Should Your AI Agent Have Write Access to Your Bank Account? A Permissions Framework for SMBs

A client asked me this question two weeks ago, and I want to be honest about my first reaction: I didn't have a clean answer ready. Not because it's complicated. Because most of the industry hasn't bothered to answer it in plain English, and I'd been assuming the framework was obvious when it wasn't even written down.

So let's write it down.

What "Access" Actually Means

When someone says "connect your AI agent to your accounting software," they usually mean one of two very different things, and the difference matters more than almost anything else in this conversation.

Standing access is a credential that sits there, permanently live, able to act whenever the agent decides to act. Think of it as handing someone a key to your building and never asking for it back.

Scoped access is a permission granted for one task, for one window of time, then gone. It's more like a contractor badge that stops working the day the job is done.

Most AI tools default to standing access because it's easier to build. Easier for them, not for you. The security world has a term for the discipline of not doing that: least privilege, meaning an agent (human or software) gets the minimum access required for the task in front of it, nothing standing, nothing "just in case." The Fintech Open Source Foundation, an actual Linux Foundation project, has published an entire framework on applying this to AI agents specifically, because regulated finance already learned this lesson the expensive way.

You don't need to read the framework. You need the three tiers underneath it.

The Three-Tier Model

Tier 1: Read-only. The agent can look but not touch. It can tell you your cash position, flag an invoice that looks off, summarize last month's spend. It cannot move a dollar. This is where every new AI tool should start, full stop, no exceptions, no "just this once."

Tier 2: Scoped write, with limits. The agent can take defined actions inside defined boundaries: categorize transactions, draft (not send) a payment, update a record. The boundary has to be explicit ("can create draft invoices under $500," not "can manage invoicing").

Tier 3: Human-approval-required. Anything financial, anything irreversible, anything that touches money leaving your account, a human confirms before it executes. Not a rubber stamp. An actual look.

Notice what's missing: there is no Tier 4, "fully autonomous, do whatever it thinks is best." That tier doesn't exist for a reason. It shouldn't exist for your business either.

One rule shows up across every serious source I found on this: never let an agent manage its own permissions. It shouldn't be able to grant itself new access, modify its own instructions, or create new credentials. That has to be enforced at the infrastructure level, not the prompt level, because a prompt is a suggestion and infrastructure is a wall.

Questions to Ask Before You Connect Anything

Before you grant any AI tool access to anything financial, ask the vendor these, out loud, and listen for hedging:

1. "Is this read-only, scoped-write, or full access, and can you show me the difference in your settings?"
2. "What's the most damage this integration could do if it malfunctioned or got compromised tonight?"
3. "Can I revoke access instantly, or does it take a support ticket and three business days?"
4. "Does the agent ever act without a human confirming, and on what, exactly?"

If the answer to any of those is a shrug or a sales deck, that's your answer.

The Moneyball Version

I'll admit the profanity is earned here: giving an AI agent standing write access to your bank account because a vendor said it would "save time" is a genuinely dumb way to find out how expensive a Tuesday can get.

Here's the reframe. This isn't a capability problem. It's a blast-radius problem. Less access doesn't mean the agent does less for you, it means that when something goes sideways (and something, somewhere, eventually will), the damage is contained to a paper cut instead of a full system failure. It's the same logic behind why nobody hands a new hire the master key on day one, no matter how promising the resume looks.

You wouldn't give a stranger off Craigslist your banking password because they seemed nice on the phone. Don't give one to a chatbot either, just because it's polite about it.

---

Smatthew Cohen is an AI Operator and the founder of Ingenium Vector. Before that he ran a sales firm called Tortoise & Rooster for twelve years, helping boutique manufacturers who couldn't afford the agencies that were ignoring them anyway. He builds things now.

Further Reading

• How to Tell If Your Marketing Agency Is Selling You Smoke: spotting vague promises before you sign
• AI Agents Don't Mean Layoffs. They Mean Upgrades: what the right scope looks like once permissions are settled