This piece has been authored by Zack Anderson, Chief Data & Analytics Officer for Payments and Global Banking, J.P. Morgan

A prompt expresses intent; it does not enforce authority. An agent can be told that it has no internet access, must not share data, or may only invest within a defined mandate. Those instructions matter, but they constrain behavior only if the tools, communications channels, and execution paths enforce them.

Recent incidents underscore the gap. In one cybersecurity evaluation, an agent that was instructed it had no internet access still produced malware that executed on real systems - because the test environment had an unintended route to the internet. A broader review associated with that evaluation also identified unauthorized access affecting multiple organizations.

In another set of agent evaluations, agents turned an internal package service into a persistent message board, shared discoveries across separate runs, and compromised parts of external production infrastructure. In related tests, agents also breached internal research infrastructure and accessed sensitive secrets at scale.

The National Institute of Standards and Technology (NIST)’s agent identity and authorization project⁠ and Open Worldwide Application Security Project (OWASP)’s public-preview Agent Control Standard⁠ are working to address important parts of this problem. Agent Control Standard, an open standard managed under OWASP, provides runtime hooks and policy enforcement.

Leading developers are also making the necessary response more concrete. They describe controls such as: classifiers that can block a tool call before execution, terminate a task, and alert a human; and evaluations explicitly focused on unauthorized agent-to-agent communication. These are useful additions, alongside restrictions on what the environment allows.

I still use one test: which action would our deployed control have stopped?

There’s also a lesson in how we define objectives in prompts. Let’s explore an example in Payments:

“Invest all cash above our £100 million liquidity buffer overnight.”

That sounds clear. Yet it leaves the legal entity, permitted currencies and instruments, and counterparty limits unstated. The buffer could remain intact while all surplus goes to a counterparty we would never approve.

A mandate needs to specify the permitted means and when to stop. If no authorized placement is available, leaving the cash uninvested and asking for direction must count as a valid result.

Given these possible outcomes, an optimal system design for agentic payments should include an independent policy engine, or similar tool, that checks the agent, who it represents, and its mandate against the proposed action. To ensure accuracy against exposure limits, any exposure checks carried out by the policy engine should include completed and pending transactions across agents acting under the exposure-bound mandate; otherwise, the exposure calculation may inaccurately omit in-flight transactions and cause the mandated limit to be exceeded. An execution service in this system must enforce the decision before cash moves, through a path the agent cannot bypass or reconfigure. The decision and policy version should remain linked to the transaction to support auditability and evidentiary traceability.

Persistent communication between agents needs the same treatment. Shared memory, queues, and message boards between agents can carry instructions into a later run. In developing agents, we should use clear approaches to authorize what agents may communicate, for which task, and who may read or write the retained state; and set expiry and revocation rules, while preserving an audit record the agents cannot alter. When appropriate safeguards are implemented, a message from another agent should not, by itself, have the ability to expand the recipient’s mandate.

 In testing a system with the above controls, an authorized placement should pass. A placement with an unapproved counterparty should fail, even if it preserves the buffer. Repeat that request through another agent and a message saved from an earlier run. Neither route should get the transaction accepted.

In Proof of Movement: AI, Autonomy and the New Architecture of Corporate Cash⁠, I described treasury as Sense → Predict → Decide → Execute → Audit. The authority check belongs between Decide and Execute.

Prompts express what an agent is meant to do. Enforceable controls determine what it can actually do: which tools it may call, which agents and channels it may communicate with, and which execution paths may accept an action. When agents can move money, authority cannot remain in the prompt. It must be checked and enforced at every boundary where instructions become tool calls, messages, or transactions.

At J.P. Morgan Payments, we are building our agentic platforms, such as our agent runtime platform for the Payments Technology team, with these best practices in mind. 

Hear from J.P. Morgan Payments on enterprise payments intelligence and more at leading industry conference Sibos 2026, Sept. 28-Oct. 1 in Miami. Check out recent insights from J.P. Morgan Payments around artificial intelligence: 

• Innovation, risk and value in a changing payments landscape
• From side projects to client solutions: How AI experimentation is shaping J.P. Morgan Payments
• Four takeaways on AI’s next phase in payments

Disclaimers:

_{J.P. Morgan, JPMorganChase, Chase, Chase Merchant Services, and Chase Payment Solutions are marketing names for certain businesses of JPMorganChase and its subsidiaries worldwide (collectively, “JPMorganChase”). Products or services may be marketed and/or provided by commercial banks such as JPMorgan Chase Bank, N.A., securities or other non-banking affiliates or other JPMorganChase entities.  JPMorganChase contact persons may be employees or officers of any of the foregoing entities and the terms  “J.P. Morgan”, “JPMorganChase”, “Chase”, “Chase Merchant Services” and “Chase Payment Solutions” if and as used herein include as applicable all such employees or officers and/or entities irrespective of marketing name(s) used.  Nothing in this material is a solicitation by JPMorganChase of any product or service which would be unlawful under applicable laws or regulations.}

_{In preparing this material, we have relied upon and assumed, without independent verification, the accuracy and completeness of all information available from public sources or which was provided to us or which was otherwise reviewed by us.  This material is for discussion purposes only and is incomplete without reference to any  other applicable briefings provided by JPMorganChase.  Neither this material nor any of its contents may be disclosed or used for any other purpose without the prior written consent of JPMorganChase.}

_{This material is not intended to provide legal, tax, investment, accounting, financial, business, real estate, technology or other advice, and should not be used for or relied upon for these purposes. The views, opinions, estimates and strategies expressed in this material are those of the respective individual contributors, authors or speakers, and may differ from those of JPMorganChase, or its employees and affiliates. Any market and/or economic commentary in this material in no way constitutes JPMorganChase research and should not be treated as such. Further, the views expressed in this content may differ from those contained in JPMorganChase  research reports. The content in this material has been obtained from sources deemed to be reliable, but JPMorganChase makes no representation or warranty as to its accuracy or completeness. In no event shall JPMorganChase nor any of its directors, officers, employees or agents be liable for any use of, for any decision made or action taken in reliance upon, or for any inaccuracies or errors in or omissions from, this material.}

_{The information in this document may be based upon management forecasts supplied to us and reflects prevailing conditions and our views as of this date, all of which are accordingly subject to change.  JPMorganChase’s opinions and estimates constitute J.P. Morgan’s judgment and should be regarded as indicative, preliminary and for illustrative purposes only.} 

_{Not all products and services are available in all geographic areas. Eligibility for particular products and services is subject to final determination by JPMorganChase and or its affiliates.  This material does not constitute a commitment by any JPMorganChase entity to extend or arrange credit or to provide any other products or services and JPMorganChase reserves the right to withdraw at any time. All products and services are subject to applicable laws, regulations, and applicable approvals and notifications.}

_{Any mentions of third-party trademarks, brand names, products and services are for referential purposes only and any mention thereof is not meant to imply any sponsorship, endorsement, or affiliation.}

_{Notwithstanding anything to the contrary, the statements in this material are not intended to be legally binding.  Any products, services, terms or other matters described herein (other than in respect of confidentiality) are subject to, and superseded by, the terms of separate legally binding documentation and/or are subject to change without notice.} 

_{JPMorgan Chase Bank, N.A. Member FDIC. Deposits held in non-U.S. branches are not FDIC insured. Non-deposit products are not FDIC insured.}

_{JPMorgan Chase Bank, N.A., organized under the laws of U.S.A. with limited liability.}

_{© 2026 JPMorgan Chase & Co. All Rights Reserved.}