JPMorgan is now blocking services that log into customers’ accounts with shared passwords and then move money, according to fintech writer Simon Taylor. Walmart is heading the opposite way. It announced an Agent Gateway built on MCP, Anthropic’s protocol for tool calling, which starts as a developer beta, with Agent Profiles due next month that carry spending limits.
Taylor, writing on X on 23 October, sees a split forming. Some companies are opening a proper entrance for agents, and others are bolting the side windows. The pressure is real. On Meta’s earnings call, Mark Zuckerberg said shopping is the most common use of Muse, Meta’s assistant, with purchases averaging more than $200. Taylor’s view is that this is a finance problem, and a big one.
The bank’s difficulty is easy to state. A customer who hands over a login tells the bank nothing about which agent is acting, the instruction it was given, or whether its behavior fits that instruction. David Sacks has argued that banks should let customers grant, cap, and withdraw an agent’s access. Taylor agrees with the direction and spends the rest of his thread on how.
He sorts the existing protocols into four layers. Entry comes first: a supported way in. The Personal Agent Protocol, now called Poppy, lets a business publish how agents can sign in and what they will be allowed to do. Two big US banks, Wells Fargo and Bank of America, sit on the design side, which Taylor stresses is shaping work. It does not mean your agent can use their apps any time soon. Visa’s Trusted Agent Protocol has a shopping agent announce itself with signed details, and Web Bot Auth lets a site verify that signature using a key the operator has published, since an agent calling itself “Muse” proves nothing.
Identity is the second layer. Proof’s x401 lets a bank request proof about the human behind an agent, and the agent responds with a credential signed by an issuer the bank trusts. OpenID4VP is the wallet mechanism that delivers it. Passkeys built on FIDO standards let you authenticate with a face, fingerprint, or PIN without giving the agent a password, though Taylor notes that this does not establish legal identity on its own.
Tools are third. MCP lets a bank describe an operation, such as freezing a card given a card ID, and WebMCP does the same through the browser so an agent need not guess which button to click. Agent2Agent lets your agent hand work to a business’s agent. None of these prove you authorized the job, and discovering a transfer tool does not entitle an agent to empty an account.
Intent is the fourth layer, and the one Taylor thinks is least settled. His example is a lost phone. “Freeze my card” should never double as permission to move a balance. A hotel booking shows the arithmetic: approve $200 a night including fees, and a room listed at $190 that adds $60 of charges breaks the cap even though the sticker price looks fine. Mastercard’s Verifiable Intent, Google’s AP2 mandates, and Visa Intelligent Commerce each tie a permission to a specific purchase. Europe’s Strong Customer Authentication does something similar for remote payments, binding approval to an amount and a payee.
Taylor’s own rule is modest. He would let an agent buy things under a couple of hundred dollars unattended, and want a check-in above that, plus an audit trail naming a known agent.
The part that matters commercially is his last point. “Permissioned” often turns out to mean paid. The existing data-sharing deal between JPMorgan and Plaid already carries pricing, and Taylor says it took almost a decade to reach. If Meta wants its shoppers’ agents inside bank accounts, the banks will have the same leverage. Anyone building agent payments should assume a per-access fee is part of the final design, and budget for it now.
Reported by Simon Taylor (on X) on 23 October 2026.
