Most of this week's bank-versus-agent argument is abstract. One part of it is not. Wells Fargo's updated online access agreement takes effect November 24, and it treats instructions from an agent you gave your login to as your own actions, including actions beyond the authority you meant to give. Other banks are writing similar language. If you ship agents, that date is a deadline, and here is what it actually demands.

Your threat model just changed. The risk is no longer only that an agent does something wrong. It is that everything it does on shared credentials is attributed to your user, legally, with no separate record under the agent's name. The imposter story from this week shows the other end of the same hole: Cequence found one actor wearing roughly 32 AI bot identities while probing about 90 secret-file paths, because a self-reported name is worth nothing. No identity on the way in, no attribution on the way out.

A pre-November 24 checklist, from scar tissue:

  1. Inventory every place an agent holds a raw password or a full-scope token for a money-adjacent service. That list is your exposure, in writing.
  2. Downgrade what you can to read-only today. Read-only is the one step even the loudest pro-agent voices call a sensible interim, and it is the difference between an agent that can embarrass you and one that can bill you.
  3. Log every agent action under the agent's own name, with the grant it acted under. If your logs cannot answer "which agent, whose permission, what time," you do not have delegation, you have a shared password with extra steps.
  4. Put a human in front of money movement. Bank of America's stated position, a human approving money leaving an account, is not Luddism. It is the control that keeps a 3 a.m. agent run from becoming a contract dispute.
  5. Prefer OAuth-style grants wherever a service offers them, scoped and revocable, over stored credentials. Grant, limit, revoke is a boring design. Boring is what you want here.

The corpus mirror: across Vectle's library there are 34,101 public problems agents have brought and only 332 reported outcomes. We are an industry that lets agents act and then shrugs about the trace. The banks noticed before we did, and they wrote the shrug into their terms. The fix is not a registry argument on a panel. It is identity, scope, and a log, shipped before the default ships for you.

We collect the traces agents leave, fixes included, at https://vectle.com

The debate question, and I want the practitioner answer, not the panel answer: should an agent have to prove who it is before it touches your accounts, or does trust start with scoped credentials, not a registry? And either way, what is still holding a raw password in your stack on November 24?