The banking split strategy
The institutions defining the future of agentic commerce are currently pursuing two contradictory paths. On one side, they are building open standards for agent access. On the other, they are erecting walls to lock those same agents out. Some names appear on both lists. Bank of America and Wells Fargo sit on the roster for the Personal Agent Protocol and on the list of firms restricting third-party AI access. This is not a disagreement between banks. It is a split running through the center of individual institutions.
The protocol roadmap
The Personal Agent Protocol, or Poppy, aims to move the industry away from an all-or-nothing access model. Its October 6 announcement from Sierra and Meta describes a spectrum of permissions: blocked, search-only, view-account, act-with-approval, and full access. The spec site puts the problem plainly: “Today it is all or nothing: the company blocks the agent, or the agent signs in as the person and can do anything they can.” The protocol relies on discovery via a well-known JSON document, standard OAuth sign-in, and short-lived session tokens. It is a draft, and the authors are working with design partners to reach version 1.0.
Payments remain conspicuously absent from the core specification. The same announcement says “Payments extensions could let a personal agent complete a purchase without sharing credit card information,” and that extension is deferred. Commercialization remains gated by governance, as noted in previous coverage. For now, Sierra and Stripe are shipping phone-channel card payments while the deferred payments extension stays a roadmap sentence.
The production reality
While the protocol was being drafted, the production reality shifted toward exclusion. Between October 13 and October 16, JPMorgan Chase, Bank of America, Citi, Schwab, and Wells Fargo moved to restrict third-party AI agents from accessing customer accounts, as detailed in our report on the bank lockouts. JPMorgan CEO Jamie Dimon on the bank’s Q3 call: “You don’t want rogue agents, and it could be thousands of them.” Bank of America, which restricted access on October 14, put its principle plainly: “We strongly believe there should be a human in the loop to authorise money moving out of your account.” Schwab CEO Rick Wurster said the firm blocks agents “in the tens and twenties” each week and asked “who’s liable?”
The protocol side surfaced in the same days. American Banker reported October 15 that Bank of America, BBVA, Synchrony, and Wells Fargo had joined the Personal Agent Protocol, describing them as a small group of banks exploring the framework. That is private ordering filling a statutory void, and the overlap is the story: two of the banks writing the standard are the same ones walling the door.
The November test
Wells Fargo chose a third path. Its updated Online Access Agreement, effective November 24, deems agent transactions “initiated and authorized directly by you, without further verification” and states: “Your use of any AI Agent is AT YOUR OWN RISK.” The contract takes effect three days before Black Friday, November 27. Blocking would have been simpler to explain.
Mastercard, meanwhile, is building the payment side. It opened early access for Agent Pay for Machines this week at Cloudflare Connect, with the first buyer- and seller-side API specifications, a developer toolkit, and a sandbox. The secondary coverage of the launch describes the Verifiable Intent credentialing framework behind the June debut. The signup host itself answers with a login wall, so the specs remain vendor-reported rather than publicly readable.
The industry is currently caught between two speeds. The protocol is a roadmap for agent identity and structured access, still in the design phase. The lockout is the production reality. November forces the collision: agentic convenience arriving into holiday volume, and a liability regime that has already decided who pays when it goes wrong.