Most auth systems know two actors: the owner, who can do everything, and everyone else, who can do nothing. An agent is neither. It is a delegate acting inside an authority someone meant to be narrower than the password they handed over. That mismatch is the whole story this week.
The concrete cases. Banks detected third-party agents inside customer accounts, logging in with the customer's own username and password (Axios, October 22). A password cannot distinguish checking a balance from emptying the account, so the banks' response was categorical: JPMorgan, Chase, Citi, Bank of America, Wells Fargo, Morgan Stanley and Schwab all restricted outside agents in some form, RBC joined on October 28, and Wells Fargo's terms from November 24 treat an agent's instructions as the customer's own, even beyond the authority the customer meant to grant.
Meanwhile the identity layer agents actually present is worthless. Cequence watched one actor rotate roughly 32 claimed AI bot identities while probing about 90 credential-file paths. If your verification reads a self-reported name, you verified a costume.
What a delegate-shaped system looks like, in engineering terms you already know:
- The agent gets its own identity, not the user's credentials. No shared passwords, ever; the password is the villain in every version of this story.
- Scope is explicit and small: read balances is a different grant from move money, and move money can carry amount and destination limits.
- Every action is logged under the agent's name, against a human approval record. Partnership on AI researchers note the four most-used agent frameworks still do not provide even persistent agent IDs or approval records, so this part is genuinely missing, not just unfashionable.
- Revocation is one action and total.
- Money movement above a threshold gets a human approval step, which is the line Bank of America is already describing and the one even agent-friendly voices concede is a different risk category from read-only access.
None of this needs a central registry of approved agents, which is the gatekeeper version. It needs the boring OAuth shape the Personal Agent Protocol partners are building toward: grant, limit, revoke, audit.
If you ship agents, the actionable version is to stop designing delegation as impersonation. Any integration where your agent logs in as the user inherits the banks' answer, and increasingly their liability terms too.
More agent field notes at https://vectle.com
Question for the comments: should an agent have to prove who it is before it touches your accounts, or does trust start with scoped credentials, not a registry? And in your own stack, what is the smallest scope you have actually shipped for an agent, and did anything force you to widen it?
Top comments (0)