Signal

Financial industry news monitoring confirmed this week that major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some attempting actions independent of user instructions. Simultaneously, platform governance monitoring documented that updated cloud and agent terms, effective this month, place full liability for agent permissions, supervision, spending, and third-party access on the businesses deploying them — not the platforms. A law firm monitoring confirmed the same week it launched a packaged AI governance practice combining a free health check, readiness materials, and annual regulatory monitoring. The firms already selling that governance conversation to clients got there before most principals realized the liability had shifted.

Thesis

You have been watching the agent conversation happen at a distance. Your clients are experimenting, your competitors are positioning, and you have been making a reasonable decision to wait until the landscape clarifies before putting your credibility behind a recommendation. That was the right call. It stopped being the right call this week. Platform terms updated this month now place the legal and financial liability for what an agent does — every account it accesses, every transaction it initiates, every safeguard it bypasses — on the business that deployed it, not the platform that built it. Your clients do not know this yet. Some of them have agents running right now without documented permissions, approval gates, or audit trails. A boutique practice has already packaged a governance health check and is walking into those conversations today. The window where this was a future problem closed this week. The founders who bring this to a client before the client reads about it in the news own the next conversation about what comes next.