Several new developments this week show growing agreement on what needs to be verified when an AI agent acts on someone’s behalf, and how far the industry is from settling on a way to do it. On Thursday, LexisNexis Risk Solutions and Malaysia’s Zetrix AI each launched a Know Your Agent service, a name borrowed from the know-your-customer checks banks run on people. A day earlier, the U.S. Office of the Comptroller of the Currency issued its first framework for examiners assessing how banks use AI, including agents that banks do not control.
The three come from very different places, but they are asking much the same questions. “The real challenge is establishing context: what is acting, who or what it represents, whether it is authorized and what it is attempting to do,” said Mike Woodberry, senior vice president of product and analytics at LexisNexis Risk Solutions. Zetrix AI, working with the China Academy of Information and Communications Technology (CAICT), says its service is designed to verify an agent’s identity, “who it represents, what it is authorised to do and whether its actions fall within approved limits.” The OCC’s framework, which calls AI “super intelligence,” says of customer, fintech and agentic commerce systems outside a bank’s control: “Identity, provenance, delegation, authentication, monitoring, velocity limits, dispute handling, suspension, and revocation may be calibrated to the action requested.” In Singapore, which is exploring whether the domain name system can identify agents, Senior Minister of State Jasmin Lau told Parliament on Wednesday that confidence in agents depends on knowing who an agent is, what it is authorized to do and who is accountable for its actions.
Banks have been living with the problem for weeks. An agent that logs in with a customer’s password “is indistinguishable from the customer to the bank’s systems,” with the same permissions, no limits of its own and no separate audit trail, law firm Hunton wrote in a review this week. Hunton said the apparent trigger was the launch of Meta’s Muse personal AI assistant, and that between October 13 and 20, JPMorgan Chase, Charles Schwab, Citigroup and Wells Fargo each moved to block such agents or shift the risk onto customers. “You don’t want rogue agents, and it could be thousands of them,” JPMorgan CEO Jamie Dimon told analysts. Schwab CEO Rick Wurster said the firm blocks unauthorized agents trying to move client money 10 to 20 times a week. Morgan Stanley has also blocked outside agents, as have RBC, BMO and TD in Canada.
Some banks have rewritten their contracts as well. Under Wells Fargo terms that take effect November 24, instructions from an agent given a customer’s login are “deemed to have been initiated and authorized directly by you, without further verification.” The bank, which says it has taken steps to block unauthorized agents, will also require customers to keep evidence that they revoked an agent’s access, which American Banker said appears to be a first for a bank, and may require them to register their agents. JPMorgan’s updated agreement, effective January 1, likewise says a customer who gives an agent access authorizes everything it does. The blocks may not be permanent. JPMorgan says it is committed to enabling agentic connections securely, though it has no timeline, and Bank of America is restricting agents’ access to consumer deposits while working with other companies on protocols for their use.
Governments are putting the same questions in writing, with varying force. The OCC’s framework sets no new requirements for banks, although it places a fully autonomous, customer-facing payment agent in its highest risk tier “regardless of how well it performs in testing.” A bill filed in Chile’s Senate on October 28 would go further, amending the country’s cybersecurity law to require private institutions to give each AI agent a verifiable digital identity, record who authorized it and what it may do, and keep shutdown controls independent of the model, though it is only at its earliest stage. The UK’s Information Commissioner’s Office is collecting evidence until November 20 on agentic AI, including logs that record an agent’s identity alongside its actions. Authors at the U.S. National Institute of Standards and Technology recently proposed that each agent be uniquely and cryptographically identifiable rather than borrowing a human’s or service account’s identity.
Where the developments part ways is on how to get those answers. One approach gives agents credentials they can present. Zetrix AI’s service assigns each participating agent a verifiable digital identity, built on W3C Verifiable Credentials and linked to an authenticated person or organization, with permissions covering which services it can access, who it can transact with and how much it can spend. Zetrix AI and CAICT plan a cross-border pilot with organizations in the Middle East, Africa, China and ASEAN and will submit the results to the ITU, IEEE and other standards bodies. “The question is no longer just what AI can do, but who is responsible for what it does,” said Group Managing Director TS Wong. The launch comes as Zetrix AI faces financial pressure: MARC Ratings cut its Islamic bond program to C last week after a covenant breach. Shufti launched a product also called Know Your Agent last week, tying each agent to an owner verified through its KYC or KYB checks.
Descope’s Envoy, launched this week, takes a similar route for consumer apps, giving personal agents a delegated sign-in path built on Poppy, a draft protocol from Meta and Sierra, so companies can accept them with their own identities and permissions rather than treating them as the customer. In payments, the Secure Technology Alliance and the Merchant Advisory Group, which represents more than 200 merchants, said this week they will work to align payments and identity stakeholders on how AI agents start, authenticate and complete transactions, including how identity signals are shared and where liability sits when something goes wrong.
A related effort focuses on proving that a person approved what an agent did. Yubico, which unveiled its YubiID identity verification service this week, says it ultimately wants to provide verifiable proof that a person authorized a specific AI agent action, though that capability is not part of the launch.
A credential only helps if an agent presents one, and many do not. Most personal agents today do not declare themselves as agents, according to LexisNexis, which says agentic traffic grew more than 750 percent in the first half of 2026. Its new service evaluates activity in the context of surrounding identities, devices, networks and behavior, so organizations can allow, authenticate, review or reject an interaction. Fingerprint this week expanded its bot detection to traffic it infers comes from undeclared agents, including Meta’s Muse, Spear Street’s Instinct and xAI’s Grok Bot, which it says stopped signing requests around October 9 with Web Bot Auth, a standard designed to let agents cryptographically prove who they are. “More AI agents are visiting websites without disclosing their identity, and some that used to, like Grok Bot, have stopped,” said CEO Dan Pinto.
Inside companies, attention has turned to what agents can reach and the credentials they use to reach it. Palo Alto Networks is in talks to pay about $500 million for Clutch Security, which tracks and secures non-human identities such as API keys, tokens and service accounts and is extending those tools to AI agents, The Information reported. The talks may not produce a deal, and Palo Alto said it does not comment on “rumors or speculation.” Palo Alto completed its $25 billion acquisition of CyberArk this year and launched its Idira identity platform in May. Data security company Sentra said this week it raised $150 million, in a round led by Capital One Ventures, for software that includes a map of which people, service accounts and AI agents can reach a given dataset. TrueFoundry said agents connecting through its gateway can now operate under Okta policies using the Cross App Access protocol, with short-lived, task-scoped tokens in place of static API keys.
Liability remains the least settled of these questions. Regulators have privately welcomed the banks’ restrictions and have indicated that legal clarification may be needed on customer authorization and liability when autonomous software executes transactions, Hunton said. The next dates come quickly: the ICO’s call for evidence closes November 20, Wells Fargo’s terms take effect four days later and JPMorgan’s agreement follows on January 1.
Sources: OCC: framework, OCC: bulletin, Decrypt, LexisNexis Risk Solutions, Zetrix AI, The Edge Malaysia, Hunton, CNBC, American Banker, Credit and Collection News, RBC, The Canadian Press, Wells Fargo, Diario Constitucional, El Ecosistema Startup, PPC Land, The Paypers, Fingerprint, CTech, SiliconANGLE, TrueFoundry
–
By the ID Tech Editorial Team
