Field notes

The banks are blocking AI agents. I let one in.

Last week, American banks started throwing AI agents out of their customers’ accounts. A few days before that, I had given one the keys to my company’s books. This is what happened next, and what I would want to know if I had to sign for an agent like that.

Kind

Founder report

Status

Working

Published

27 October 2026

Revised

27 October 2026

Reading time

About 10 min

This story went wrong before it went right.

The news

On 22 October, Axios reported that the biggest banks in the United States had found AI agents inside customer accounts. Nobody had hacked anything. People had simply given their online banking login to a personal AI assistant, the way you might give it to a spouse, and the assistant had logged in and started doing things. Looking at balances. Phoning the bank’s call centre, without asking the customer first.

The banks were not amused. The big banks are blocking or restricting these agents. Jamie Dimon, who runs JPMorgan, said on his earnings call that he will not let just any outside agent operate inside his systems. The former White House AI adviser, David Sacks, suggested a compromise, at least for now: let the agents in, but read-only. They may look. They may not touch.

I read all this with a slightly uncomfortable feeling, because a few days earlier I had done exactly what those customers did. Only I did it with my company’s money.

The bookkeeper left

Our part-time bookkeeper found a full-time job. I was happy for her and worried for us.

By the time I opened the accounting software myself, 353 bank transactions were waiting to be matched to something. Sixty-six of them were bank fees nobody had booked. Thirty-nine draft bills sat in the inbox, and fifteen of those were empty or duplicates. The accountant needed clean books. I had neither the person nor the time to produce them.

So one evening I did what I do with most problems these days: I wrote a brief for an AI agent. It was short. See everything in the books and the bank feed. Match the payments to the bills. Book the recurring charges that never come with an invoice. Never send anything. Never create an invoice. Never move money. And make all of this impossible, not just forbidden. I wanted the limits in the machinery, not in a sentence the agent might one day misread.

What I had in mind was a small key. A user in the bookkeeping system that could read everything and change almost nothing. The kind of access you would give an intern on their first day.

There is no small key

Here is the first thing I learned, and I learned it within the hour.

Our bookkeeping software does not make small keys. To let a program talk to it, you need an admin user, and an admin can do everything I can do. So the agent got an admin user. I named it after itself, which felt orderly at the time, and I put its key where the agent could reach it.

Then I thought about what “everything I can do” actually means in that software.

It is connected to our bank account. Every transaction lands in it the day it happens. And from inside it, I can make transfers. I had written “never move money” in my brief, read it twice, and felt quite responsible. And then I had handed a machine the one key in the company that moves money, and that sends our customers their invoices, bank details included.

I would like to tell you I spotted this in the planning. I did not. I spotted it afterwards, sitting in front of the screen, with the key already in place.

The AI was not the problem. It had done nothing wrong all evening. The problem was the key. A key does not read briefs. If the agent one day mistook a line in a supplier’s invoice for an instruction, the key would not stop it. If the key ever left my computer, my brief would be worth nothing at all. I think this is what the banks woke up to last week: not rogue agents, but ordinary agents holding keys that were never cut for them.

I could have stopped there. Deleted the user, gone back to clicking through 353 transactions myself. I did not, and the reason was not courage. The boundary had to be built somewhere, and the vendor was not going to build it. If nobody will cut you a smaller key, you cut it yourself, in your own code, between the agent and the key. And you write down that you did.

The lock

So that night, with an AI building beside me, we made a lock.

It is a piece of software that sits between the agent and the key. Everything the agent wants to do in the books has to pass through it, and it is the only path there is.

The software knows a short list of doors. Twenty-one of them. Thirteen are for looking: show me the bank transactions, show me the open bills, show me who owes us what. Eight are for doing, and each one is narrow: link this bank transaction to that bill, turn a draft into a booked bill, undo what you did a moment ago. There is no door for paying. No door for transferring. No door for sending anything to a customer, or for deleting something a person booked. Those doors do not exist, so the agent cannot try them, and it cannot ask nicely either.

Then we did something that still feels like the most important hour of the night. We wrote a test that checks the list of doors every time the software is changed. If anyone, including me, including a future agent, ever adds a door whose name contains “payment” or “transfer”, the test fails and the new version refuses to be built. A rule in a brief is a promise. This is a wall.

Before the agent goes through any of the eight, the software looks at the books first and refuses if something does not fit. Money going the wrong direction. An amount bigger than what is owed. A bill a person has already touched. The refusal says why, in plain words, and the agent’s instructions tell it that a refusal is an answer, not an obstacle to get around.

Every change the agent makes is written down, with the state before and after, and every change can be undone or rebuilt. We did not build a single doing-door before we had proven its undo on real data. The very first thing ever written to our real books by a machine was a domain bill for 19.03 euros, matched to its bank transaction and unmatched again within the minute, with me watching like a parent at a swimming lesson.

One more thing. The agent needs to see salary payments, because reconciling payroll is part of the job. It does not need to see names. So the software replaces each employee’s name with a tag, something like “employee-3f2a”, the same tag for the same person every month. The agent can follow a salary across the year. It never learns whose it is.

BCG has a line I keep coming back to: the agent is the easy part. It was. Setting up the agent took an hour. The lock, the plumbing and the proofs took the rest of the night.

The second reader

By morning it worked, and I was ready to call it done. Then I did something I would recommend to anyone building anything with an AI: I gave the code to a second AI that had not been in the room. No history, no explanations, none of my conclusions. Just the code and one question: what is wrong with this?

Twenty findings in ten minutes. Two of them were real holes. One of the doors could be used to mark a supplier’s bill as paid with money that had come in from a customer. And undoing one kind of change could delete a bill a person had since reused. Both holes sat exactly where I had “proven” the system worked a few hours earlier, on one example, feeling pleased with myself.

Proof on one case makes you confident far beyond that case; a reader who did not build the thing finds the gap in ten minutes.

Then the agent went to work for real. Its first proper match was a payroll tax payment. A few hours later came the number I had been waiting for: the revenue in our books matched the accountant’s figures to the cent.

Why read-only is the wrong answer

Back to the banks.

Sacks’s compromise, let them look but not touch, sounds careful. For your own bank account it may even be fine. Most people want an assistant to tell them something, not to do something.

But that is not where agents are going. The big bookkeeping and finance products are putting agents into companies’ books right now (QuickBooks and Ramp already have; the rest will follow), and in a company, the work is in the doing. Matching payments, booking bills, closing the month, chasing what is missing. All of it is writing to the books. A finance agent that is only allowed to look is a dashboard with good manners. Read-only does not make it safe. It makes it useless, and a useless agent pushes people straight back to the thing the banks are angry about: handing over the full login, so the agent can finally do something.

In the United States that login is a different risk for a company than for a person. A consumer who loses money to an unauthorised transfer has Regulation E behind them, with its liability tiers, and even there it is not settled whether a transfer your own agent made counts. A business account generally has no such cover: a payment the bank processed by the agreed security procedure can bind you, agent or not. The banks’ problem is really a business problem.

What I would wish for instead is the key I could not buy. Narrow doors. Each one with a record and an undo. A test that proves the big doors are not there. And a person’s name on the whole thing.

If you are the person who signs for an agent, here is the one tool I would hand you. For every job the agent does, write down three things, in three separate columns. What you authorised. What the key can technically do. What the agent has actually done so far. The first column is your brief. The second is the key. The gap between them is where your risk lives, and nobody will point it out for you, because the first column is what every demo shows. The customers in last week’s news authorised column one and handed over column two. So did I, for one evening.

The banks are right to be scared. I think they are wrong about the fix. Read-only is a key cut for looking. The fix is a key cut for the work people actually want done, with the limits in the key, not in a promise. That key is theirs to build.

What I still don’t love

I am trained as an auditor for AI management systems, so I did what I would make a client do and assessed the whole thing against the standard for it, ISO/IEC 42001. The gaps were not in the code. They were around it: what the AI gets to see, the terms with the company that runs it, instructions living in chat threads with no version number, and the plain fact that when the model is updated, the agent’s judgement changes while its doors stay the same. I had spent the night on the code, and the code was the part that was fine.

One correction stays with me. The first draft of the system description listed me as a component, in the same table as the model and the bookkeeping system. I struck myself out. A person is not a part of the system. A person has a role, with moments where they look and moments where they sign. The agent can be given the work of keeping the books. It cannot be given the accountability for them. When something is wrong, the accountant and the tax office will come to me, not to it.

The key is still a master key, on one computer, written down as a risk I accept and will look at again in April. I still don’t love it. And I have no test for the agent’s judgement yet. If you know a better way to test how an agent decides, I would like to hear it.

For the person who signs

I have turned that assessment into something you can use: a Banking Agent Assessment, free on nullfte.com, in an EU and a US edition. A one-page decision sheet for one agent, a longer workbook for larger or regulated organisations, a risk register, the controls and the test scenarios, pre-filled as a starting point. For every control it asks one question: is this set at the bank, or is the agent only told? Take it, change it, tell me what is missing.

And if you are one of the customers in last week’s news rather than a company, there is a short checklist for your own account on the same page.

If you keep one line from all this, keep this one. The boundary sits where you can enforce it, not where you would like it to be.