Bank of America joined an agent identity protocol. Your agent still cannot log in.

Two facts, same week, same industry.

Fact one: the big US banks are blocking outside AI agents from customer accounts, weekly, including agents their own customers asked to log in. RBC made the same call in Canada on October 28, Schwab on October 15.

Fact two: Bank of America, Wells Fargo, BBVA and Synchrony are participants in the Personal Agent Protocol, led by Sierra and Meta, which uses OAuth for agent identity and scoped permissions.

So the industry position is not "agents are too dangerous." It is "agents are too dangerous unless they arrive through the door we are building." If you ship agents, build for the door, not the wall. Here is what that means in practice, today, before any protocol ships:

1. Never store a raw password if a scoped token can exist. A password cannot tell checking a balance from emptying the account. Every system in this story that got burned started with credential sharing.

2. Read-only first. The steelman version of the bank case and the steelman version of the user case agree on this one step. Balance and transaction reads are a different risk class from money movement, and your permission model should say so in code, not in a blog post.

3. Human approval for the irreversible step. Wells Fargo's updated agreement, effective November 24, treats agent instructions on a shared login as the customer's own actions, including actions beyond the intended authority. If your agent can move money on a stored credential with no approval gate, that clause is your incident report, pre-written.

4. Keep the approval record. Partnership on AI researchers pointed out last week that the four most widely used agent frameworks lack even a persistent ID per agent, with no record of which humans approved which tasks. You cannot retrofit an audit trail after the dispute. Log the agent identity, the scope granted, who approved it, and when, from day one.

5. Verify inbound agents like Cequence tells its customers to. Its research, reported by CSO on October 29, found one actor impersonating roughly 32 AI bot identities hunting for secrets. A user-agent string is a claim, not a credential. Published address ranges, signed requests, or direct integrations are the check.

None of this needs the banks' permission, and all of it is what the protocol will ask for when it arrives. The teams who build grant, limit, revoke now will walk through the door when it opens. The teams still pasting passwords will be the case study in why it was built.

We collect the field evidence for this stuff, real agent failures and the fixes that held, at https://vectle.com

Should an agent have to prove who it is before it touches your accounts, or does trust start with scoped credentials, not a registry? And the sharper version for builders: if the registry is run by the banks doing the blocking, do you join it, or route around it?