The Forge — Armory Forge Systems — Signet Article #046

Something useful happened in Mumbai this month, and it had nothing to do with a new model release.

On September 10, at the Global Fintech Fest, the chairman of India's National Payments Corporation drew a line through the middle of the agentic AI conversation. Ajay Kumar Choudhary, NPCI's non-executive chairman and independent director, put it like this:

"Decision making and execution must remain separate. AI may recommend, but authentication and final settlement must follow deterministic auditable rules."

Read that twice. It isn't a warning that AI is dangerous. It's an architectural instruction — and it applies to your business whether you process payments on a national rail or run a three-person plumbing shop.

What he was actually describing

NPCI runs UPI, India's real-time payments network. In August it carried roughly 24.5 billion transactions across 752 banks. When an institution like that says "here's how agents are allowed to touch money," it isn't a think piece — it's a design constraint for everyone building on top of it.

His reasoning rests on a mismatch. AI reasoning is probabilistic: the same situation can produce different interpretations, and that flexibility is precisely why it's good at figuring out what a customer actually wants. Payments infrastructure has to be the opposite — deterministic, auditable, final. A settled transaction can't be probably settled. A spending limit can't be approximately enforced.

So the architecture he described splits three things people normally lump together: intent, authorisation, and settlement. The agent reads intent. The rail verifies identity, mandate, limits and consent. Then the rail settles.

Notice how little the agent is doing. It selects. It does not authorise. It does not enforce a limit. It does not move the money.

The objective, Choudhary said, is not unlimited machine autonomy but "autonomy that is bounded and accountable."

The part that isn't settled yet

Reporters have gotten slightly ahead of the record here, so it's worth being precise. Reuters reported on September 10 that NPCI is building a registry to verify and monitor AI agents making transactions on UPI, forming part of a planned Unified Agentic Protocol — initially to vet agents paying on UPI, with cards and bill payments possibly later. Business Standard reported similar plans in July. Both reports rely on unnamed sources, NPCI has published no specification, and any launch would need approval from the Reserve Bank of India. Treat it as reported, not shipped.

That's fine. The direction is what matters, and the direction was visible across the whole festival. In his own lane, the chairman of India's securities regulator made the same move, saying an AI-generated alert should not automatically be treated as a regulatory finding. Same rule, different industry: the machine that notices something is not the machine that decides what it means.

Why a small business should care

Here's the uncomfortable part. Most small businesses are doing the exact opposite of what Choudhary described — and they're doing it by accident.

Look at where AI actually shows up in a ten-person company. A chat bot that answers the phone and books the job. A tool that drafts a quote and sends it. Software that reads vendor invoices and pays them. An assistant that replies to customers on its own.

Every one of those collapses deciding and doing into a single step. The agent decides the job is booked, and books it. It decides the invoice matches, and pays it. That works right up until it doesn't — and when it doesn't, you have no idea which part failed, because there's only one part.

That's the real risk. Not that AI is wrong often. That when it's wrong, you can't point to where the decision happened — so you can't fix it, correct it, or explain it to the customer.

Draw the line yourself

You don't need a regulator to hand you this. The same three-part split works in a business of any size:

• Intent — what does the customer actually want? This is where AI is genuinely excellent, and where you can turn it loose. It reads, listens, summarises, proposes.
• Authorisation — is this allowed? Amount, scope, policy, who signed off. This should be rules, not vibes. Anything over $500 comes to me. New customers get a callback. Refunds never auto-issue.
• Execution — do the thing, log the thing. Fast, automatic, and recorded so you can reconstruct it later.

The agent lives in intent. It can live in execution, inside limits. Authorisation is where you stay.

That's not a restriction on what AI can do for you. It's the thing that makes it safe to give AI more. A bounded agent can be trusted with real work. An unbounded one can only be trusted with a demo.

The question everyone will eventually ask

Every serious payments rail, every regulator, and — soon enough — every insurer and auditor is converging on the same question: when your agent acted, what was it allowed to do, and can you prove it?

The businesses that look smart in two years will be the ones that answered that question before anyone asked it. Not with a policy document. With architecture: a clean split between what a machine interprets, what it is permitted to execute, and who owns the decision.

That's the rule out of Mumbai. The payments part is India's problem. The rest is yours.

Armory Forge Systems builds AI workers for exactly that job — the phone, the quotes, the follow-up, the support, the books. Each one is a defined role with limits, an audit trail, and a human holding the decision. If you want the leverage without the liability, let's talk.