Banking
Deployment record
In the tracker →- Organisation
- SAP
- System
- Joule
- Stage
- Live
- Function
- AI assistant
- 01JPMorgan Chase and Charles Schwab are blocking external AI agents from accessing customer accounts and moving client money, citing security concerns.
- 02SAP's API policy prohibits interaction with external AI systems unless routed through its own AI assistant, Joule, leading to pushback from users seeking clarity on integrations.
- 03ServiceNow introduced Action Fabric, allowing third-party AI agents to access its workflows, with billing based on agent actions rather than users.
Show all 5Show less
- 04Salesforce's Headless 360 exposes its platform to AI agents through APIs and tools, while Workday is exploring monetization strategies for outside agent access.
- 05Both consumer and enterprise companies are establishing terms for AI agent access, focusing on security, liability, and governance issues.
SAP
Follow Deployed on Google
Over the past month, some of the largest consumer-facing companies have moved to keep outside AI agents away from customer accounts.
JPMorgan Chase blocks external agents that try to access accounts using customers' banking credentials, though read-only data such as balances can still reach agents through providers like Plaid.
Charles Schwab blocks outside agents from moving client money, and CEO Rick Wurster told Bloomberg Television that such attempts happen "tens of times a week."
Amazon has blocked Meta's Muse shopping agent, telling users that "continued access by an unauthorized AI agent violates Amazon's Conditions of Use."
A similar question is playing out inside the enterprise. When a company wants to use an outside AI agent on data stored in its own business software, the software vendor is increasingly deciding whether that agent gets in, how and at what cost.
SAP Routes Agents Through Joule
SAP's API policy, last updated on April 27, 2026, lists among prohibited uses "interaction or integration with (semi-) autonomous or generative AI systems," except "through and within the limits of SAP-endorsed architectures," The Register reported.
In practice, external agents are directed to SAP's own AI assistant, Joule, using agent-to-agent (A2A) communication.
"For agentic use cases, A2A via Joule is the only way," SAP's Thomas Saueressig said, according to Techzine. "The public APIs are for static applications, not for dynamic third-party AI agents."
An SAP spokesperson said the updates "clarify design-intended use of SAP interfaces" and align with industry-standard cloud practices. On an investor call, CEO Christian Klein said "no customer, no partner needs to worry," while also saying "we need to start throttling those APIs."
The policy drew pushback from SAP users. DSAG, the German-speaking SAP user group with more than 3,700 member companies, asked for contractual clarity, transition timelines and protection for existing integrations.
In a later statement to The Register, an SAP spokesperson said "the SAP API Policy does not restrict third-party agents from accessing SAP," and that the policy governs how agent traffic is routed through A2A and Model Context Protocol (MCP) gateways. SAP's FAQ says the policy "introduces no new pricing for access via endorsed architectures."
Gartner analyst Christian Hestermann said "SAP is trying to channel how and who can access the SAP systems through third-party AI platforms and solutions."
ServiceNow Opens the Door and Meters It
ServiceNow took a different approach at its Knowledge 2026 conference in May, introducing Action Fabric. The layer exposes ServiceNow's workflows, approval chains and business rules to AI agents, including third-party ones, through an MCP server.
Anthropic is the first design partner. Its Claude Cowork app connects to ServiceNow, so an employee can, for example, request access rights and trigger an approval chain.
The week's banking, insurance and brokerage deployments. Tuesdays.
Actions pass through ServiceNow's AI Control Tower, which checks identity, permissions and the audit trail.
The MCP server is included in ServiceNow's Now Assist and AI Native packages, and agent actions consume the same Assist credits as ServiceNow's own AI agents, Techzine reported.
COO Amit Zavery confirmed billing per operation an agent completes, rather than per user, according to The Information.
JPMorgan analyst Mark Murphy called the charge "effectively a tax" on customers using outside agents with data already stored in ServiceNow, PYMNTS reported.
Salesforce and Workday
Salesforce announced Headless 360 in April, exposing its platform as APIs, MCP tools and command-line tools that AI agents can use without the Salesforce interface.
The company added more than 60 new MCP tools, and said its components can appear inside ChatGPT, Claude, Gemini, Microsoft Teams and other MCP-compatible apps.
"Why should you ever log into Salesforce again?" co-founder Parker Harris said.
Workday has not announced pricing for outside agent access. Bhusri has said charging for agent access offers "meaningful financial upside," according to UC Today.
At a recent investor meeting, he listed APIs among the ways Workday plans to make money, alongside selling agents on a Flex Credit basis, Constellation Research reported.
He also said Anthropic's integration with Workday runs through Sana, Workday's AI platform, rather than directly through its base APIs.
The Same Question on Both Sides
On both the consumer and enterprise side, the companies holding the data are setting the terms for agents. Banks and Amazon have pointed to security and their terms of use.
Wurster said outside agents are not allowed to move money because "we think there is too much risk there to the client and to the firm."
"We can't control it, the client can't control it, something could go wrong and who's liable?" he said.
Schwab is also building its own MCP servers, which let clients connect their own AI models under Schwab's authentication for reading and research. It is a form of controlled access similar to the gateways software vendors are building.
For enterprises choosing AI agents, Forrester analyst Faram Medhora said the unresolved questions include "who pays for the runtime, who governs the agent, who owns the audit trail."
Last updated
