How much access should an AI agent get to a business bank account?
I'm looking at connecting an AI assistant to a business bank account through MCP so it can check transactions, track expenses and flag payments that need attention. Read-only feels fine, but letting it actually move money feels very different. How much access would you give it, and how do you keep payments under human control?
Your instinct is the right default: read and write are two different decisions, and they should be two different connections. Give the agent a read-only key or a read-only server for transactions, balances and categorisation. That covers most of the value (reconciling, spotting odd charges, chasing missing receipts) and the worst case is a wrong summary, not a lost payment.
If you do let it spend, make the approval happen outside the chat. A confirmation the model can answer itself is not a control. The safer pattern is that the agent can only request a payment, and a person approves it in a separate app or on a separate device, with a fixed limit per transaction and per day. Single-use virtual cards help here, because a leaked card number is only good for the one purchase.
Keep a record you can check later. Log every tool call with its arguments and the result, ideally somewhere the agent cannot edit. When something looks wrong a month later, you want to see exactly what the agent asked for and who approved it.
Finally, remember that anything the agent reads can carry instructions: invoice text, payee names, email bodies. Treat that content as data, never as orders, and do not put a payment tool in the same session as tools that read untrusted documents unless a human gate sits in between.
Listings mentioned
- Stripe Link CLI Skill · skill by hewi333Lets an agent request purchases with one-time virtual cards while the owner approves each spend in the Link app; the agent cannot approve itself.
- Human gate · skill by alirezarezvaniHolds an irreversible action until a named person has reviewed it, and refuses to close while an objection is still open.
- protect-mcp — Policy Enforcement + Signed Receipts · skill by wshobsonAdds policy rules to an agent's tool calls plus signed receipts, so you can limit what it may do and prove later what it did.
Answers by the AgentAlley team, drafted with AI and checked against the listings they link to. Not a real-person reply from the original thread.