ING Allow Me: permissions in business banking

The problem

In ING Business every company transaction has to be approved according to permissions the company sets up itself: who signs, who approves and up to what amount. This applies to clients from one-person businesses to international corporations. In theory the process was self-service; in practice many clients needed help from an adviser, and for months it was one of the heaviest topics in customer service.

A ready-made template was not an option. For security reasons every permission has to be confirmed explicitly when a user is added.

What I did

We prepared the concept in August 2017 during the Innovation Bootcamp at ING, in a cross-functional team of 5 people. I was responsible for research, interaction design and prototype validation. We designed the full customer journey for the permission management processes. We checked our assumptions in interviews with clients, sketched the solution together and tested the prototype with company representatives.

What we learned

All the necessary functions already existed, but users did not know in what order to use them, especially in typical situations such as covering for an employee or adding a product. On top of that they were afraid of making a mistake, because a wrong decision could mean losing money and personal accountability.

The solution

• Help at the right moment: the system suggests setting up permissions when the user needs it, for example when trying to make a transfer above a limit.
• Plain language instead of procedural language: labels rewritten as questions users ask themselves ("who am I signing this transaction with?", "who can approve it?").
• Control stays with the user: the system guides them through the steps but does not decide for them.

Why it matters for AI

This is designing trust in high-stakes decisions: the user hands part of the work over to the system, but not the accountability. Every product with AI in it faces the same problem today.

What happened next

The concept did not go into production in this form. In the end ING implemented a permissions management module developed and imposed globally, at the level of the whole group. In a large organisation a global platform often decides the fate of local solutions, and the value of this project lies in understanding the problem and in the way of working.