We want an AI assistant to read our business bank account, categorize transactions and prepare bill payments. How do we connect it so it can't send money on its own, what can it still change without approval, and what should we avoid giving it?

What should I check, step by step?

1. Use the bank's official agent connection (for Mercury, its MCP server at its official address) with OAuth. Don't share your password, let the agent drive your signed-in browser or give it a general API token.

2. Connect the agent from a person whose role is no broader than the job, because the role sets the ceiling; then grant only the scopes the task needs. Start read-only and add a write scope only when a task requires it.
3. Grant payment and transfer request scopes only if the agent prepares payments, and confirm in the bank's docs that requests can't be approved by the same connection.
4. Leave out scopes for actions that apply immediately unless the job needs them: in Mercury, budgets:manage lets the agent change a published budget's amount per person, archive budgets and reassign transactions without a separate approval.
5. Approve every request in the bank's app after checking the recipient or destination account, amount, payment method and timing. Treat "request created" in chat as nothing more than a request.
6. Have the agent check for an existing request before creating another after an error or timeout, so a retry doesn't leave two payment requests for one bill.
7. If an agent needs a card, give it a dedicated agent card with its own limit rather than access to your main cards. Mercury's agent cards can't have their limits raised or be unfrozen through its API.
8. Keep the agent away from untrusted content in the same session (emailed invoices, web pages, shared docs), or at least away from write scopes when it reads them, because prompt injection can create unwanted requests or leak data.
9. Review the agent activity log regularly and disconnect agents you no longer use; check that leavers' agents were disconnected.

Can an AI agent connected to Mercury send money without approval?

Mercury's announcement describes five layers: who can connect agents (Admins and Bookkeepers can, Teammates can't, custom roles choose), how much access an agent gets (never more than the connecting person, and you can scope it down), a permission check by Mercury on every request, a person approving every payment, and disconnecting an agent in seconds. When an employee is removed, their agents disconnect automatically, and payment requests an agent prepares are marked so the approver knows an agent was involved.

• The MCP docs (in beta) list eleven write tools, each behind its own OAuth scope, and existing read-only connections have to reauthorize before they can use one. requestSendMoney creates a payment request to an existing recipient and requestTransferMoney a transfer between your own accounts; both require approval in Mercury. The docs say the AI tool can't approve the request or move money on its own, that the organization's approval policies still apply, and that where those policies would allow the payment without approval, the requester must approve it in Mercury.
• That is the property to look for in any bank: the agent can prepare, a person decides in a channel the agent can't reach, and the bank enforces it on its side. If approval runs through a code the agent can read, such as an emailed one-time password, an agent with inbox access can approve itself.

What can an AI agent change in a Mercury account without approval?

Mercury's supported-tools page says createCategory, editCategory and updateTransaction (notes and categories) apply immediately. The budget tools do too: updateBudget changes a budget's name, amount per user, frequency or dates immediately, with a published budget getting a new version; archiveBudget archives a published budget or deletes a draft; and assignTransactionToBudget moves a transaction between budgets. createBudget only makes a draft that a person must publish.

• So an agent with budgets:manage can raise a team budget's per-person amount without asking anyone. Money still doesn't move without approval, but spending room for people or cards on that budget can change. Grant that scope only to agents whose job is budgeting, and review the budget's version history.
• Read access carries its own risk. The security guide notes it exposes balances, full transaction history, recipient routing and account numbers, statements and card information, and that this data could leak if the AI tool is compromised or follows injected instructions; it also says the approval requirement doesn't protect against every data disclosure or immediate edit.

Should you give an AI agent a bank API token or your login?

A read-and-write API token. Mercury's API also has a send-money endpoint whose reference says it creates a transaction that will be processed immediately or may require approval, alongside the request-to-send-money endpoint that always goes through approval. Its token policy requires an IP allowlist for read-and-write tokens and automatically downgrades tokens that hold more permission than they use in 45 days, but an agent holding such a token isn't limited by the MCP's request-only design.

• Your login or browser session. Mercury's announcement notes that agents working through a person's browser make it hard for the bank and the business to tell person-led actions from agent-led ones, and that many banks respond by blocking agents entirely.
• Your main cards. Mercury's agent cards are virtual cards a person creates and hands to an agent through the Vault API (not through MCP); the agent can't create agent cards, raise their limits or unfreeze them via the API, which caps exposure at the cards you handed over.