Customers are increasingly connecting AI assistants to their bank accounts, and many US banks are responding by restricting or blocking AI agent access altogether.
That caution is understandable, since an autonomous agent acting on a customer’s behalf at machine speed introduces real risk. Still, customers are already asking their assistants to build budgets, flag unusual charges, and compare savings rates, so the real question isn’t whether AI agents will touch bank data but whether they’ll come through a secure front door or a side window.
The same tension played out years ago, when data aggregators asked customers for their bank passwords and scraped their account data. Banks had good reason to worry then, but customers kept using the tools they wanted, and the answer turned out to be secure, consent-based connections like OAuth and APIs rather than blocking. AI agents need the same treatment, although because they act autonomously and can shift intent mid-task, they call for a tighter model built on zero trust.
Zero trust is a security approach built on a simple idea: never assume a request is safe, so every request has to be verified, tied to a purpose, and limited in time. Applied to agent-initiated data sharing, that principle translates into four requirements.
1. Verify the agent’s identity: An AI agent is software, which means the bank needs to know exactly which agent is making a request and where it is running, rather than treating it as a generic AI tool. Existing standards such as OAuth 2.1 and SPIFFE already give banks a way to register agents and verify them cryptographically on every call.
2. Get the customer’s clear approval: Standard OAuth scopes like read:accounts are too broad for autonomous agents, so banks should use rich authorization requests (RFC 9396) to limit consent to the exact task, including the data category, the transaction date range, and nothing beyond what’s needed. A customer reading the consent screen should come away knowing precisely what they agreed to.
3. Share only the data needed for the task: The agent should declare the specific task it is trying to accomplish, such as “calculate average monthly grocery spending for a budget,” and the bank should check that intent at the gateway or resource level so every API request matches what the customer approved. A budgeting task, for instance, has no reason to pull account numbers or full statements.
4. Limit how long access lasts: Once the agent is verified, it should receive short-lived, intent-based tokens that are bound to that specific agent, so a stolen token is useless to anyone else. Each token should expire as soon as the task is complete, so access never outlives its purpose.
With these controls in place, customers get the convenience they want while banks keep the control they need.
Zero trust for agents only works when it sits on top of a secure, API-based data-sharing foundation. If a bank’s customers are still handing their credentials to third parties, the bank already has limited visibility into who is accessing their data, and that blind spot will grow considerably once agentic AI goes mainstream. Closing that gap is exactly what Akoya was built to do.
Akoya’s Open Finance Solution is a full-service platform that sits between a financial institution and the broader data-sharing ecosystem, combining a standards-based technical platform with managed services. Here is how it lines up with the model described above:
Banks are already moving in this direction, connecting aggregators and third-party providers through secure APIs and reducing their reliance on credential-based access. That shift lays the groundwork for agent-initiated data sharing, too.
The infrastructure a bank builds for open finance today is the same one its customers’ AI agents will rely on tomorrow. Agents are already in customers’ hands, and banks that put verified identity, task-level consent, and short-lived access in place now will be in a far stronger position than those still debating whether to allow agents at all, since the banks that build a trusted path first will also help set the terms for everyone else. For a deeper look at this shift, read Your customers’ AI agents are coming. Will you be able to see them?