Security architecture for conversational banking AI

Letting customers move money by talking is powerful, and it widens the attack surface. A serious conversational banking system treats security as architecture, not a feature. Here is how the pieces fit.

Defense in layers

No single control is enough. Conversational banking security is layered so that a gap in one place is caught by another:

• Limits. Per-transaction and daily caps, by customer and tier.
• Confirmations. Explicit approval before any state-changing action.
• Strong auth. PIN, OTP, or biometric for sensitive operations.
• Policy rules. Block risky recipients and patterns before execution.
• Least privilege. Each agent can only call the tools its job requires.

Least-privilege agents

A common mistake is giving one all-powerful agent access to every capability. Better to scope each specialist: the FX agent cannot issue cards; the support agent cannot silently move money. If any single agent is manipulated, its blast radius is limited to what it was allowed to do.

Credentials never in the open

In a chat interface, the tempting shortcut is to ask for a PIN or card number in the thread. Do not. Secrets must be captured through secure flows and never handled as plain text in the conversation. The AI prepares the action; authentication happens through a protected channel.

Prompt injection and manipulation

Because the input is natural language, adversarial input is a real threat: a customer, or content the system reads, may try to talk the AI into ignoring its rules. The defense is that guardrails and policy are enforced by the system, not by the model's goodwill. A limit is a limit even if someone politely asks the AI to ignore it. Instructions found in data are treated as data, not commands.

Grounding as a security control

An AI that only acts on real, grounded data is harder to trick into fabricating a balance or approving against imaginary funds. Truthfulness and safety reinforce each other.

Everything is logged

Finally, every decision and action is recorded for the audit trail, so security is not just prevention but also detection and accountability.

Security in conversational banking is the whole architecture working together. TwelveAI builds these layers into its infrastructure so safety is the default. See the security page.