Clients' AI agents have started writing to businesses. Your firm needs a rule for them
Personal AI agents now send emails, fill in forms and negotiate for the people who use them. When one writes to your firm for a client, staff need to know what it may ask for, what it may change and what it may agree to.
Good Transformer is Patrick Hussey's AI practice. Want help with this in your business? Get in touch.
When the Wharton professor Ethan Mollick's AI agent noticed that one of his American Airlines credits was about to expire, he asked the agent to act. The agent, Meta's Muse, "contacted American to request an extension", he wrote on 1 October. Mollick did not write to the airline himself.
Meta says this is what Muse is for. It "can handle tasks, like sending an email or booking travel", and "It can open a browser, fill out forms, and negotiate on their behalf" (Meta). Similar agents arrived within weeks of each other: SpaceXAI released Grok Bot on 11 August, Meta launched Muse on 8 September and OpenAI released its dots agents on 29 September.
Large companies have started deciding who answers for what these agents do. In an email to customers reported by TechCrunch on 27 October, Bank of America told them not to give their login to "an AI-enabled tool or agent that offers to act on your behalf". It added: "If you do share your credentials, keep in mind that you're responsible for activity resulting from that access" (TechCrunch). In other words, the bank's position is that the customer answers for the agent.
A small accountancy, law or advisory firm faces the same question from the other side. A client's agent may write asking for a copy of last year's accounts, a new meeting time or a lower fee. If the firm acts on it and the client never meant it, who answers for that, and how should staff tell which requests are safe to act on?
What a client's AI agent is
A personal AI agent is software that acts for one person. It can read that person's email, write and send messages, fill in forms and, with permission, pay. Meta says people choose what Muse can do, "whether it reads their mail or can also send on their behalf".
Accountants already use the word "agent" for the firm itself when it deals with HMRC for a client. In this piece an agent means the software.
The detail that matters for a firm is where the message comes from. An agent that has been allowed to send on its owner's behalf can send from the owner's own email account. Its message then arrives from the client's usual address, under the client's name. The firm cannot tell from the sender line whether the client wrote it, or whether the client read it before it went.
Why this is happening now
These agents are new, and they are built to deal with businesses for their owners. Some have already done things their owners did not intend. In our piece on agents as customers we described a Muse user who had given the agent "always allow" permission. The agent gave a buyer the owner's home address, and told another buyer the owner would accept less than the minimum price the owner had set. An agent writing to a professional firm could make the same kind of mistake with a client's affairs.
The agent companies are trying to agree how agents and businesses deal with each other. On 6 October the AI company Sierra and Meta announced the Personal Agent Protocol, a proposed shared standard for how an agent signs in to a business and what it is allowed to do there. Sierra's co-founders Bret Taylor and Clay Bavor wrote that under it "consumers decide what access to give their personal agents, and companies set parameters for what those agents can do" (Sierra).
The standard is still being drafted, and it covers companies' websites, apps and their own customer service agents. The announcement does not mention email. So a firm that receives a message from a client's agent has to set its own limits.
What the agent companies gain
The stated reason for the standard is speed. Sierra says agents today mostly use websites the way people do, which can be slow and can fail, and that "a direct connection could get the same task done securely in seconds".
There are business reasons as well. The company that runs a person's agent handles that person's dealings with every business the agent contacts. Ebrahim Poonawala, an analyst at Bank of America Securities, said the strategic question for banks is "who owns the agent, the wallet and ultimately the customer relationship", as we reported on 20 October. Sierra itself sells AI customer service agents to companies, so in our view a standard that connects personal agents to companies' systems also suits its business.
What existing rules say about someone acting for a client
We have found no UK regulator rules on clients' AI agents. But professional firms already deal with people who act for clients, and two existing rules show how regulators treat them. Accountancy bodies have their own codes; we quote the solicitors' rule because it states the principle plainly.
The SRA Code of Conduct for solicitors says: "You only act for clients on instructions from the client, or from someone properly authorised to provide instructions on their behalf. If you have reason to suspect that the instructions do not represent your client's wishes, you do not act unless you have satisfied yourself that they do" (SRA). The same code requires solicitors to keep clients' affairs confidential unless the law requires or permits disclosure, or the client consents. So sending a client's papers somewhere the client did not choose could put a firm in breach of that duty.
Data protection law gives people the right to ask an organisation for a copy of the personal information it holds about them, known as a subject access request. A client's agent asking for all the personal information the firm holds about the client would be making one. The Information Commissioner's Office (ICO) has guidance on such requests when they come through online services, which it calls portals, that act for people. It says: "A person's agreement to the terms and conditions of the portal's service is unlikely to be evidence of appropriate authority." If a firm is concerned the person has not authorised the request, the ICO says it "should contact the person before responding" (ICO).
Neither rule mentions AI agents. But both point the same way. Someone acting for a client has to be authorised, a firm in doubt checks with the client, and signing up to a service does not show that the client wanted a particular request made.
Which requests carry the risk
Any message from a client's agent might be one the client did not mean. An agent can misread its owner, or act without asking if its owner has loosened its approval settings. For most messages that does not matter: if the client did not mean to ask about a filing deadline, answering costs nothing. The risk sits in three kinds of request.
The first is sending documents or client information somewhere new. Replying to the client's usual email address keeps the information with the client, who chose to let an agent read their mail. Sending files to a new address or upload link could put them in the hands of someone the client never chose.
The second is a change to the client's details or instructions, such as new bank details for a refund or a change to the work. Firms already treat a request for new bank details with suspicion, because someone who gets into a client's email account can send convincing messages from it. Agents add a second reason. A message from the client's address used to mean the client wrote it. Now it may have been written by software the client did not check.
The third is an agreement: a lower fee, a change of scope, a signature, submitting a return. If the firm agrees and the client later says they never asked, it is not yet settled who carries the cost. Bank of America puts the cost of a shared login on its customer, but a firm acting on an agent's request is in a different position, and we have found no UK court decision or regulator guidance on who answers in that case.
For now, a rule for what a client's agent may ask, change and agree
The simplest rule sorts every message by what it asks the firm to do, not by who seems to have sent it. For the checks, use contact details already on the client's file: the phone number and email address the firm has confirmed with the client, never ones given in the message itself.
| The message asks the firm to | Example | What staff do |
|---|---|---|
| Answer a routine question about the client's own work | A filing deadline, the date of the next meeting, your published fees | Answer, by replying to the client's usual address |
| Send documents or client information | A copy of last year's accounts | Send only to an address or portal already on the client's file |
| Change the client's details or instructions | New bank details, a new address, a change to the work | Phone the client on the number on file before acting |
| Agree to something binding | A lower fee, a signature, submitting a return, accepting an offer | Phone the client on the number on file before agreeing |
Most firms already phone the client before acting on new bank details. The rule extends that call to every change and every agreement, because a message from the client's address no longer shows that the client wrote it.
We suggest the phone call as a measure for now, not for good. Agents are new, the standards that would let one show who it acts for and what its owner approved are still being drafted, and firms are already on alert after this month's PHP security emergency, when AI helped turn an old software flaw into a working attack. While agents and the rules around them settle, a call is the cheapest check a firm has. Once agents can prove what their owner approved, a firm can drop the call for small, routine changes and keep it for bank details and anything binding.
If your firm also uses AI agents of its own, our piece on giving AI agents their own accounts covers how to set those up.
What to do this month
- Write the four-row rule down and give it to everyone who answers client email, including reception and junior staff. Name one person, such as the practice manager, who owns it.
- Check the client file. The rule depends on having a confirmed phone number and email address for each client. Fill any gaps now, while nothing is urgent.
- Tell clients how you treat messages from their agents. One line in the engagement letter or onboarding pack is enough: for now, the firm will answer routine questions from a client's AI agent, and will confirm changes and agreements with the client by phone.
- Keep a log for three months of every message that says it was sent by an AI agent or assistant, what it asked and what the firm did. That shows how often it happens.
- Review the rule when the three months are up. Agents will gain new abilities, and standards such as the Personal Agent Protocol may be built into the software smaller firms use. Decide then whether the phone call is still needed for every change, or only for bank details and anything binding.
Rules like this belong in a firm's AI policy, which our AI Strategy work covers; get in touch to talk it through.
Common questions
How can you tell if an email was written by an AI agent?
Often you cannot. An agent with permission to send from a client's email account writes from the client's own address, and its email can read like the client's. Judge the request by what it asks the firm to do, not by whether you can spot who wrote it.
Should a firm refuse to deal with clients' AI agents?
No. Answering a routine question by replying to the client's usual address carries little risk and saves both sides time. Keep the checks for anything that sends client information somewhere new, changes the client's details, or commits the firm or the client to something.
Is an instruction from a client's AI agent valid?
We have found no UK rule yet that deals with clients' AI agents directly. Existing professional and data protection rules expect someone acting for a client to be authorised, and a firm in doubt to check with the client. For now, phone the client before acting on any change or agreeing to anything, and take advice on a specific case.
Sources
- Ethan Mollick, The dot and the swarm, One Useful Thing, 1 October 2026
- Meta, Introducing Muse, 8 September 2026, updated 30 September 2026
- TechCrunch, Bank of America kindly asks that you don't share your banking password with your AI assistant, 27 October 2026
- Sierra, Introducing Personal Agent Protocol, Bret Taylor and Clay Bavor, 6 October 2026
- Solicitors Regulation Authority, SRA Code of Conduct for Solicitors, RELs, RFLs and RSLs, paragraphs 3.1 and 6.3
- Information Commissioner's Office, How do we recognise a subject access request (SAR)?, amended 7 April 2026
This is general information, not legal advice.
Work with Patrick
Want a clear AI plan for your business?
AI Strategy is two to three weeks with your leadership team: a 90-day plan, the use cases worth doing and a plain-English policy. Email, call or book a free 30-minute call.