So this week two of the biggest names in US finance said, more or less out loud, that they don’t want your AI agent anywhere near your money. Jamie Dimon said on JPMorgan’s third-quarter earnings call that the bank won’t let outside agents operate inside client accounts, as it’s too risky for the clients and for the bank. And Charles Schwab’s CEO, Rick Wurster, told Bloomberg that Schwab blocks dozens of agents every week trying to move client money, and that he gets a weekly report on it. (Citi and Bank of America are reportedly doing the same.)

My first reaction was “good”. My second one was a bit more nuanced, because buried in the Schwab story is the bit that actually matters for anyone building software right now, and it has very little to do with banking.

The Window and the Door

Here’s the thing: the agents being blocked are mostly getting in the old-fashioned way. They use the customer’s login and password, or they drive a browser and click around the website as if they were the customer. Schwab is specifically stopping that (credentials and browser automation), but it is happy to let outside AI tools read balances through controlled MCP servers, and it would rather clients use its own assistant for the rest.

Let me translate this for you: “please stop climbing in through the window with a copy of the customer’s keys, there’s a door over here, and the door has a bouncer”. And that is exactly the right answer. An agent that logs in with your password IS you, as far as the system can tell. It can do everything you can do, nobody can tell it apart from you in the logs, and the only way to cut it off is to change your password (which also cuts off you). An agent that comes through a proper door has its own identity, a limited set of things it’s allowed to do, a token that expires, and an off switch.

Now look at the other two agent stories of the same week. OpenCode disclosed that stolen API keys affected 1.4% of its Console users, with those keys then used for unauthorised charges (some of them report four-figure bills). And Workday agreed to buy C1 (ConductorOne) to manage access for people and AI agents. Three different companies, one theme: the hard problem with agents nowadays is identity, as in who the agent is and what it’s allowed to touch. The model is the easy bit.

I Had to Make This Call Too

I went through the same design question on Calendrz earlier this year, when I wanted people to be able to use it from Claude and ChatGPT. The quick option was an API key: generate one, paste it into the AI tool, done in an afternoon. Which is precisely the sort of long-lived secret that just bit those OpenCode users.

So instead Calendrz became an OAuth 2.1 authorisation server for its MCP server. You add it as a connector in Claude or ChatGPT, sign in with Google or Microsoft as usual, and the AI tool gets its own tokens: access tokens last 60 minutes, refresh tokens 30 days. The tools are marked as read-only or not, the Google and Microsoft tokens of your connected calendars never leave the server, and the endpoints that only make sense in a browser (adding a calendar account, paying for a plan) simply answer 403 to an agent. Was it more work than an API key? Bloody right it was! But the security model now fits in one sentence a user can understand: the assistant can read your calendar and press a few buttons, it never sees your passwords, and you can cut it off at any time.

Sure, But Isn’t This About Money?

Some analysts reckon the banks’ real worry is commercial: an agent that happily sweeps idle cash out of a low-interest account into something better is not great news for the bank’s interest income. I’ll give them that, there’s probably a bit of both in there. But commercial motive or not, the engineering answer doesn’t change, and it’s the same whether you run a bank or a two-person SaaS.

What I’d Do on Monday as a CTO

1. Find out how agents already get in. Look at your logs for headless browsers and logins that behave like scripts. Schwab’s CEO gets a weekly report; quite likely you don’t even know the number.
2. Split what agents can do into reading, changing and irreversible (moving money, deleting data, emailing customers). Reading is cheap to allow. Irreversible stuff needs a human in the loop, at least for now.
3. Build the door: OAuth, scopes, short-lived tokens, a separate identity per agent and a way to revoke it. If you expose an MCP server, the spec already asks for OAuth, so half the thinking has been done for you.
4. Treat every API key like cash in an envelope. Ask the team what the blast radius is if one leaks tomorrow, and whether there’s a spending limit on it. If the answer is “errr…”, you have your next sprint.

Bottom line: the agents are coming in, one way or another. You just get to choose whether it’s through a door you built or through a window you forgot to lock.