On Monday in Seoul, Korea's Financial Supervisory Service said it is reviewing a full exemption from the country's network separation rule, which walls bank systems off from the internet, for financial firms with advanced AI security. Lee Seok, the supervisor's director-general for digital finance, told Seoul FinTech Week the rule is strong and simple but does not suit the AI era. Ten firms, picked from 49 applicants, have run a first test with AI for security work, and two more rounds are planned.

The trade comes with a clear price. "If an AI service provided by a financial company has a problem, the financial company must bear the responsibility, in any situation," Lee said, and responsibility for every decision has to sit with a person. The supervisor's survey of 118 firms counted 814 AI services in use or planned, up 24% in a year, and found more of them in the back office than facing customers. Security rules will move from a checklist to principles: each firm assesses its own risk and the supervisor checks the work. Fewer rules, the same owner. (Sidae Ilbo; Etoday)

Retailers are drawing the same line in code. Walmart says each AI agent that shops for a customer will have its own profile inside that customer's account, so its orders show up separately. Customers can approve every purchase or set a limit, with $50, $100 or $200 as examples, and delete the profile at any time. Walmart compares it to adding a cardholder with a spending cap.

The terms are just as plain. Purchases need the customer's approval by default, agents never see card numbers or change payment methods, and normal returns apply if an agent does not act as intended. Walmart will open an Agent Gateway so approved agents can shop through a proper interface instead of clicking through pages built for people. Every purchase has a named owner and a ceiling. (Walmart)

Model makers are pushing responsibility down the chain too. OpenAI said on October 21 that from November 20, model routers, AI gateways and other services that give third parties direct access to its models will need its review and approval first. Apps that simply build its models into their own features are not caught by that rule.

Companies that host or resell OpenAI models must keep safeguards consistent with OpenAI's own, investigate possible violations and coordinate enforcement, so a user blocked in one place cannot simply move to another service. OpenAI has not said how approval will work or how it will audit compliance. If your products reach a model through a router, ask your vendor whether it has applied. (AI.info; OpenAI's own post was not reachable for linking)

Washington is testing before it trusts. A Coast Guard notice in Monday's Federal Register says it intends to sign a research agreement with a company called LOOKOUT to evaluate "Super Intelligence" tools that detect, classify and track targets in low light, fog, rain and rough seas during search and rescue. The tools must be commercially available, portable and able to do their computing on the device.

One stated goal is to measure how confident the system is and how it performs, and to build an evaluation tool that could ease future adoption. The Coast Guard pays nothing under the agreement, says it does not want to shut out other participants, and takes public comments until November 25. The wording comes from a September executive order telling agencies to say "Super Intelligence" instead of "AI." The label is new. Measuring first is not. (Federal Register; executive order)

Already filed, if you want the run-up: The Buffer (China telling employers to warn workers before AI takes their jobs), The Lab (Britain's new AI biosecurity lab, funded partly in OpenAI and Anthropic credits) and The Clerk (a US appeals court taking a case away from a judge over an AI-drafted order).

Also on the shelf: The Tab (Europe's Parliament fighting over who pays when AI does harm), The Footer (Brazil's top court fining lawyers for hiding orders to its AI) and The Loop (Japan's rulebook for 180,000 civil servants using AI agents). Read today beside The Tab. Europe is still arguing over who pays when AI does harm. Seoul's bank supervisor gave its answer in one sentence.

Banks have learned this lesson the expensive way. In 1992 Barings sent Nick Leeson to Singapore as general manager of a new futures office and put him in charge of both the front office, which traded, and the back office, which checked the trades. He hid losses in an error account and doubled down after every loss.

By February 1995 the losses had reached £827 million, twice the bank's available trading capital. Barings, the oldest merchant bank in the United Kingdom, was declared insolvent on February 26. Nobody had separated the one who acted from the one who checked. AI agents now do both kinds of work, and Seoul's survey found more of them in the back office than at the front. (Nick Leeson)

Put these to management. For each AI system that can act on its own, who is the named owner, and who checks its work? Is the checker a different person, or a different system, from the one that acts?

Then the limits. Which of our agents can spend money, change records or reach customers, and what caps and approvals apply? If a vendor or reseller sits between us and the model, have we confirmed its safeguards match the model maker's rules?

The Move

Seoul's bank supervisor just put a deal on the table that other regulators are likely to copy. Fewer prescriptive rules for AI, and the company owns every outcome. Walmart and OpenAI are building the same logic into their systems and contracts.

Ask the chief risk officer for one page before the next board meeting: every AI system that can act on its own, its named owner, its independent checker, and its limits on money and data.

Name the owner before the agent acts.

Seven bullets. One move.