Human in the loop AI is a simple idea that is easy to get wrong: a person approves what an agent is about to do before it happens. Last week some of the biggest banks in the U.S. found out what it looks like when that step is missing, and their answer was to block or restrict agents. If you are connecting agents to your own business, this is a good week to decide where your approvals go.
According to The Rundown's write-up of an Axios report, JPMorgan, Bank of America and Morgan Stanley are among the banks restricting third-party AI agents. They found agents logging in to customer accounts with the customers' own credentials, against the banks' rules. Some called support lines or took actions the customer never asked for.
In most cases the customers had authorized the agents themselves. One bank executive told Axios they are struggling to tell those apart from rogue ones. Morgan Stanley is blocking third-party agents, JPMorgan, Bank of America and Citi are restricting them, and most banks are moving toward read-only access.
For the authorized agents, a person chose to connect each one and handed it a login. In the cases the banks flagged, nobody approved what the agent did after that, and the bank could not tell the agent from the customer.
Human in the loop AI means a person reviews and approves an AI system's action at a defined point, before that action takes effect. For an agent working in your business, that breaks down into four parts:
Approving an agent once, when you connect it, is a different decision. It settles whether the agent should exist. It says nothing about the email the agent sends at 2am next Tuesday.
Some teams talk about "human on the loop" instead, where a person watches the system and can step in after it acts. That can be fine for low-stakes work in high volume. For anything that reaches a client or a bank account, I want the person in the loop, at the moments that matter.
The same week, Anthropic opened a research preview of Claude Duet, an agent app for professionals and small business owners that keeps working in the background across your connected apps. Its approval rule is the clearest one I have seen from a big lab. Duet reads, drafts and prepares work on its own. Before it sends a message, makes a payment, signs a document or deletes anything, "it shows you exactly what it's about to do and waits for your approval."
Two other details are worth copying. Some actions are off-limits even with your approval, and Anthropic names trading securities and moving money between accounts. Duet's handling of credentials is also designed so it never directly sees your passwords or sign-in tokens.
Put that next to the bank story and the gap is plain: the bank agents held the customer's own password, so to the bank they were the customer.
Getting this right takes a few decisions, written down where your team can find them.
We run BYLD on Byld Ops, and its AI assistant follows this pattern. It can search everything in Byld Ops, draft replies and proposals, update records and create tasks when someone asks it to. Anything that leaves the company needs sign-off from a person. Sending a proposal, emailing an invoice or recording a payment sits in an approvals queue until someone on the team approves it.
Outside agents get their own access too. Byld Ops exposes its tools over MCP, and a connected agent works through a key, with the same permissions as the person who issued it.
On the product side, BacklinksAI, which we built, matches users with journalists' requests for expert sources, and its AI writing assistant helps users compose their responses.
If you want this set up in your own business, our AI chief of staff page covers how we deploy Byld Ops.
An AI system where a person reviews and approves an action at a defined point, before it takes effect. With agents, that point is usually anything that sends, pays, signs or deletes.
In the loop, a person approves before the action happens. On the loop, a person monitors and can step in after it acts. Use in the loop wherever a mistake would reach a client or move money.
No. Give it its own access with limited permissions. When an agent signs in as you, nobody can tell its actions from yours, which is the problem the banks ran into.
If you are working out where the approvals belong in your own operations, book a call below and I will go through it with you.