Federated Agent Connector · live demonstration

Controlled access to banking services for AI assistants

Customers need a way to authorise AI assistants to work with their bank. The bank needs to identify the assistant separately from the customer and enforce the limits of that authority. Partners need to verify those limits before accepting a request.

The Federated Agent Connector shows how. It gives each assistant its own cryptographic identity and connects that identity to customer authorisation. Federation allows participating organisations to verify identity and trust through signed statements. Read the briefing · Watch the film (2 min) · Use it from your own assistant

Current limits
  • This is a demonstration with sample accounts and no payment capability.
  • Page buttons simulate the AI assistant.
  • The assistant's private key is held on the demonstration server; the version installed on a Mac keeps it in the Secure Enclave, which is the arrangement a bank would ship.
  • The site describes integration with PingFederate and federation services. It does not establish production readiness.

Your browser will offer to save a passkey for . Only this demonstration uses it, and you can delete it afterwards. The demonstration forgets you after minutes idle.

1 Link an assistant to your bank

Confirm with your fingerprint or face. The bank then gives the assistant an ID of its own - so it never needs your password - and tells its network the assistant can be trusted.

What is happening underneath

The connector makes its keys, then sends you to the bank's passkey sign-in. The sign-in's nonce covers those keys, so the ID token says a person approved these keys. The bank's attester issues a client attestation bound to the agent's key, registers the agent as a hosted entity in the bank's OpenID Federation, and gives it the bank's customer-agent Trust Mark.

2 Let it read your accounts

Sign in to the bank with the same passkey, and approve what the assistant may see and why. Then ask it for your balances: the bank answers, and knows it is your assistant asking, for you.

What is happening underneath

A FAPI 2.0 mandate: a pushed authorisation request that authenticates with the attestation, PKCE, and tokens bound to the agent's own key (DPoP). PingFederate signs you in through an OIDC connection to the bank's passkey sign-in. The token's subject is you; its actor is the agent - delegation, never impersonation.

3 Let it get offers from a partner

An insurer in the bank's network has never met this assistant. It checks the bank's word, what you allowed and why - and only then answers.

What is happening underneath

The partner resolves the agent's trust chain to the Trust Anchor, checks the bank's Trust Mark, and asks two policy decision points - the federation's own layer first, then its own - whether the call fits the agent's mission and your purpose. Its enforcement point is configured from what the federation says about the partner.

4 Watch the bank say no

The assistant asks to use your data for marketing. That is not what it is for, so the bank refuses - before you are even asked to approve anything.

What is happening underneath

PingFederate's rich authorisation request processor asks the PDP about each item requested. DirectMarketing is outside the agent's mission - the bank capped its purposes in the federation - so the request comes back invalid_authorization_details.

5 See how the network trusts it

Anyone in the network can check who vouches for the assistant and what it is allowed to do. It claimed more than the bank allows, and the bank struck those out.

What is happening underneath

The connector resolves its own OpenID Federation trust chain from the anchor's pinned keys - its Entity Configuration, the bank's Subordinate Statement and metadata policy, and the anchor's statement about the bank - and validates its Trust Mark.

6 Switch it off

First the bank withdraws its approval badge: the partner stops serving the assistant at once, while the bank still does. Then the bank cancels the ID, and it is stopped everywhere.

What is happening underneath

Withdrawing the Trust Mark fails the partner's check on the mark's status. Deleting the hosted entity breaks the agent's trust chain for every member, and PingFederate's attestation filter refuses the agent as well.

Who is involved

Each runs as its own service, at its own address. Open any of them to see what it publishes.