FINRA has been clear that it is not writing a separate rulebook for AI. Regulatory Notice 24-09 says its rules are intended to be technology neutral and continue to apply when member firms use generative AI, whether they build the tool or use one embedded in third-party software. What changed in the 2026 Annual Regulatory Oversight Report is specificity: a new section on generative AI that names the risks of AI agents and the practices firms may wish to consider. If your project management tool now ships agents, this is the reading list.
1. The Risks FINRA Names
The report lists agents acting autonomously without human validation and approval; agents acting beyond the user's actual or intended scope and authority; multi-step reasoning that makes outcomes difficult to trace or explain; agents working on sensitive data that may store, disclose or misuse it; general-purpose agents lacking domain knowledge; and misaligned reward functions. None of these are exotic. They are the ordinary failure modes of handing a capable new hire every key in the building on day one.
2. Four Practices, Four Controls
FINRA suggests firms consider where to keep a human in the loop, how to monitor agent system access and data handling, how to track agent actions and decisions, and how to establish guardrails that limit agent behaviours, actions or decisions. Each maps to a concrete control you can ask a vendor to show you. Human in the loop is an approval step in front of a category of action, not a single prompt. Access monitoring is a per-agent list of what it can reach. Tracking is a ledger of every action. Guardrails are hard limits the agent cannot argue its way past.
3. How Those Look in Kavanah
Each AI employee in Kavanah runs inside capability scopes you assign, such as tasks, communications, CRM or finance, and the tools outside its scopes are removed before the model ever sees them. Autonomy has four levels: off, assess only, safe and full. In safe mode an agent can never send email, post externally or delete anything. In full mode, action policies decide per category (external sends, finance writes, destructive actions, AI spend) whether to allow, allow within a daily budget, park for approval or block, and a category with no policy parks for approval by default. Every action lands in an action ledger, reversible ones carry an undo, and an agent cannot be the source of an authorization: a document in which one agent grants another permission is refused at the write.
4. Supervision Still Belongs to a Person
Rule 3110 requires a supervisory system and written procedures tailored to the firm's business, with reviews of correspondence done by a registered principal and evidenced in writing. An agent does not change who is accountable. What a well-built system changes is how much of the principal's day goes to finding the work: parked agent emails wait in one place to be read, edited and approved, and the approval, the message and the agent's conversation all reach the archive under compliance mode.
We keep the comparison of how other project tools describe their AI controls, and the full checklist for regulated firms, on our financial services page. Start an agent in safe mode, give it one job, and read the ledger for a week before you widen anything.
