Emirates are showing now is that you can carry that responsibility without giving up your speed, as long as you draw the limits before you need them.
The layer where an agent's limits are written down, so that people can check them and the agent itself can read them. See how the foundation works, for public services and for banks.
See the solutionsThe Signal & The Noise
A fortnightly read on what is actually changing in AI across the UAE and the Gulf, written personally. No content calendar, no generated filler.