On 1 September we led with OpenAI and Anthropic pushing agents behind your logins. On 12 October we asked who signs the RFI reply when Gemini's coworker agent gets an account of its own. This week the other side of that argument answered, and it is the side that holds the money.
On 13 October, on JPMorgan Chase's third-quarter earnings call, Jamie Dimon said the bank would not let outside agents act inside customer accounts. That same morning, American Express published an Intent Intelligence Framework that checks what a customer has authorised before an AI agent can make a payment. While one institution restricted access, the other set out a process for approving transactions.
If you run a client portal, a procurement system or a payment platform, this is your next 12 months. An agent will arrive with a valid login a real person handed over, and neither answer so far is 'let it in'.
What Dimon said, and what his CFO added
Business Insider's report of the call, which we read via syndication, has Dimon saying security worries are "heightened" with agents, "because you don't want rogue agents, and there could be thousands of them". The bank is building its own agentic tools for clients, he said, and then set out the interim position.
In the meantime, we're not going to allow just any outside agent to come in inside the company because that's just too risky for clients and for JPMorgan.
Jeremy Barnum, the bank's chief financial officer, added the practical detail. JPMorgan is already blocking agent access "to the extent that we're able to block those", he said, because the services doing it today rely on credential sharing and screen scraping. His verdict: "It's not secure." Dimon described a customer handing credentials to an agent as a "liability transfer" away from the bank. If your QS gives an agent a portal login, whatever it approves is on you, not the vendor.
Amex's gate: capture the intent before the agent spends
American Express took the route worth studying. Its press release describes a four-stage flow inside the Agentic Commerce Experiences (ACE) Developer Kit. A Create Intent API captures the customer's instructions and constraints, such as merchant, maximum budget and preferences, and the customer signs them off. The system issues an Intent ID and a Proof of Intent Token carrying those constraints. The token obtains a payment credential scoped to the intent, so the agent never sees the card number, and both travel with the transaction into authorisation, fraud checks and disputes.
Hannah Bozian, Amex's VP of Agentic Partnerships and Strategy, told TechCrunch's Sarah Perez why the ordering matters.
Our approach differs from the implementations of others in that it pulls intent earlier into the transaction flow. And this is important because it helps mitigate some risk before the risk occurs.
Her example: an agent told to buy white Nike trainers in a size 9 that orders Adidas instead gets stopped because the request no longer matches the signed intent. In our world, an agent told to call off rebar from a named supplier under £30k must fail if it picks another supplier at £31k.
Amex told TechCrunch it has not yet seen a rise in disputes from agentic commerce, and the release names no adopters, pricing or launch date.
Amazon got there first
GeekWire's Todd Bishop reported on 20 September that Amazon had cut off Meta's Muse agent from shopping on Amazon.com after Meta declined to remove Amazon from the experience.
Users saw a pop-up: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed." Amazon said Meta never told it Muse would access the store, that the agent does not identify itself while browsing, and that it appears to capture and store customer credentials. Meta's launch materials say Muse "has no visibility into people's passwords or payment methods".
The pattern across three weeks is the same. Agents push for access on the user's own credentials. Whoever carries the risk blocks them or demands they identify themselves and prove what they were told to do.
The evidence the gatekeepers are reading
The caution has a data trail, though part of it is months old. On 28 May Cyera researchers Ehud Halamish and Vladimir Tokarev published an analysis of 7,246 publicly reported AI incidents from September 2023 to May 2026. They verified 344 as relevant to the enterprise; in 188 of those, an autonomous system caused harm in production with no attacker anywhere in the chain. Cyera sells agent security tooling, so weigh the framing accordingly.
On governance, Deloitte's Gregory Vert, Brad Kreit and Abha Kulkarni wrote on 12 October that, according to Deloitte's 2026 State of AI in the Enterprise, only one in five surveyed companies has a mature governance model for autonomous agents, despite three-quarters planning to deploy them within two years.
Takeaway
The banks and card networks are writing the rules where money moves, choosing between a hard block and a signed statement of intent. Your tender portal and your payment approvals are smaller versions of the same choke point. Dimon's answer is cheap and blunt. Amex's is harder to build and far more useful, because it keeps a record of what the human actually authorised.
Decide now whether an agent may act on your client portal or procurement system at all, and write it into the access policy before someone shares a login.
Borrow the Amex shape for anything that commits money: a human signs a scoped instruction covering the supplier and cap before the agent runs, and the system rejects anything outside it.
Put credential sharing with personal agents on the risk register as a liability transfer, which is JPMorgan's own term.
We have tracked the agent-access question since 1 September, and the answers from banks and retailers are arriving faster than most project teams can write policy. The weekly Project Flux newsletter follows each one through to what it means on a UK job: sign up here.
Links and Stuff
All content reflects our personal views and is not intended as professional advice or to represent any organisation.
