Long before an AI agent tried to book a flight or log into a bank account, another outside technology ran into a closed network.
The Carterfone, invented in 1956, let people on two-way radios connect to the telephone system. AT&T's rules banned it. In 1968, the US Federal Communications Commission (FCC) overturned that blanket ban and ruled that customers could connect devices as long as they didn't harm the network. In 1975, new standards made it practical to roll the technology out.
I see a similar problem with AI agents today. Businesses are being asked to let AI-fueled software act on behalf of their customers, while the rules for who is in charge, who is responsible, and how everyone gets paid are still being worked out.
Why are businesses so wary of AI agents?
An AI agent can work through a task step by step on its own. It can compare options, read information, pick a path, and sometimes complete a purchase. The fact that it can do this with little supervision is what makes it useful. It is also what makes it risky.
JPMorgan Chase has said it blocks outside agents from using customers' banking logins to operate their accounts, citing safety. The bank does support customers sharing their data securely through approved open banking providers, and says it wants to allow agent connections once they can be done safely. Airlines are careful too. Delta told TechCrunch it has no setup that lets outside agents shop for or book flights on its website or app.
As a security professional, I understand the hesitation. A customer may approve a goal without realizing everything the agent needs to do to reach it. "Find me a better flight" doesn't mean "cancel my current booking, buy a non-refundable ticket, and send my passport details to another company." The space between what the customer says and what the agent does is where trust can fall apart.
An agent needs clear limits
Giving an agent access to an account should never mean it can do everything that account allows. An agent could misread an instruction or share information it didn't need to. It could also run into harmful content on a website that tries to steer it off course. And if it keeps retrying or searching over and over, it can flood a company's systems, raising costs or slowing things down for other customers.
Businesses need answers to four questions, which I call the Four W's:
- Who runs the agent?
- Whom does it represent?
- What is it allowed to do?
- When does its permission end?
It isn't enough for an agent to simply claim a real person is behind it. What matters is proof that a verified customer actually gave permission. That proof should confirm the specific permission without revealing more personal information than necessary.
The business concern few people mention
I also think part of the pushback is about money.
Online businesses compete for your attention, not just your purchase. Search rankings, ads, recommendations, and add-on sales all add to what a single customer visit is worth. Picture a traveler booking a flight. Along the way, they're offered seat upgrades, travel insurance, and hotel deals. Some of these are genuinely useful. Others look appealing mainly because of urgency, clever presentation, or the feeling of grabbing a bargain.
An agent told to find the lowest total price that meets certain conditions could skip most of that. It would judge an upgrade only by whether the customer said they wanted it. That could be better for the customer, but it also takes away many of the seller's chances to influence what the customer spends.
This is my reading of the incentives. It isn't proof that any company is using security as an excuse. And agents aren't automatically neutral either. Their recommendations can be shaped by poor instructions, business partnerships, or incentives built into how they were designed. The competition may shift from who grabs the customer's attention to who influences the agent's choice.
I expect businesses to move faster once they see a way to make money from agents and have safeguards they trust. Agents could bring in customers who are ready to buy and make real purchases easier to complete. The opportunity is real, even if the way companies sell today has to change.
Human approval should match the level of risk
The customer should approve any step that meaningfully increases what they're risking or committing to. For a travel agent, that might mean asking permission before sharing ID documents, getting separate approval before canceling an existing booking, and confirming the final price and refund terms before buying.
For business leaders getting ready to let AI agents act for customers, five controls matter most:
- Confirm who the agent is and what it's allowed to do. Know which company runs the agent, and confirm the customer's specific permission through a trusted method.
- Limit what the agent can do. Keep browsing separate from buying. Set spending limits, allowed actions, and expiration dates, and make it possible to cut off access instantly.
- Ask for approval at the important moments. Pause before sharing sensitive information, taking actions that can't be undone, or changing a plan the customer already approved.
- Keep a clear record of what happened. Log the instructions, permissions, approvals, actions, and results. Be able to explain why important choices were made, without promising to reveal the AI's internal thought process.
- Agree in advance on how to handle disputes. Set up how mistakes will be investigated, fixed, refunded, and escalated before an agent makes an expensive one.
Any agreement to let agents in should also set limits on how much traffic they can send and how often they can retry, so an agent doing a legitimate task can't overload a company's systems.
Someone must still be accountable when things go wrong
The problem gets real when a customer says, "I never approved that purchase."
A useful record has to show four separate things: what the customer asked for, what the agent suggested, what was approved, and what the seller actually did. A login record alone can't answer all of that. Some of the tools to support this are already being built. Visa's Trusted Agent Protocol uses digital signatures to help merchants recognize legitimate agents and understand what they're trying to buy. That's a helpful step. But knowing who an agent is doesn't, by itself, prove that everything it does is appropriate.
What can be done better?
The Carterfone story points the way, but it doesn't guarantee the outcome. Networks open up when everyone agrees on rules for safe access that can actually be enforced. Customer demand alone doesn't settle those rules.
I expect more businesses to welcome agents once permission can be verified, transactions can be traced, and letting agents in makes business sense. The practical question for leaders is this: what would your organization need to confirm before letting an agent act?
A solid answer gives customers convenience, gives sellers confidence, and gives both sides a clear way to fix mistakes. The doors will be easier to open once everyone knows who can come in, what they're allowed to do, and who is responsible when something goes wrong.
About the Author:
Aby Rao is a cybersecurity and risk management leader with two decades of experience in the American workforce, including roles with Fortune 500 companies and high-growth technology organizations. He hopes to make AI and cybersecurity conversations more practical, accessible, and useful for business decision-makers through his writing, speaking, and community engagement.
References:
[1] Federal Communications Commission, Carterfone decision, June 26, 1968. https://www.nicholasjohnson.org/FCCOps/1968/13F2-420.html
[2] FCC, The Broadband Availability Gap, historical discussion of Carterfone and Part 68. https://docs.fcc.gov/public/attachments/DOC-302496A1.pdf
[3] Finextra, "JPMorgan Chase blocks outside AI agents from directly accessing customer accounts," October 15, 2026. https://www.finextra.com/newsarticle/48585/jpmorgan-chase-blocks-outside-ai-agents-from-directly-accessing-customer-accounts
[4] TechCrunch, "The next hurdle for AI agents: getting websites to let them in," October 6, 2026. https://techcrunch.com/2026/10/06/the-next-hurdle-for-ai-agents-getting-websites-to-let-them-in/
[5] Visa, "Visa Introduces Trusted Agent Protocol: An Ecosystem-Led Framework for AI Commerce," October 14, 2025. https://corporate.visa.com/en/sites/visa-perspectives/newsroom/visa-unveils-trusted-agent-protocol-for-ai-commerce.html