Only making it a duet with rlcarey...
This is an issue of 1) state law and 2) contract law. Whether the person is called an agent, authorized signer, or convenience signer, there is no universal direction saying what they can and cannot do.
In any state where I've ever done a program, there are significant differences from bank to bank about what a person with these powers can do. The smartest approach is to spell it out in the document signed by the account owner(s).
Hint: I would make the grant of authority very broad; e.g. the equivalent of a general power of attorney over a specific account, so I did not have to police it.
"Compliance should not be compromised by revenue interests." FIN 2014-A007 Put that in your "risk based" pipe and smoke it.