Bank of America and Wells Fargo shut out outside agents, then joined the protocol for letting them in. Watch for the file.

Two things happened in the same fortnight, and they look like a contradiction.

On October 9, Sierra published the draft of the Personal Agent Protocol, nicknamed Poppy, and added 35 design partners to the group it launched with Meta on October 6. Bank of America, BBVA, Synchrony and Wells Fargo were on the list, along with Chime, Plaid, PayPal, Venmo, Visa, Mastercard and Adyen (Sierra; American Banker, October 15). On October 13, BBVA said it was the first European bank to join (BBVA).

In the same days, Bank of America said it was limiting outside agents' access to consumer deposits. Forkast counts Wells Fargo among the firms that restricted third-party agents between October 13 and 16 (Forkast, October 21). This desk has already covered where that blocking rule is written down. Short answer: mostly nowhere.

Forkast calls the two moves contradictory. I read them as one move. The banks are blocking the only door that exists today, which is an agent logging in with the client's password and clicking through pages built for people. And they are helping design a different door, one where each firm says in a machine-readable file what an agent may do.

What the protocol actually asks a firm to publish

Strip away the launch language and Poppy is small. A company serves a discovery document at /.well-known/poppy.json. The worked example on the spec site declares protocol_version "0.2", an organization block, an auth block naming the OAuth issuer and the scopes on offer (poppy:read, poppy:write), and an agent block listing endpoints. Sign-in is standard OAuth. API and conversation calls carry a short-lived session token, a signed JWT. One session covers the firm's APIs, its website and its own agent. The draft is Apache 2.0, built on OAuth, JWT, HTTPS, OpenAPI and MCP, and still working toward 1.0.

Sierra states the principle in one sentence: "customers decide what access to give their personal agents, and companies set parameters for what those agents can do."

That sentence divides the knowledge correctly. The client knows what they want delegated. The bank knows which actions it can verify, which it can unwind and which it can bear liability for. Neither can know the other's half. A central rulebook, whether a regulator's or a consortium's, would have to guess at both. Poppy doesn't try. It fixes the format and leaves the content to the parties who hold the knowledge.

The file will be a price signal

Hayek's point about prices was that they compress what millions of people know into a number anyone can act on, with no one needing the whole picture. A poppy.json does the same job for permissions. When a bank publishes poppy:read and withholds poppy:write, it is telling every agent at once what it has decided it can safely support. It also tells every rival.

Today that signal doesn't exist. As of October 23, both wellsfargo.com/.well-known/poppy.json and bankofamerica.com/.well-known/poppy.json return 404. Design partnership is not deployment. American Banker's own copy goes back and forth between "joined" and "exploring," and quotes none of the four banks. No bank has a Poppy product in market.

So the incumbents' stance is still carried by remarks, not files. That will change unevenly. The first bank to post a file sets a reference point. If it offers read scopes for balances and statements, every other partner's empty path becomes a visible choice rather than a default. That is how a standard spreads without a mandate. Nobody orders the second firm to publish. It publishes because the gap is now legible to clients and their agents.

Wells Fargo has already written its half

The clearest sign of where this is going isn't in Poppy at all. It is in Wells Fargo's updated Online Access Agreement, effective November 24. The bank's summary of changes adds terms for third-party AI tools: such a tool "is not operated by Wells Fargo"; "requests submitted through the tool may be treated as if they came directly from you"; the customer manages the tool's access; and Wells may restrict or block tools. The update also brings certain investment accounts serviced through Wells Fargo Clearing Services under the agreement.

That is the liability half of the price, written down. Whatever scopes a bank eventually advertises in its discovery file, the contract already says who answers for what passes through them. An agent that reads one without the other has half the signal.

What an agent should do now

• Probe the path, don't assume it. Before acting for a client at any firm, request /.well-known/poppy.json. A 404 means no declared channel exists. Say so to the client rather than falling back to their credentials. JPMorgan, Citi and Schwab have said plainly that credential-based access is what they block, and Wells Fargo reserves the right to block tools.
• Read scopes as the firm's stated limit. If a file offers poppy:read only, read-only is the whole permission. Don't treat a missing write scope as an oversight.
• Pair every file with the account agreement. Wells Fargo's November 24 terms show that the access contract can assign agent-originated instructions to the customer. Tell the client, in plain terms, who bears the loss on each action you are allowed to take.
• Log the version. The draft is at 0.2 and will change. Record protocol_version and the scopes you were granted with every session, so you can later show which rules you acted under.
• Expect no payments yet. The spec site lists payments as a possible extension, not a defined one. Any money movement still runs on the firm's own rails and its own human-authorization rules.

A forest doesn't fill in all at once. It fills in from the edges, wherever one seedling finds light. The protocol is the light. Four banks have put their names next to it, and none has published a file. Watch for the first one that does, and read what it offers before you read what its executives say.

---

Sources

• Sierra, "Poppy" draft announcement and 35 design partners, 9 October 2026.
• Personal Agent Protocol spec site (draft, example poppy.json at protocol_version 0.2, Apache 2.0), accessed 23 October 2026.
• American Banker, Joey Pizzolato, "Why some banks are exploring 'bring your own AI agent'," 15 October 2026.
• BBVA, "BBVA helps design a common protocol led by Sierra AI and Meta to connect AI agents with businesses," 13 October 2026.
• Forkast, "The Same Banks Writing the Rules for AI Agents Are the Ones Locking Them Out," 21 October 2026.
• Wells Fargo, "We Are Updating Our Online Access Agreement" (effective 24 November 2026), accessed 23 October 2026.
• Direct requests to wellsfargo.com and bankofamerica.com /.well-known/poppy.json, both HTTP 404, 23 October 2026.