The Insider Problem

JPMorgan told analysts on October 13 that it won’t let outside AI agents into customer accounts to act on a customer’s behalf, according to CNBC . Jamie Dimon said the bank isn’t going to let “just any … outside agent” in, because “it’s just too risky for clients and for JPMorgan.” A spokeswoman put it more plainly.

Because it is not safe, we do not permit third parties to access accounts by obtaining customers’ banking credentials and logging in on their behalf.

CNBC reports that an agent can still see some data read-only, like a balance, through a connector such as Plaid, but it can’t send money or pay a bill, and the bank gave no timeline for letting agents do more. The bank has a stake here too: CNBC reports it’s piloting an agent of its own, Smart Cash, that predicts a customer’s cash flow and moves money. Either way, the agent a customer points at a bank is an insider the bank didn’t hire and can’t scope, asking for the customer’s whole login, and JPMorgan is refusing that grant.

I’ve watched companies hand out access for a long time (to employees, to contractors, to service accounts), and the review of that access has always lagged the grant. An agent, meaning software that can take an action in your systems on someone’s behalf, widens that gap, because it gets access faster and uses it faster than anyone gets around to reviewing it. Six days after the JPMorgan call, Microsoft published a security post titled Agents are your newest insiders. Security must move at their speed. Nadim Abdo, Microsoft’s corporate vice president for identity and network access, wrote it, and it makes the same argument about the agents a company runs on its own systems.

Abdo’s list of what agents already do is ordinary work: writing code, researching products, analyzing revenue, processing expenses, and acting across the systems that run the business. That access is what makes them useful. In his telling, the trouble with agents is ordinary too: they make mistakes, they can be manipulated or compromised, and depending on how they’re built and deployed they can run continuously, at machine speed and at scale. That’s a fair description of a new hire who never sleeps and can be talked into things.

Abdo’s answer is that every agent should have an identity separate from the person using it or sponsoring it, so the company can tell what a person did from what an agent did for them. In his words, an agent “should not automatically inherit all the standing access of its user. It should begin with no authority and receive only what it needs for the approved task, for only as long as the task requires.” His example is an expense agent that needs to read submissions, check the policy, and approve a routine reimbursement, and doesn’t need every permission the employee who sponsors it already has. And if the agent or the software wrapped around it gets compromised, it shouldn’t be able to switch off the controls watching it.

Abdo’s post builds on an essay Satya Nadella published on X on October 10, Models as Insider Risks in the Super Intelligence Era . Nadella argues that a company has to “separate the supply of intelligence from the authority over it.” The controls on what a model can reach and what it can do have to sit outside the model, following a security principle that dates to the 1970s: a program must not be able to bypass or tamper with the mechanisms that enforce its permissions. He also points out that you can have models test one another and still end up with “an opaque model inside an opaque orchestration layer, watched by another opaque model.” He closes with this.

The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least.

I think that’s the right approach, and I didn’t expect it from the head of a company that sells the models. It’s also old advice: nobody hands a new contractor the CEO’s login and hopes for the best, and Abdo’s “begin with no authority” rule is that same instinct.

Microsoft names its products for this in the same post, Entra Agent ID and Dynamic Permissions among them. ServiceNow announced AI Passport on October 15. AI Passport is a signed credential an agent checks at runtime to confirm what it’s allowed to do. The release expects it in Q4 2026 and lists AI Passport among its forward-looking statements, so it isn’t shipping yet.

So Microsoft, which is making the argument, and ServiceNow, which is building for it, both sell an authority layer, which makes Nadella’s line a little less surprising than I first thought. Neither catalog should decide how you build it, though, and Nadella’s warning about opaque models watching opaque models applies to their products as much as to anyone’s.

I’d ask three questions first though:

• Does the permission expire?
• Does the boundary sit somewhere the model can’t edit?
• Can a named person shut the agent off?

Abdo’s post covers the first two, and the third is what Nadella calls an emergency brake: an authorized person who can always pause or shut down a model mid-task.

A narrow permission still leaves room for a manipulated agent to misuse what it legitimately holds. Abdo’s expense agent, with exactly the right access, can be talked into approving a fake reimbursement. Scoping caps how far that goes, so the agent can approve the wrong reimbursement and still can’t touch payroll. Before any agent spreads across a company, a person has to decide how much damage a wrong or manipulated agent is allowed to do.

JPMorgan has already answered that question for agents coming in from outside, and for now its answer is none. I’d guess most companies haven’t asked it yet about the agents they already run, and those agents are picking up access the way employees and service accounts always have, faster than anyone gets around to reviewing it. Nadella wants a system that lets you trust the model the least, and that only works if someone inside the company has already decided how wrong the model is allowed to be.