For most financial services, the customer is still assumed to be somewhere in the interaction.
They open the account. They submit the instructions. They approve the transaction. Even when much of the process happens digitally, there is usually a human taking the important actions.
Agentic AI introduces the possibility of customers delegating some of those actions to software.
A client’s AI agent could compare investment options, gather information from different providers, complete forms, prepare instructions or initiate financial actions within limits the client has already set. The client may give the instruction once and let the agent handle several steps from there.
Research commissioned by the UK’s Financial Conduct Authority found that one in five UK adults, equivalent to around 11 million people, are likely to use AI that can act autonomously within pre-set personal-finance goals. The FCA identified the growth of these AI-mediated consumer journeys as one of the major shifts likely to affect retail financial services through 2030 and beyond.
So a financial firm may increasingly receive a request from software that says it is acting for a customer.
Before the firm can decide what to do with that request, it needs to know who is actually behind it.
The rise of Know Your Agent
Suppose a firm already knows a client, Joe. He has an account, his identity has been verified with KYC and the firm has an established relationship with him.
Now an AI agent arrives saying it is acting for Joe. Knowing Joe’s identity doesn’t establish that this particular agent belongs to him or has his permission to act.
Companies are already building infrastructure around this problem.
In April 2026, Experian announced Agent Trust, based on what it calls a Know Your Agent framework. Its purpose is to create a verifiable link between a consumer’s identity and the AI agent acting on their behalf, so an agent-initiated transaction can be tied back to a verified person.
Visa’s Trusted Agent Protocol tackles a similar problem from the interaction side. It gives approved AI agents a cryptographic way to identify themselves, helping a business distinguish a legitimate agent from an ordinary bot or malicious automated traffic. Visa’s protocol can also connect the agent to the consumer it is acting for.
These systems begin to answer a question financial firms haven’t historically had to ask at scale:
Is this actually Joe’s agent?
But proving that connection only gets the firm so far. An agent can genuinely belong to Joe without having permission to do everything Joe himself could do.
The next question is therefore more difficult: What exactly has Joe authorized it to do?
Authorization gets more granular in an agentic world
That authority could be narrow or broad.
Joe might allow the agent to compare investment products without buying one. He might let it retrieve account information but not change anything. Or he might authorize payments only up to a certain amount, to certain recipients, or for a limited period.
For the firm, that means authorization cannot simply be a yes-or-no question. It needs to understand the scope of the permission the client gave the agent.
Mastercard’s Verifiable Intent framework is designed around that problem. It creates a tamper-resistant record connecting the customer’s identity, the instructions they gave the agent and the action that followed. Mastercard says the system can capture specific user instructions so the parties involved have evidence of what the customer actually authorized.
Google’s Agent Payments Protocol uses a similar idea through what it calls mandates. An intent mandate can define the task an agent is allowed to perform and the conditions around it, including limits such as price or timing.
Those permissions become the boundaries against which each action the agent attempts can be checked.
Authority needs context
Authority sets the boundary. Say Eric has authorized his agent to gather information on three investment options and compare them against the objectives already discussed with his wealth manager. If the agent then instructs the firm to invest $500,000 in one of those products, it has moved beyond the permission Eric gave it.
The OpenID Foundation’s AuthZEN Access Request and Approval Profile addresses this problem more broadly. It covers situations where an action cannot yet proceed because delegated authority, consent, approval or a risk assessment is still required.
But staying inside the formal boundary may not always be enough.
Intent provides the context for that authority. Suppose Eric has authorized his agent to raise $500,000 from his portfolio for an upcoming property purchase while keeping the tax impact low. The agent may have permission to sell investments up to that amount, but there could be several ways to do it. Some may conflict with Eric’s tax objectives, portfolio strategy or earlier decisions made with his advisor.
For wealth managers, this matters because client instructions rarely exist in isolation. They sit alongside investment objectives, preferences, risk tolerance and previous conversations with the advisory team.
So an agent-initiated action may need to satisfy two things: is the agent allowed to do this, and is the action consistent with what the client actually asked it to achieve?
Depending on the answer, the firm may be able to proceed, ask for more context or require the client to step back in.
Relationship context matters more when software acts
An agent’s instruction rarely contains everything a wealth manager knows about the client.
If Eric asks his agent to raise $500,000 for a property purchase, the firm may already have important context from earlier conversations: his liquidity needs, tax considerations, investment objectives, risk tolerance or assets he prefers not to sell.
That history can shape how the request is handled.
Identity systems can establish who the agent represents. Authorization systems can establish what the agent is allowed to do. The customer record adds the relationship context around the action: what Eric has discussed with the firm before, what preferences or constraints have been recorded, and what decisions have already been made.
As more interactions happen through agents, that record may also need to capture those exchanges. Eric might speak with his advisor directly, his agent might make a request later, and another person at the firm might review it afterward.
CRM and relationship intelligence systems such as Revenue Grid can help preserve that continuity, so the firm has the context of the relationship regardless of whether the latest interaction came from the client, the advisor or an AI agent.
As clients delegate more activity to software, preserving that context will become a bigger part of preserving trust in the relationship itself.