Building in public.

Banks hold money. We govern what agents do with it. Why staying out of the custody business is not a limitation, it is the architecture.

Funding via a partner account, one permanent card per agent, just in time limits. The flow diagrams are done and technical alignment with the partner CTO is in progress.

Cards rest frozen at limit zero. For an approved payment the limit is raised to the exact amount, then closed again. Single use safety without single use cards.

Deterministic rule checks and an append only event log, built rail agnostic from day one. The audit trail is the product, not an afterthought.

Agentic banking is banking where AI agents do not just answer questions but execute financial tasks inside human defined guardrails. Here is how it works and who is building it.

Visa is live with 30 issuers, Mastercard ran its first agent payment with Santander, and AI referred traffic converts 42 percent better. What is real in Europe right now.

An agent can file the application, track KYB and configure the account. Two steps must stay human: identity verification and the mandate signature. Here is the exact split.

Agents cannot do strong customer authentication. The mandate model solves this: the human authenticates the rules once, the agent executes inside them. Visa ships the same logic.

Teams paste corporate cards into prompts because there is no better option. Here is the safe pattern: one card per agent, frozen at rest, unlocked per approved payment.

The Model Context Protocol became the standard way agents reach tools. Money tools need stricter design: scoped visibility, idempotency, and decisions outside the model.

A manipulated agent can be talked into requesting anything. It must not be possible to talk it into spending anything. The defence is architectural, not clever prompting.

When agents act with real world effect, the AI Act expects human oversight and traceability. For spending agents, that translates into mandates, decisions and an append only trail.