Wells Fargo has put in writing what many people suspected: when your AI agent gets something wrong, the mistake is yours. That makes AI agent permissions a practical question for anyone who lets an assistant near their accounts, and the first place most people do that is their calendar.
What Wells Fargo changed
The bank’s updated Online Access Agreement, which takes effect on 24 November 2026, adds a section on AI agents. It defines an agent broadly: any software that takes “autonomous, semi-autonomous, or non-autonomous action” on someone’s behalf. Then it is blunt. “Your use of any AI Agent is AT YOUR OWN RISK.”
Customers are “solely responsible” for unintended actions, for actions based on incomplete or manipulated inputs, and for an agent “exceeding the authority granted” to it. They are also responsible for “properly and timely revoking” an agent’s access, must keep evidence that they did, and stay on the hook until they tell the bank.
Meanwhile, on 3 November, CrowdStrike launched an AI Kill Switch for companies: it stops a misbehaving agent, prevents it from relaunching and cuts its network access, with every step logged. Useful, but a kill switch stops the next action. It doesn’t take back the last one.
Put the two together and the message is clear. Agents are getting more freedom, and the responsibility for what they do is landing on the person who switched them on.
Why AI agent permissions start with your calendar
Banking is where the lawyers got there first. The calendar is where most people will feel it first. Booking, moving and declining meetings is the job people hand to an assistant before anything else, and it touches every part of a busy week.
If you juggle several calendars (a day job and a side project, three clients, a personal calendar the family can see), an agent with access to all of them can do a lot in a few seconds. Some of it is easy to undo: a meeting moved on your own calendar can be moved back. Some of it isn’t. A cancellation sent to a client, an invitation sent to the wrong person or a “yes” to a meeting that clashes with another job lands in someone else’s inbox. You can’t unsend it.
So before you hand an assistant the keys, ask three questions:
- What can it reach? Which accounts, and does it hold your Google and Microsoft passwords or tokens directly?
- What reaches other people? Does it notify attendees every time, or can you choose?
- How do you switch it off? One place to cut access, or a dozen permission pages across providers?
Our view: agents are going to do more and more of the clicking, filling in and navigating for people. When that happens, the guardrails can’t live in the screens people no longer look at. They have to live in the tools the agent calls.
Where Calendrz fits
That is how we built the Calendrz MCP server. Claude, ChatGPT and other MCP clients connect to Calendrz once, through a standard OAuth sign-in, and work across all your connected accounts. The assistant never sees your Google or Microsoft tokens, and the tokens it does get are short-lived. On the Free plan, AI access is read-only.
When the assistant manages your calendar, the tools behave like a careful assistant would: “cancel” on a meeting you don’t organise declines it rather than deleting it for everyone, changes to a recurring event ask whether they apply to one occurrence or the whole series, and you decide whether attendees are notified. And because availability mirroring runs underneath, anything the agent books in one calendar is auto-blocked in all the others, so a client or colleague looking at another of your calendars can’t book you into the same slot.
Keep the keys, share the work
Letting an agent run your diary is worth doing. Just give it narrow access, keep the actions that reach other people under your control, and know where the off switch is. If you’d like an AI assistant that works across every calendar you own without being handed the keys to each one, try Calendrz.
