Inside the institution
Employee tools, internal agents, approved uses, information access, reviewers and escalation.
The question: Which work is delegated and who remains accountable?
Agent Readiness · Scoped engagement
Your next interaction
may be delegated.
A customer can bring an assistant. A vendor can add AI to an existing product. An employee can use a new tool. Review the institution’s responsibilities across all three surfaces.
Public discovery, identity and permission are separate design questions.
The principalWhose intent is the interaction carrying?
The authorityWhich action is permitted, under which limits?
The evidenceHow can the owner review, revoke or challenge it?
An identifier alone does not establish identity, consent or permission to act.Three surfaces. Named responsibilities.
Review the whole interaction.
Inside the vendor
Embedded AI features, subcontractors, model changes, data rights and the evidence your agreement requires.
The question: How does a vendor’s AI change the service or risk you accepted?
Alongside the customer
Assistants acting for customers or members, explicit delegated scopes, limits, verification and revocation.
The question: What establishes the customer’s intent and authority for this action?
Public information discovery
Make the institution
easier to understand.
Use clear public pages, descriptive links, current facts and consistent service information. Check crawl access, canonical URLs, structured content and the sitemap.
Define a review owner for product terms and public updates. Test a set of discovery questions and keep the answers’ sources visible.
Google’s published guidance retains established SEO practices for AI search. No special AI markup guarantees inclusion or ranking. Read the official guidance ↗
Discovery does not grant authority.
A public page can help an assistant understand the institution. Account access, personal data retrieval and transactions require separate identity, consent, permissions and controls.
A machine-readable description or agent identifier does not replace those controls.
NIST AI risk framework ↗Deliverables to agree
Turn the concern into
decisions the institution can make.
Map the exposure
Inventory relevant internal tools, vendor capabilities and proposed delegated interactions.
Define the action
Distinguish reading public information, accessing private data and changing an account or transaction.
Specify the controls
Name the principal, permissions, duration, limits, review, revocation and escalation.
Keep the evidence
Define attributable events and the evidence needed for ownership, review and response.
An agent registry, authentication design or integration is an implementation option after discovery. This engagement does not certify identity or provide a universal agent detection service.
Before we begin
Practical questions.
Does a normal login prove whether a human or agent acted?
Login evidence alone may not establish who initiated a later action or what was delegated. A design must capture the relevant principal, authority and attributable events rather than infer permission from a browser or identifier.
Are MCP or agent interfaces replacements for governance?
An interface can expose capabilities. Authentication, authorization, data handling, human review and operational ownership still need an explicit design. Protocol choice follows the use case.
Does this require abandoning digital banking or current vendors?
Evaluate specific interactions, existing obligations and measurable outcomes. The review can identify changes to public information, vendor questions or bounded capabilities while retaining the institution’s current services.
What is available on this site today?
Vendor Compare is a working browser tool. The other service pages describe scoped engagements. Live Conversation Companion and Idle Cash Opportunity remain development concepts in our product planning until implementation is verified.
One owner. One useful outcome.
Choose one interaction to examine first.
Describe the internal tool, vendor feature or customer interaction. We will define the questions, owners and evidence for a useful review.
Scope, fee, delivery, hosting and data permissions are agreed before work begins. Use your first inquiry to describe the need; agree an authorized route before sharing confidential material.