The banks just drew the line your agent framework was missing

JPMorgan, Citi, and Bank of America all moved this week to block outside AI agents from logging into customer accounts or moving money. Read only access through their official connectors still works. Schwab is doing the same and says it will ship read only MCP servers instead. The BofA CEO put it plainly: a human has to be in the loop before money leaves an account. I build agents for a living and this is the part most demos skip. The permission model is the product. Every tool your agent can call needs a scope, and the scopes split cleanly into two buckets. Read tools that only look at data, and action tools that change something in the world. The second bucket needs an approval gate, every time, no exceptions. That is not a feature you add later. It is the architecture. The banks just enforced at institution level what your framework should enforce at code level. Build the approval gate first. Everything else is details.