No Jail Holds an Agent Forever: Why Agentic Controls Are Not Enough in Open Banking, and What Might Be

In Open Banking, AI agents can act on a customer's behalf, and the bank's checks confirm who the agent is, what its token allows and whether consent is still on record. None of those checks sees how the agent reads what the customer authorized, and that reading can drift within a session that passes every check. When it drifts outward, the agent acts beyond what the customer agreed to, which is a consent failure and a liability for whoever runs the agent; when it drifts inward, the agent refuses what the customer did authorize, which is a service failure. Closing this gap calls for anchoring: a stabilizer that keeps the customer's authorized scope, its source and the task's need in force while the agent decides. I theorize that only an internal stabilizer, an anchoring ability trained into the model, can hold in the long run, and that a carefully designed external stabilizer might be the second best. Both are proposals, not tested results; the companion paper, Part II, sets out the external design and an experiment to start testing it.Theory and framework created and written by the author; drafted and researched with AI assistance; reviewed and edited by the author.