Who Lets Your AI Agent In?

This week I was talking with the head of tax at a large firm, and he brought up something I hadn’t been watching. The companies that own the actual tax calculation engines are increasingly shutting off access for the AI tools built on top of them. Those are the tools that take in client documents, handle the input side, and push the return into the engine.

I haven’t seen a headline about it yet. But once I started looking, the same thing was happening everywhere else, and it was happening fast.

Six banks in two weeks

For two years the pitch for AI agents has been simple: give it your login and it’ll do the work. I call these tools harnesses. A harness sits between you and the systems you use, logs in, and does the work for you.

In October, the biggest banks in North America started answering that pitch:

• JPMorgan is keeping outside agents out for now. Jamie Dimon’s reason: “There’s a liability transfer.”
• Bank of America says no money leaves an account without a human approving it.
• Schwab is already blocking agents that use client passwords, “in the tens and twenties” every week. CEO Rick Wurster: “We can’t control it, the client can’t control it, something could go wrong and who’s liable?”
• Citi doesn’t want outside agents logging in or transacting directly, and Morgan Stanley is blocking them.
• RBC went furthest. It’s blocking third-party personal agents from online banking entirely, because they “cannot yet be trusted.”

It’s not just banks

The software businesses run on has been doing the same thing all year. In April, SAP changed its API policy so AI systems that “independently schedule or execute calls” can’t use its APIs on their own. If you want an agent in SAP, it goes through Joule, SAP’s own agent. In May, ServiceNow took a different route. Outside agents can come in, but they go through a layer called Action Fabric and pay for every action. A JPMorgan analyst called it a “tax” on using outside agents with your own data.

Meta banned general-purpose AI chatbots from WhatsApp’s business platform. Amazon took Perplexity to court over its shopping agent and won an injunction, then the Ninth Circuit overturned it. The court said that when an agent acts on a user’s instructions, it’s “the user, not Perplexity, who is accessing Amazon’s servers.” If that holds, companies can’t treat agents as intruders under the law. They have to use their own terms, technology and pricing instead.

Back in tax, the door was narrow to begin with. UltraTax, ProSeries and Drake have no public API, and Lacerte requires a developer license you request by form. Meanwhile Thomson Reuters just rebuilt CoCounsel as its own agent on top of UltraTax.

The five moves

Once you look for it, every company is making one or more of five moves:

• Block: you can’t come in. RBC, SAP’s policy, WhatsApp.
• Gate: you can come in through our door, with limits. Bank of America’s human approval.
• Toll: you can come in, and every action costs money. ServiceNow.
• Build our own: block yours, offer ours. Joule, CoCounsel.
• Shift the liability: let one in, and it’s on you. Wells Fargo’s updated online terms say requests made through a third-party AI tool “may be treated as if they came directly from you.”

Why they’re really doing it

Every one of these companies gives a security reason, and the reasons are real. Agents hold passwords, act without asking, and can move real money.

But there’s a second reason: whoever owns the interface owns the customer. If you bank through someone else’s agent, you stop opening the bank’s app and you stop seeing its offers. The bank becomes plumbing, and plumbing gets swapped out when a cheaper option shows up. And per-seat pricing breaks when one agent does the work of many seats.

We’ve seen this before. Budgeting apps like Mint asked for your bank password and scraped the screen. Banks didn’t like it for the same two reasons, and it ended with bank-led connections. AI agents are the new screen scrapers, except they don’t just read your balance. They move money and file returns.

What to do about it

First, before you buy any AI tool that works inside a system you don’t own, ask how it gets in. Is it an official, contracted connection, or your firm’s login and a workaround? What happens if the engine owner cuts it off six months from now? Picture a tax harness you’re paying for getting cut off in February, in the middle of busy season.

Second, look at your own accounts. If someone on your team connects a personal agent to a company account and the bank treats that agent as you, the loss is yours. This isn’t settled yet, but it’s the direction the banks want it to go.

Key takeaways

• The companies that own the systems are pushing back on outside AI agents: banks, ERP vendors, platforms and tax engines.
• Watch for five moves: block, gate, toll, build their own, and shift the liability.
• The stated reason is security. The business reason is that whoever owns the interface owns the customer.
• An AI tool is only as durable as its access path. Find out how it gets in before you build a process around it.
• If an agent acts with your credentials, expect it to be treated as you.

Want the CPE credit? Take the full lesson on EverydayCPE and earn 0.2 CPE credits: Who Lets Your AI Agent In?.