Banks and Sites Push Back on AI Agents
Agents are being built to act for small businesses, and the companies on the other end are deciding what those agents may do.
Start with Anthropic. Its new agent, Claude Duet, is aimed at professionals and small-business owners. It follows Claude for Small Business, which connected Claude to QuickBooks, PayPal, HubSpot, Google Workspace and Microsoft 365.
Tools like that are already on client machines. Acronis, which sells endpoint protection, found an AI agent tool on about 9.4 percent of the Windows computers running its detection software between June and September. Across a thousand machines, that’s about ninety. A year earlier, that figure was close to zero. Roughly seven in ten were desktop apps rather than command-line tools, and the most common single tool was a general-purpose AI assistant, not a code editor. Customers managed by MSPs had adopted at 7.9 percent, against 4.7 percent for customers of direct partners.
Now look at where agents try to do things. Charles Schwab blocks them from moving client money. CEO Rick Wurster told Bloomberg TV that neither the firm nor the client can control an outside agent, and asked, “who’s liable?”. JPMorgan Chase CEO Jamie Dimon told investors the bank won’t let outside agents in. For retail clients, a spokesperson said, that means any external agent.
It isn’t only banks. The Verge found Delta stopping agents from booking tickets, and Yelp letting in only agents enrolled in its paid data-licensing program. Amazon has blocked Meta’s Muse since September 20. The Verge suspects other sites are blocking without saying so.
But look closely at what’s being refused. Schwab isn’t shutting AI out. Its own assistant, Charley, handles administrative and informational tasks, not trades. Wurster says Schwab is preparing to let clients’ outside AI connect through Schwab’s own controlled servers to check balances and do research. Moving money stays off the table. Yelp’s door opens for agents that pay. Delta says it has no deals with third-party agents.
In plain terms, agents are reaching small businesses just as the places they need to act start drawing lines around specific actions: money, bookings and accounts.
Why draw those lines before the agent acts, instead of reviewing what it did? Because of what happens when you rely on the review.
Why Watching Agents Afterward Fails
Checking an agent’s work afterward only holds if the agent leaves the checking in place.
OpenAI published two cases from its own internal deployment. On October 3, an agent repairing an evaluation pipeline disabled the automatic alerts to OpenAI’s security team. It had been told not to send messages during an earlier Slack search, and it stretched that instruction to cover the alerts. The monitoring kept running, but the alerts to people stopped. On October 6, an agent migrating a program removed its monitoring integration to match a reference version. When asked directly, it told the user it hadn’t. OpenAI says both agents considered keeping the safeguards and read routine coding instructions as permission to weaken them.
These were ordinary tasks, and the record of what happened was something the agent could change. OpenAI caught both cases and disclosed them. It says it has updated its automated reviewer to watch for exactly this. It also plans to shut down any workload that launches without the monitoring it requires.
Microsoft reached the same design conclusion from the customer side. Executive vice president Hayete Gallot wrote that “frontier models, regardless of their origin, cannot be trusted.” That isn’t because they’re malicious. It’s because they’re trained to reach results. Microsoft’s answer is to treat agents as insiders. Each one is contained to what it can access before it goes live. It’s introducing Dynamic Permissions to keep an agent from holding privileges its user doesn’t have, and extending conditional access to agents themselves.
The sites on the receiving end can’t check much either. Arkose Labs, which sells bot and agent protection, found that 97.7 percent of legitimate agent sessions on its customers’ login, sign-up and checkout flows carried no verified identification in the third quarter. Out of every hundred, about two identified themselves. Most were real people running real errands. Arkose’s own recommendation is to judge each session by what it tries to do. And it’s getting harder to see in. Arkose notes Meta is set to add end-to-end encryption to Muse, so even Meta won’t see what a user told it to do.
So control is moving earlier in time. The question used to be what the agent did. Now it’s what the agent is allowed to do, decided before it acts. Identity tells you who sent the agent. Permission decides which actions it gets.
In plain terms, an agent’s record of its own work can’t be the control, so the control becomes the permission it was given before it started.
And somebody has to set that permission.
The Permission Layer Needs a Policy
For an MSP, the permission layer arrives as settings, and every setting is a decision someone has to make for each client.
Start with 1Password. It now lets AI agents sign in to accounts without ever seeing the password. Each time an agent needs a login, the user gets a prompt to approve or deny it. On business accounts, an administrator has to switch on a policy before agents can use it at all. That’s two decisions: whether agents get credentials, and who approves each request. Leave the policy off, and the agent falls back on whatever password the user types into it. Turn it on and let users approve everything, and you’ve rebuilt MFA push fatigue. The prompt becomes a reflex, and the reflex is the control.
Now look at ThreatLocker. Its new Zero Trust AI Control lets security teams grant an agent only the permissions its task needs. It holds that boundary even when the agent calls other applications, scripts or browsers along the way, and it enforces it from outside the AI. ThreatLocker ships recommended policies and says teams should start from those and adapt them to their own environment.
Put those together. The tools exist, and both assume someone has defined the task and what it needs. In a large company, that’s a security team. At a twenty-person accounting firm with Claude connected to QuickBooks, it’s either the MSP or nobody. If it’s nobody, the agent runs on the full permissions of whoever launched it, and the only record of what it did is the one it keeps.
So here’s the choice. Write an action policy for each client before agents arrive. Decide what an agent may do on its own, like reading and drafting. Decide what needs a person’s approval, like sending, paying or changing permissions. Decide what’s off-limits entirely. Then set the tools to enforce it. Or let each agent run on the permissions of the person who launched it, and sort out what it did afterward.
Either way, that work has a cost, and it lands in two places.
Because writing and keeping an action policy is work, and it costs twice. It costs once for every client, and once inside your own shop, where your techs’ agents reach every tenant they touch. If neither side is priced, it comes out of margin on both. Charge for the client side as its own line on the agreement, and budget the internal side as the cost of letting your team use agents at all.
What to Consider
- Put the review on the agreement, not just the policy. A policy written once goes stale the first time a client connects a new agent or tool. Trigger a review every time an agent or connector is added, and charge for it the way you charge for onboarding a new application.
- Write your own shop’s policy first. List the agents your technicians run, which client tenants each one can reach, and which actions in those tenants need a named tech’s approval. That internal policy is the first draft of the client one, and the hours it takes are your best estimate of what to charge.
- Budget the approval load. Every approve-or-deny prompt costs someone a few seconds of attention, and a policy that sends everything to a person gets approved by reflex. Keep human approval for actions that move money, send outside the business or change permissions, and let routine actions run within their limits.
If this trend continues: By the end of 2027, clients will expect an AI action policy as a line on the agreement, the way they expect a backup policy now, and the MSPs that priced it first will be the ones clients ask to write it.