Forrester urges banks to replace blanket AI agent blocks with graduated, permissioned access

According to Forrester, five banks have moved to block third-party AI agents from operating inside customer accounts and making transactions. The analyst firm calls this an understandable short-term response to fraud, liability, privacy and accountability risks, but not a viable long-term strategy.

Forrester’s consumer research finds that nearly a third of consumers use AI assistants for some personal finance questions, yet 50% of surveyed US and Canadian consumers do not trust AI with sensitive financial information and 40% have data security concerns. Many banks already allow limited, read-only agent access through approved open banking providers.

Forrester recommends “graduated trust”: authenticating both customer and agent, verifying agent provenance, assigning unique agent identities, granting least-privilege permissions that are explicit, revocable and time-limited, requiring customer approval for payments, and monitoring, cataloguing, risk-assessing and rate-limiting agent activity.