Who gave the agent permission—and is that permission still valid?
That question anchored a recent fireside chat I moderated with Dewald Nolte, Entersekt’s Chief Product Strategy and Market Engagement Officer. We explored what happens when AI agents begin acting on a customer's behalf, how financial institutions can distinguish authorized activity from fraud, and where existing authentication capabilities can help.
The two main takeaways that stood out:
-
Preparing for agentic banking starts with proving what the customer authorized and recognizing when circumstances have changed.
-
The industry has useful foundations already. The challenge is extending them to support delegated authority that may remain active long after the customer’s initial approval.
Prove what the customer authorized, recognize when circumstances have changed
Many banking controls were designed around a familiar interaction: a person logs in, initiates an action, and authenticates when required. An AI agent complicates that model. When software uses a customer’s credentials from a new device or server, its activity can resemble account takeover—even when the customer deliberately authorized it.
What struck me was how difficult this could make decision-making for the fraud teams. Blocking the activity may frustrate a customer who wants the agent’s help. Allowing it without sufficient evidence may weaken defenses against attackers using similar techniques. The distinction becomes especially important when moving from research and administrative assistance to actions that move money. Comparing financial products is one thing. Adding a beneficiary or transferring funds introduces a different level of consequence.
Distinguish legitimate delegation from agent-driven fraud
One of the most useful distinctions Dewald made was between two challenges that often get bundled together.
-
Legitimate delegation occurs when a customer intentionally gives software authority to perform a task. Institutions need controls that establish who granted that authority, what it permits, how long it lasts, and how it can be withdrawn.
-
Agent-driven fraud involves criminals using AI to accelerate or scale familiar attacks, including account takeover and social engineering. A framework designed for cooperative, authorized agents will not make those attackers participate.
To me, this is where many conversations around agentic banking become oversimplified. Financial institutions need to address both. Treating every agent as an attacker can undermine useful customer experiences. Assuming every agent will follow an approved delegation framework leaves existing fraud paths exposed. Identifying automated activity can inform a risk decision.
But deciding whether an agent appears “good” or “bad” is a shaky basis for trust.
As Dewald explained, a sophisticated malicious agent may look as polished and consistent as a legitimate one. Appearance alone does not establish authority. His proposed approach was practical: detect automation, then demand proof of customer permission.
Manage permission over time
The discussion’s most consequential point concerned the gap between granting permission and using it. A customer might authorize an agent in March to purchase tickets when they become available in June. During that interval, the customer could lose a phone, reset credentials, experience an account compromise, or simply change their mind. A mandate’s expiration date helps define its permitted duration. It does not establish whether the customer’s original instruction remains appropriate under changed circumstances.
Dewald described this as consent becoming a state that institutions must manage over time. That calls for monitoring relevant changes, defining when renewed approval is needed, and making revocation effective. The practical question extends beyond whether permission was granted: does the institution still have enough evidence to rely on it for this action?
Preserve evidence throughout the delegation lifecycle
Agentic banking also raises difficult questions about what happens when a customer challenges an action. An institution may need to establish which agent received permission, the authorized scope and duration, and when and how the customer approved it. Those records will be important when investigating claims that an agent exceeded its instructions or continued acting after permission should have ended.
The circumstances surrounding approval also matter. An authenticated customer can still be deceived or coerced. Device intelligence, behavioral signals, and transaction context can help institutions assess that risk alongside the consent record. The discussion reinforced the importance of preserving evidence throughout the delegation lifecycle, from initial approval through subsequent actions and any changes to authority.
Extend existing foundations to support authority beyond the initial approval
One encouraging takeaway from the discussion was that financial institutions are not starting from scratch. Existing approaches in card authentication and open banking offer relevant experience with third-party access, scope, and customer approval. Agentic banking will require enhancements, particularly around ongoing permission, but institutions have a foundation to build on.
Use existing authentication capabilities to establish meaningful consent
Today, institutions can use existing authentication capabilities to seek approval for a specific action through a channel the agent does not control. For example, an institution could ask the customer to approve a new payee or transfer in their banking app on a trusted device. The approval should clearly explain the action being requested.
That independent connection to the customer is central to establishing meaningful consent. As mandate frameworks develop, proof of permission could include a cryptographically verifiable record of the authority granted to an agent.
Connect the capabilities that support trustworthy consent
Dewald’s advice was to connect the capabilities that support trustworthy consent today. That includes understanding customers’ trusted devices, developing useful behavioral profiles, and bringing authentication, fraud, and consent signals together.
Institutions also need a dependable way to reach customers independently of the agent and retain evidence tied to the action approved. For smaller banks and credit unions, shared intelligence and collaboration can extend those capabilities. Signals identified elsewhere can help a lean team recognize threats earlier.
The challenge is extending these foundations to support delegated authority that may remain active long after the customer’s initial approval: monitoring relevant changes, seeking renewed approval when needed, and making revocation effective. Because as delegation becomes more common, customers may authenticate less frequently while granting more consequential authority each time. Making those moments clear, secure, and provable will be essential to earning their trust.
What I ultimately took away from the discussion is that agentic banking is not primarily an AI problem. It’s a trust problem.
 |
👉 Watch the full fireside chat for the discussion and audience Q&A on agent mandates, customer consent, disputes, and the role of existing authentication capabilities. |
