On November 2, 2026, Wells Fargo updated its Online Access Agreement — and buried the most important sentence in consumer AI inside Section 15. Any instruction or transaction submitted by an AI agent using your credentials "are deemed to have been initiated and authorized directly by you, without further verification" (Wells Fargo Online Access Agreement, Section 15(d), updated Nov 2, 2026, via TechTimes, Nov 3, 2026). Section 15(e) is shorter, and Wells Fargo put it in capital letters itself: "Your use of any AI Agent is AT YOUR OWN RISK" (TechTimes, Nov 3, 2026). The change takes effect November 24, 2026 — three days before Black Friday — for a customer base TechTimes puts at approximately 70 million digital banking customers. If you are a business owner shopping for a custom CRM or bespoke software development with agents inside it, read that clause as what it is: the bank solved the agent problem by defining it away. The agent acted, therefore you authorized it. That is not AI agent governance. That is a disclaimer with a section number.
Governed AI agents: "deemed authorized" is the opposite of authorization
Real authorization has a shape. A named person grants a specific permission, for a specific action, inside a specific limit — and the grant can be checked afterward and revoked when it is wrong. Section 15 has none of that shape. Wells Fargo defines an "AI Agent" broadly as "any software that takes autonomous, semi-autonomous, or non-autonomous action on behalf of any person or entity" using your online banking credentials (TechTimes, Nov 3, 2026). Under that definition, the budgeting app you connected last spring and a shopping agent you authorized once are the same legal object as you at your keyboard. The agreement also puts the burden on the customer who revokes an agent's access to retain documentation of that revocation — if an agent you thought you disconnected later moves money, proving the revocation happened first is your job (TechTimes, Nov 3, 2026).
One qualifier matters, and honesty requires naming it: the liability provisions apply "subject to applicable law or regulation" (TechTimes, Nov 3, 2026). The contract does not erase every statutory protection. What it does is set the bank's starting position in every dispute — the transaction was yours — and make you argue your way back from there. (Analysis: a starting position is not a small thing. In a dispute, the party who does not have to prove authorization usually wins the first round, and most customers never get to a second one.)
Custom CRM: the credential-collapse problem is an architecture problem
Why would a bank write a clause like that instead of just detecting the agent? Because, on today's plumbing, it mostly cannot. When an agent logs in with your username and password, the bank's systems see a session under your credentials — the same evidence you present when you log in yourself (TechTimes, Nov 3, 2026). TechTimes names the resulting failure the credential-collapse problem: you, an agent you authorized, and a rogue agent using stolen credentials collapse into one indistinguishable session. Three different actors, one identity, no way to tell them apart at the door.
The rest of the industry has answered that collapse by slamming the door. Charles Schwab has been blocking AI agents from its platform "dozens of times a week," and JPMorgan Chase blocked external agents in October (TechTimes, Nov 3, 2026). Bank of America CEO Brian Moynihan told CNBC that limiting agent access was necessary because "a human should authorize money leaving an account" (TechTimes, Nov 3, 2026). So the two live options in American banking this week are: block agents entirely, or let them in and deem everything they do authorized by you. Neither option is governance. One is refusal. The other is surrender with paperwork.
If you run a business, this lands on your operation, not just your bank account. The custom CRM, invoicing tool, or scheduling system you connect an agent to has the same collapse inside it: one shared login, no per-agent identity, no scoped permission, no record of which action the agent took and which one you took. When something goes wrong, "deemed authorized" is the only story your own system can tell — because it never recorded anything else.
AI agent governance: Hong Kong just built the other answer
On the same day Wells Fargo published its clause — November 2, 2026 — the Hong Kong Monetary Authority launched Project SAGE, short for Securing Agentic Finance with Governance and Enablement, "to support the responsible development and adoption of agentic finance in Hong Kong" (HKMA press release, Nov 2, 2026). SAGE works four areas: market development and use-case exploration; AI agent identity and authorization verification mechanisms; interoperability standards and protocols; and governance arrangements, legal liability, and consumer protection (HKMA, Nov 2, 2026). The HKMA also established an Agentic Finance Expert Group and published a discussion paper on banks' use of agentic AI, seeking views on governance models, responsibility arrangements, and a possible central register of trusted agents (HKMA, Nov 2, 2026).
The industry shorthand for SAGE's identity pillar is "Know Your Agent" — KYA (TechTimes, Nov 3, 2026). It is the exact inverse of Section 15. Instead of collapsing the agent into the customer, KYA asks what identity credentials an agent should carry, what authority was delegated to it, and how a counterparty verifies both before acting (HKMA, Nov 2, 2026; TechTimes, Nov 3, 2026). (Analysis: this is the split the whole market is now choosing between. One regulator spent November 2 building agent identity. One bank spent November 2 disclaiming it. A buyer should notice which side their own systems are on.)
Bespoke software development: scoped delegation already has a draft — use its shape now
The technical fix for credential collapse is not mysterious, and TechTimes names it plainly: scoped delegation, where an agent receives a limited authorization token — permitted to pay a specific bill, not to move savings; permitted to read a balance, not to initiate a wire — instead of the master credentials that grant full access (TechTimes, Nov 3, 2026). A standard for exactly that was announced October 6, 2026: Meta and Sierra unveiled the Personal Agent Protocol, nicknamed "Poppy," an open specification for OAuth-based scoped agent access, with Bank of America, Wells Fargo, BBVA, and Synchrony named as early banking design partners; the specification itself was published October 9, 2026 (TechTimes, Nov 3, 2026).
Here is the honest caveat, because bespoke software development is where caveats become your problem: Poppy is a design specification, not deployed banking infrastructure (TechTimes, Nov 3, 2026). You cannot wait for it to arrive and call that a plan. But you do not need the finished standard to build its shape into your own systems today: a separate identity per agent, permission scoped to the task, a named human's yes before the consequential step, and an audit record that survives the session. That is the governed design — authorization before action, recorded — and it works with the plumbing that exists now.
Phoenix custom software: what to do before November 24
Wells Fargo's Section 15 takes effect November 24, 2026, and Salesforce projects 20% of holiday ecommerce will originate from AI chat agents this season (TechTimes, Nov 3, 2026). The highest-volume shopping week of the year is about to run through the loosest authorization regime a major bank has ever published. If you are a Phoenix business owner evaluating governed AI agents, a custom CRM, or Phoenix custom software, do these five things first:
- Audit every agent holding your credentials. Every budgeting app, invoicing tool, or assistant that ever asked for a banking or CRM login still has that access until you revoke it (TechTimes, Nov 3, 2026). Revoke what you no longer use.
- Document every revocation. Wells Fargo's agreement makes your revocation record your evidence (TechTimes, Nov 3, 2026). Screenshot it, date it, keep it.
- Refuse shared logins inside your own systems. If your CRM cannot tell an agent's action from yours, you have built Section 15 into your own house. Per-agent identity is the minimum.
- Scope every permission to the task. Pay this bill, read this balance, draft this email — never the master key. Scoped delegation is the fix the industry itself has named (TechTimes, Nov 3, 2026).
- Require a named yes before money moves. Bank of America's stated position — a human should authorize money leaving an account (TechTimes, Nov 3, 2026) — should be your system's rule too, with the yes recorded.
A governed system makes this list boring, because the answers were built in before the agent ever ran. An ungoverned one discovers, on the busiest week of the year, that everything its agent did was "deemed" to be you.
Frequently asked questions
What did Wells Fargo's Section 15 actually change?
Updated November 2, 2026 and effective November 24, 2026, Section 15(d) provides that instructions or transactions submitted by an AI agent using your credentials "are deemed to have been initiated and authorized directly by you, without further verification," and Section 15(e) states that use of any AI agent is "AT YOUR OWN RISK" — subject to applicable law or regulation (Wells Fargo Online Access Agreement via TechTimes, Nov 3, 2026).
What is "Know Your Agent" (KYA)?
The identity pillar of the Hong Kong Monetary Authority's Project SAGE, launched November 2, 2026: designing what identity credentials AI agents should carry, how delegated authority is verified, and how governance, liability, and consumer protection attach to agent actions — alongside a possible central register of trusted agents (HKMA press release, Nov 2, 2026; TechTimes, Nov 3, 2026).
What should a business owner ask a software vendor about agents?
Ask whether each agent carries its own identity, whether its permission is scoped to a specific task rather than a shared master login, whether a named human authorizes consequential steps before they happen, and whether the system keeps a record that separates the agent's actions from yours. Those four answers are the difference between governed AI agents and a "deemed authorized" clause waiting for its first dispute.
Robbie Glover builds governed AI systems at Ronin Inc in Phoenix, Arizona. If you want a custom CRM where every agent carries an identity, works inside scoped permission, and asks before the consequential step — talk to us.
