Major U.S. banks are detecting third-party AI agents operating inside customer accounts without the banks’ approval,Axios reported this morning. Some of those agents appear to be acting beyond their users’ instructions. Bank executives described the situation to Axios as horrifying, and the largest lenders are moving quickly: Morgan Stanley has begun blocking outside agents, and JPMorgan, Bank of America and Citi are restricting them.
Banks have always known that authenticated is not authorized. They have spent decades building controls on that principle: entitlements, transaction limits, step-up verification, fraud monitoring. But those controls were built for people. They assume that the person who logs in is the person acting, and that a person acts at human speed.
AI agents break both assumptions. Many sign in with credentials customers handed over themselves, then act inside the customer’s session with the same access the customer has. And they work at machine speed, around the clock.
Today’s controls ask whether the customer is allowed to do something. With a person at the keyboard, that was enough: the one asking and the one acting were the same. With an agent, the controls face a second question they were never built to ask. Did the customer actually ask for this? Too often, banks find out only after the fact.
That is the gap. The controls haven’t failed. They just can’t reliably tell the customer from the software holding the customer’s password.
Blocking agents, or limiting them to read-only access, is a sensible first move. It cannot be the last. Bank executives told Axios they know customers will keep using these agents, and the industry’s leaders are already asking the right questions. Brian Moynihan, Bank of America’s chief executive,has said a human should approve money leaving an account, and his bank is developing protocols for how agents interact with accounts and who is liable when one authorizes a payment. And the same Morgan Stanley now blocking outside agentsannounced in June that it would let corporate clients’ agents connect to its stock-plan platforms through an approved channel.
That isn’t a contradiction. It’s the model. The question is not whether to let agents in. It’s which door they use, and what they’re allowed to do once inside. Banks have done a version of this before, moving data aggregators off customers’ passwords and onto approved connections. Agents need the same move, for actions as well as data.
Making that move takes a new architecture built on in-the-moment micro-sanctions. Every action an agent attempts is checked at the moment it tries to act, against what the customer has authorized and what the action would do, by controls that sit outside the AI model. Governance moves from after the fact to before it. Each request faces four tests, three before it runs and one after:
- Identity. Who is acting, and on whose behalf? An agent should carry its own credentials, never the customer’s password.
- Authority. What has the customer actually permitted, within what limits, and for how long?
- Policy. Which business rules apply to this request?
- Proof. Was the action completed correctly, only once, and with a verifiable record?
The checks scale with the stakes. Seeing a balance requires a verified customer. Moving money requires limits the customer has set or the customer’s approval in the moment, along with fraud checks. Changing a password stays with the customer. The model proposes; the system authorizes.
I made a related argument this weekin response to Satya Nadella, whohas called for separating “the supply of intelligence from the authority over it.” The same principle shapes how we build at Netomi.
Banking is an early warning, not an isolated case. Last month, Amazon blocked Meta’s Muse agent from shopping its store. The next day, Shopify announced an agentic checkout for Muse through Shop Pay. From finance to retail, every enterprise now faces the same question: how to welcome legitimate AI agents without surrendering control.
Earlier this month, we completed a framework for exactly that question. Today we’re making it public. “Consumer AI Agents: Governing the New Interface Between Customers and Enterprises” is the full technical version of this argument: the controls, the reference architecture, the risk tiers and how to put them to work.
The customer can delegate the task. The enterprise cannot delegate accountability.
