Banks blocking AI agents for Salesforce portals: the call

The call

Jamie Dimon said on JPMorgan’s third-quarter call on 13 October: “We’re not going to allow just any outside agent to come inside the company” (vendor, via Yahoo Finance). Schwab’s Rick Wurster followed on his own call on 15 October (vendor, via American Banker), then told Bloomberg Television on 16 October that the big agents are stopped “in the tens and twenties” each week (vendor, via The Next Web). By 18 October the story had widened to Amazon, Yelp, and Delta (independent, OfficeChai) and reached the Hacker News front page with 133 points (independent, Zeli digest).

What it is, and what it is not

What it is. A three-door policy. Door one, an outside agent holding the customer’s username and password, or driving the website by browser automation: blocked at both banks. Door two, read access through a route the bank controls: Plaid and other open banking providers at JPMorgan, and Schwab’s own MCP servers, which publish a fixed tool list under Schwab’s authentication (vendor, via Beri and The Next Web). Door three, moving money: no outside agent, at either bank. “We can’t control it, the client can’t control it, something could go wrong and who’s liable?” (Wurster, vendor, via The Next Web).

What it is not. It is not a ban on AI. Schwab is steering clients to Charley, its own assistant, announced 30 September (vendor, via American Banker). It is not purely a security decision either. “An outside agent works for the client. Charley works for Schwab,” said analyst Tim Welsh, pointing at the roughly $493 billion in sweep cash an independent agent might move (independent, American Banker). Your portal has the same tension: an outside agent that cancels and compares at machine speed is a service problem and a retention problem at once.

The number nobody is quoting

Coverage repeats “tens and twenties a week”. Nobody has put it against Schwab’s own account base.

One block a year for every 27,000 to 77,000 accounts. Wurster reads that as clients not yet ready to hand accounts to AI (vendor, via The Next Web). There is a second reading. The figure counts the agents Schwab caught from big providers, not the agents that tried. Amazon says Meta’s Muse did not identify itself as AI when it blocked it in September (vendor, via OfficeChai). An agent that looks like a browser counts as a customer. And Wurster told American Banker the blocks were “few and far between”, which does not sit easily with tens a week (independent, Beri). A block count measures your detector, not your traffic.

Missing

What neither bank has said, as of 19 October:

• How an agent is told apart from a customer: user agent, behaviour, device, or the agent declaring itself.
• How many agent sessions got through undetected.
• Who pays when an agent holding a customer’s password moves money. Wurster asked the question; nobody has answered it.
• The MCP tool list, scopes, and token lifetime Schwab offers, and how a customer revokes an agent.
• A date for money movement through the governed door. JPMorgan gave none (independent, Beri).
• An agent identity standard a portal can verify. Nothing published says any bank has adopted one.
• Where the CFPB lands on open banking. Its Section 1033 rule has been reopened (independent, Beri).

Who owns what

The agent is the customer’s choice. The door is yours.

In a Salesforce estate the front door is the Experience Cloud login, with the customer’s own credentials. A governed side door is a Connected App or External Client App with narrow OAuth scopes, exposing a short list of read actions such as case status and order status. Step-up verification for changes belongs in a Login Flow or in the service process itself. Detection starts in Login History and, if you license it, Event Monitoring. Agentforce on your own portal is the Charley equivalent: your agent, your rules, your audit trail.

Commercial decision: a blanket block you cannot enforce, or a governed door you can log, rate-limit, and revoke. The banks chose both. So should you.

Monday morning

1. Step 1. Baseline two weeks of portal logins. Pull Login History for external users and flag headless browsers, data-centre IP ranges, and logins followed by machine-speed page views. Owner: Salesforce admin with the security team.
2. Step 2. List every portal action by risk. Read (case status, invoices), change (address, contact, preferences), and commit (refund, cancellation, payment). Owner: service operations lead.
3. Step 3. Write the three-door policy. Credentials shared with an agent: not supported, said plainly in your terms. Read: through a governed API only. Commit: human or step-up, every time. Owner: service lead, signed off by legal.
4. Step 4. Scope the side door. A Connected App with read-only scopes for two or three actions, rate limits, and a revoke button the customer can find. Owner: Salesforce architect.
5. Step 5. Decide where your own agent fits. If customers want an agent, give them yours before Muse decides for them. Owner: head of service.

We move the side door from PILOT to build when an agent identity standard ships that a portal can verify and that Meta, OpenAI, or Google agents actually send.