The distinction that matters in a finance-adjacent system is between AI that answers and AI that acts. An assistant scoped to what the signed-in user may already see is low-risk. An agent that adjusts an accrual is not, and needs policy, a review queue for anything flagged, and an immutable record of what it did and why.
Governance here is not a compliance overlay — it is what makes automation deployable at all in a process that has to survive an audit.