Read-only is the new default: why banks are splitting “see” from “do” for AI agents

Read the October 2026 statements from US banks about AI agents side by side, and one pattern stands out. Almost nobody is banning agents outright. They are banning agents from doing things, while leaving them free to see things through approved channels.

• JPMorgan Chase blocks outside agents from logging in or acting on accounts, while supporting customer-authorised data sharing through open-banking providers, Fortune reported. Some third-party tools can view account data, but none can send money or pay bills, according to TNW.
• Citi does not let agents log in or transact, but customers can give read-only access to approved open-banking providers, it told USA TODAY.
• Charles Schwab blocks agents that use client credentials or browser automation, and plans read-only access for outside AI tools so they can check balances and do research but not move money (TNW). Its own assistant, Charley, will not be used to “move money, because we think there's too much risk there to the client and to the firm,” chief executive Rick Wurster said, as reported by American Banker.

This post looks at why the line falls where it does, and why it will not stay there.

Why reading is the easy half

Read access has a decade of infrastructure behind it. Data aggregators and open-banking connectors already let budgeting apps and lenders see balances and transactions with the customer's consent, using tokens scoped to reading. A bank can revoke them, audit them and see which app holds which permission. None of that requires the agent to hold the customer's password.

Reading also fails gently. If an agent misreads a balance, the customer gets bad advice. If an agent misfires on a transfer, the customer loses money. The asymmetry is the whole argument for the split.

The rulebook for read access in the US is itself unsettled. The CFPB's personal financial data rights rule under section 1033 was reopened for reconsideration in 2025 (Cooley), and its compliance dates are suspended while a federal court has enjoined enforcement, according to the Open Banking Tracker. Even so, the mechanics of read-only sharing are well understood. The mechanics of delegated action are not.

Why doing is the hard half

An agent that moves money needs three things a read connector does not:

1. Authority that is specific. “Pay my credit card bill each month, up to the statement balance” is a very different grant from “you have my login.”
2. A way to stop it. In a 2026 survey of more than 380 security professionals, only 17.5% said they could automatically stop an agent behaving unexpectedly in production, Campus Technology reported, and more than 40% of those who saw unexpected agent activity reported agents modifying or deleting data.
3. Evidence that the person agreed. When a payment is disputed, someone has to show that it came from inside the authority the customer gave, and that the customer was in control when it mattered.

Today's credential-sharing agents have none of the three. That is why the banks drew the line where they did.

The missing middle: act, with the person's approval

The interesting design work is happening in between. The draft Personal Agent Protocol, introduced in October 2026 with partners including several banks, describes the current state bluntly: “Today it is all or nothing: the company blocks the agent, or the agent signs in as the person and can do anything they can.” Its proposal is graded access, with scopes such as read and write, and a tier where the agent acts only with the user's approval.

That middle tier already exists in some products. In August 2026, the German broker Scalable Capital let customers trade through AI assistants, with each trade approved by the user and no ability to make payments or withdrawals, Fortune noted. The agent prepares; the person decides.

The pattern is old. A junior employee can draft a wire; a manager approves it. What is new is that the junior is software, and the approval has to happen in a browser or app where software can also click the approve button.

The weak point in “the person approves”

“Human in the loop” is only as strong as the evidence that a human was actually in the loop. If an agent can open the approval screen in the same browser session and press the button itself, the approval step is decoration. If the approval is a one-time code sent to email, and the agent can read the customer's email, it is decoration too. Ping Identity's chief executive made exactly this point to USA TODAY, saying email one-time passwords are no longer secure enough because agents often have access to email.

So the middle tier needs an approval step with two properties:

• It is tied to this action: this payee, this amount, now. An approval cannot be replayed for a different payment.
• It shows that a person, not software, was in control when the approval happened.

Passkeys give the first property and part of the second. Checking that a person is present at the moment of the action, without adding a puzzle, gives the rest. That second check is what HEIP is for.

What to expect next

Read-only is a sensible holding position, and banks will hold it for a while. But customers adopted agents to get things done, and “your agent can tell you that you are overdrawn but cannot move money to fix it” will not satisfy them for long. The banks that move first will be the ones that can answer, for every money-moving action an agent proposes, a simple question: did a person approve this, here, now?