Authority Is Earned, Not Installed

How Caribbean financial institutions can give AI responsibility one evidenced step at a time, and keep a named person accountable for every decision.

The GAIN Ledger™ · Article 5 of 7

New to this series?

The GAIN Ledger™ is a seven-part series for boards and executives of Caribbean banks, credit unions, insurers, securities dealers, lenders and payment providers. It introduces Dawgen CARI-GAIN AI™, Dawgen Global’s method for applying AI to redesigned work and proving that the improvement reaches earnings. This article covers governance: how much authority an AI system should hold, who stays accountable, and how to control vendors, data and cross-border obligations. You can read it on its own; everything you need to follow it is explained here.

When a new employee joins a bank, nobody hands them signing authority for wire transfers on the first morning. They shadow experienced colleagues. They prepare files that someone else approves. Their limits rise as they demonstrate judgement, and those limits are written down, monitored and withdrawn if something goes wrong.

AI systems deserve no less caution and no more trust. Yet many implementations grant software the equivalent of senior authority on day one, because the configuration screen allows it and the demonstration looked convincing. The system is allowed to decline an application, close an alert or post an adjustment before anyone has measured how often it is wrong on the institution’s own work.

The consequences are not theoretical. An AI tool that drafts a customer reply wrongly creates an embarrassment. An AI tool that releases a payment wrongly creates a loss, a complaint and possibly a regulatory question. The difference between the two is not the technology; it is the authority the institution chose to give it. This article sets out how to make that choice deliberately.

The framework in brief

Dawgen CARI-GAIN AI™ treats the complete workflow, not the software tool, as the unit of transformation. It rests on two ideas.

First, four CARI tests apply at every step. Capture: can every material output be traced to reliable, permitted evidence? Accountability: does a named person own each decision, with a real route to escalate? Return: does the benefit survive the full cost of running it, and has finance verified it? Inclusion: can every customer still use the service, and are staff involved and supported?

Second, work moves through four GAIN phases containing seven stages: Gauge (Frame the problem and baseline), Align (Capture reliable inputs; Simplify the work), Integrate (Connect systems; Assist with AI where it adds value) and Net Results (Prove the result; Expand what works). Each stage ends at a gate with four permitted outcomes: proceed, repair, pause or stop.

Figure 1 — The Dawgen CARI-GAIN AI™ model: four tests applied across four phases and seven stages. Dawgen Global illustration.

This article concerns the Accountability test and the Assist stage, where AI is first given work to do.

Three levels of authority

CARI-GAIN defines a progression that every AI use must climb, shown in Figure 2. Each level must be earned with evidence from the level below.

Level 1: read and draft. The system summarises evidence, drafts responses, classifies documents and suggests matches. People decide everything and nothing changes in any system of record. The risk is limited to the quality of the draft, and the institution learns how the system performs on its own documents, customers and products.

Level 2: prepare with validation. The system prepares complete case files, populates records and proposes actions, but a qualified person validates each item before it takes effect. Performance is measured against independent reference decisions, meaning the answers an experienced reviewer reaches separately, without seeing the system’s output.

Level 3: bounded automatic action. Only where explicit rules, value limits, risk thresholds and independent checks exist does the system act alone, and only within those limits. A sample of its automatic actions continues to be checked by people for as long as it operates.

Figure 2 — Authority levels: AI earns responsibility in steps, and some decisions stay outside automatic action at the outset. Dawgen Global illustration.

Some decisions stay out of automatic territory entirely at the outset: credit refusal, account restrictions, regulatory submissions, investment advice and the release of funds. Any later proposal to automate one of them needs its own legal and risk assessment and specific approval. The principle is simple: an AI explanation does not authorise a payment. Financial calculation, approval authority and transaction execution remain in controlled systems with their own controls, however persuasive the AI’s reasoning appears.

Authority also moves downwards. When a vendor updates its model, when the mix of customers or documents shifts, or when monitoring shows performance slipping, authority is reduced until the evidence is re-established. Authority that was earned can be withdrawn.

Named people, real escalation

Accountability means a named person, not a department and never “the system”, owns each decision. CARI-GAIN records this in a Decision Register: for every decision in the workflow, it lists whether a rule, an AI component or a person performs it, the authority level, the accountable role, the evidence retained, the value or risk limit, and the escalation route.

A reviewer is only accountable in substance if they have the information, the time and the authority to change the outcome. A “human in the loop” who must clear four hundred AI suggestions in an afternoon is not reviewing; they are approving by default. Review capacity is therefore planned like any other resource, with peak days in view.

Accountability is shared across six roles, shown in Figure 3. The board or a delegated committee approves risk appetite, material deployments and investment limits, and reviews customer outcomes and concentration risk, including dependence on a single technology provider. The executive sponsor and process owner own service, staffing, exceptions and benefits, and can suspend the workflow without waiting for a committee meeting. The finance owner validates the baseline and every benefit claimed. Risk, compliance and privacy assess obligations, fairness and permissible data use. Technology and security control access, integrations, vendor configuration, logs and recovery. Independent validation challenges model performance and controls separately from the people who built them, and internal audit retains its own independent assurance role.

Figure 3 — Six accountable roles around every AI-assisted workflow. Dawgen Global illustration.

Small institutions often worry that this requires a large governance structure. It does not. It requires clear separation of duties: the person who builds a workflow does not approve its live authority; the person who reviews exceptions can escalate to someone with power to act; and audit remains independent. In a team of eight, that may mean three people wearing different hats at different moments, with system access restricted accordingly.

Every live workflow also needs a suspension switch, a control that stops automatic processing immediately, and a tested alternative route. If a material control fails or a predefined limit is breached, automatic processing stops and assigned staff maintain the service. Recovery should be rehearsed, not hoped for, particularly in a region where a storm can take connectivity down for days.

Treat every input as untrusted

AI introduces a category of risk that traditional systems did not face. A customer message, an uploaded document or a retrieved web page may contain hidden instructions designed to manipulate the system into ignoring its rules, revealing data or taking an action. This technique is called prompt injection. A well-designed workflow treats all such content as untrusted data: instructions embedded in a document cannot change system permissions or business rules, however they are phrased.

Equally, access controls must be applied before retrieval, so that an AI assistant never receives a record the user is not permitted to see. This is the principle of least privilege: every person and every system component gets only the access its task requires. An assistant that can read every customer file in order to answer one customer’s question is a data breach waiting for a clever request.

CARI-GAIN requires testing before any live authority is granted, covering prompt injection, data leakage, impersonation, unsupported answers (responses not grounded in an approved source) and tool misuse. After go-live, it requires monitoring for changes in data, performance and vendor models.

Vendors, data and the applicability register

The Bank for International Settlements, in its 2026 analysis of AI data use in financial services, drew attention to data quality, privacy, security and third-party dependencies as central concerns. The Central Bank of Barbados has highlighted the resource constraints of smaller institutions and the need for tested, explainable AI. In May 2026, the Caribbean Group of Banking Supervisors made the impact of AI on the financial sector a key focus of its annual conference. Supervisors are paying attention, and they will apply existing rules to new technology.

In practice, these concerns translate into contract and configuration questions. Do enforceable terms prevent customer data from being used to train a provider’s general models? Where is data stored and processed, and by which subprocessors? What are the retention, incident response, continuity and exit rights? Can the institution leave without losing its records?

Most Caribbean jurisdictions do not yet have AI-specific statutes. They rely on data protection legislation, outsourcing and sector rules, AML/CFT obligations, consumer protection and supervisory expectations. In Jamaica, for example, the Office of the Information Commissioner’s data protection standards address accuracy, security, retention and cross-border transfers. CARI-GAIN therefore requires an applicability register for every deployment: a living list of the legal and regulatory obligations that apply, organised by jurisdiction, legal entity and activity, with a status, an evidence reference and a named owner for each. Cloud storage and remote support across borders deserve specific assessment; customer consent does not resolve every obligation. Where a regulator expects notification or non-objection, it belongs in the plan from the start. Where the position in a territory is unsettled, it is recorded as open, the more protective treatment is applied, and legal confirmation is obtained.

An illustrative scenario: one assistant, four territories

Illustrative and fictional. A regional banking group operates subsidiaries in Jamaica, Barbados, Saint Lucia and The Bahamas. Its compliance teams spend much of each week assembling evidence for transaction-monitoring alerts. Management buys an AI assistant that can read alert data, pull customer records and draft a disposition for each alert. In the demonstration, it closes alerts in seconds.

The original plan is to let the assistant close low-risk alerts automatically from the first month. Under CARI-GAIN, the group proceeds differently.

Step 1: set the authority level. The assistant starts at Level 1. It assembles the evidence file and drafts a summary; a compliance officer decides every alert. Closing or escalating alerts is reserved to qualified officers, consistent with their reporting accountability.

Step 2: register the decisions. The Decision Register lists each step: retrieving transactions (rule), retrieving customer records (rule, with access limited to the officer’s entity), drafting the summary (AI, Level 1), disposition (person), escalation (person, with the money laundering reporting officer named).

Step 3: check the obligations. The applicability register shows that customer data for each subsidiary must be handled under that territory’s data protection and AML/CFT rules, that the vendor processes data outside the region, and that one supervisor expects to be told about material outsourcing. The contract is amended to bar training on customer data and to confirm data location and exit rights; the notification is made.

Step 4: test before trusting. The team runs the assistant on several months of closed alerts whose correct outcomes are already known, including deliberately crafted transaction narratives containing hidden instructions. It finds that the assistant occasionally summarises evidence from a related customer the officer was not entitled to see. Retrieval is re-engineered so that access checks run first.

Step 5: earn Level 2. After the fixes, summaries are measured against officers’ independent conclusions. The assistant moves to Level 2 for evidence assembly only. Officers still decide; they now spend their time on judgement rather than on gathering files.

Step 6: monitor and keep the switch. Each summary is logged with its sources, model version and reviewer. When the vendor announces a model update, the group re-runs its test set before accepting it. Automatic closure is not approved; it may be proposed later, with its own assessment, if the evidence supports it.

The group ends up with faster, better-evidenced reviews, a governance record it can show a supervisor, and no decision it cannot explain.

What to do this month

1. List every AI use in the institution, including tools staff have adopted informally, and record the authority level each actually holds today.
2. Name an accountable person for each decision those tools touch, and confirm they have the time and information to review properly.
3. Test the suspension switch for any workflow where AI acts automatically, and rehearse the manual alternative with the staff who would run it.
4. Review vendor contracts for data use, data location, subprocessors, incident notice and exit rights.
5. Start an applicability register for your largest deployment, territory by territory, and note any supervisory notification required.
6. Commission a prompt-injection and access test before extending any AI tool’s authority.

Questions for your leadership team

1. For each AI use in our institution, what level of authority does it currently hold, and who approved it?
2. Can we suspend any AI-driven workflow within minutes, and have we tested the manual alternative?
3. Do our vendor contracts prevent our customer data from training general models, and do we have workable exit rights?
4. Do we maintain a register of the legal and regulatory obligations that apply to each deployment, in each jurisdiction?
5. Who independently challenges the performance of the systems our teams build or buy?

Key takeaways

• AI authority should rise in three evidenced steps (read and draft, prepare with validation, bounded automatic action) and fall again when evidence weakens.
• Credit refusal, account restrictions, regulatory submissions, investment advice and funds release stay outside automatic action at the outset. An AI explanation does not authorise a payment.
• Accountability means a named person with the time, information and power to change the outcome, supported by six clear roles.
• Treat all inputs as untrusted, apply least privilege before retrieval, and keep an applicability register for every jurisdiction you operate in.

Start with the CARI-GAIN Scan

Know exactly what authority your AI holds, and whether the evidence supports it. The CARI-GAIN Scan is a fixed-scope diagnostic that baselines your priority workflows, reviews decision ownership, automation limits, vendor terms and jurisdictional obligations, and delivers a ranked workflow portfolio and business case with a staged path to safe authority.

info@dawgen.global | dawgen.global | US 855-354-2447 | (876) 926-5210

Big Firm Capabilities. Caribbean Understanding.

 About Dawgen Global

Dawgen Global is an independent, integrated multidisciplinary professional services firm headquartered at 47 Trinidad Terrace, New Kingston, Jamaica, serving 35 territories across the Caribbean. Founded and led by Dr. Dawkins Brown, Executive Chairman, the firm is independent and not affiliated with any international network. It delivers a full suite of professional services under one roof: audit and assurance; tax advisory; IT and digital transformation; risk management; cybersecurity; actuarial and insurance regulatory advisory; HR advisory; mergers and acquisitions; corporate recovery; business advisory and strategy; accounting BPO and virtual CFO services; and legal process outsourcing.

The proposition is simple: big-firm capability without the big-firm price. Dawgen Global’s integrated approach is built for the specific complexities and opportunities of the Caribbean market, helping organizations make sharper, better-informed decisions that drive measurable progress.

To explore a partnership, reach out:

• Website: dawgen.global
• Email: info@dawgen.global
• WhatsApp (Global): +1 555-795-9071
• Caribbean offices: +1 876-665-5926 | +1 876-929-3670 | +1 876-926-5210