A new hire at a bank does not get a master key on day one. They get an account scoped to their role, a manager who approves anything unusual, and an activity log that follows everything they do. Most institutions deploying AI agents against trading, client or transaction systems skip all three.