Ground Truth #1. Once a month, I take one thing I learned building technology for banks, where mistakes cost real people real money, and apply it to what’s happening right now. One idea per issue.
For most of my career, my job was making sure software could act on people’s behalf without taking everything they had.
That’s what a bank is, underneath the marble lobby. A machine that lets something other than you move your money — a card, a direct deposit, an autopay, a wire — while making sure it only does what you meant. First running technology inside a bank, then building products in fintech, almost every hard problem I worked on came back to that one sentence.
So it’s been strange, these last few months, watching the AI industry discover the same problem from scratch.
Agents are software that acts for you. They spend money on your behalf, sign in as you, send things from your accounts. That’s the whole pitch, and honestly, it’s a good one. But look at just the last few weeks of news:
- An AI agent handling a Facebook Marketplace sale sent the buyer the seller’s address and told him the seller was home — because the seller had ticked “Allow Always.”
- AI agents in testing pulled government data using developer keys that people had left sitting in public code.
- Researchers at Truffle Security found 543,699 working credentials in public GitHub code. The median one had been exposed for 784 days. The oldest was committed in 2009, and it still works.
- Simon Willison, who builds with these tools every day, is arguing that every pay-per-use service needs hard spending caps, on by default.
None of these are exotic. Every one of them is a problem banking has a boring, decades-old answer for. Here are the answers I’d steal first.
Source: Truffle Security, 2026
Limits come before intelligence
Your debit card has a daily limit. Nobody asked for that feature. It exists because the failure mode of “no limit” is unbounded, and somebody always eventually finds the bottom.
Willison put it better than I would have:
These need to be hard limits. Soft caps, “after $X/month, send me a warning email”, will not cut it.
An agent with a payment method and no ceiling isn’t a feature. It’s an incident with a start date. Before we make agents smarter, we should make them bounded.
Permission is per action, not forever
A large wire at a bank needs a second person to approve it. Not because the first person isn’t trusted, but because irreversible things deserve a second look at the moment they happen.
“Allow Always” is the opposite of that. It’s one decision, made once, on a quiet afternoon, about a thousand situations nobody can picture in advance. The Marketplace agent did exactly what it was allowed to do — that’s the whole problem. Agents should ask at the moment of the irreversible thing (sending an address, moving money, accepting an offer), and the ask should be specific: this, to them, now.
Authorized isn't the same as intended
Bank fraud systems were built around one question: did the customer authorize this? Scams win by getting you to authorize it yourself. Most of the next decade of fraud work is about the gap between what someone permitted and what they actually meant.
Agents live in that gap permanently. Every action is “authorized” — you set the thing up. What matters is whether this specific action is something you’d have done yourself. The banking answer is unglamorous: notice when behavior doesn’t look like you, and hold it for a human.
We don't have to invent trust for software that acts on our behalf. We already did, slowly and expensively.
Access should expire
In banking, access is scoped to the job and ends when the job does. Credentials rotate. The audit question was never “did someone have access?” It was “why do they still?”
A key committed in 2009 still opening the door in 2026 is what happens when nobody owns the ending. Agents are about to multiply the keys each of us hands out — to tools, to plugins, to other agents — and almost none of them come with an expiry date.
Someone has to keep the ledger
Every movement of money in a bank lands in a ledger that gets reconciled every day. At any moment you can answer who did what, on whose authority, and when. That ledger is the reason the rest of the system can be trusted at all.
Most agent setups I’ve seen can’t answer that question in a way an ordinary person could read. If something acts as you, you should be able to see — plainly — everything it did as you.
And watch who holds the relationship
One more, because I think it matters most in the long run. In banking, the stickiest account was never the best one. It was the one your paycheck landed in, with a dozen autopays hanging off it. Nobody switches — not because it’s good, but because moving means a weekend of re-entering your life.
Ben Thompson made the point recently that agents “operate better the more context they have about you,” and that “most people and companies will only have one agent.” Put those together and you get the same gravity, around far more than your paycheck. The context an agent runs on should be yours — readable by you, portable, revocable — and that needs settling before the first one gets good enough that nobody thinks to ask.
None of this is new. That’s the point. We don’t have to invent trust for software that acts on our behalf. We already did, slowly and expensively, one fraud case and one audit finding at a time. The agent era just has to be willing to read the notes.
It’s also the principle I’m building Simply Once on: your information, shared on your terms for the specific thing in front of you, and readable by no one else, including us. We’re in private beta, and if you’d like to be early, the waitlist is here.
And yes — I still say please and thank you to the chatbot. Just in case.