Expose the card management system to the agent as a short list of named capabilities, each with its own depth: read status, freeze and unfreeze, cancel, order a replacement, adjust controls. Pass tokens, never full card numbers. Hold replacements and limit changes that hit risk rules, withhold PIN and card number reveal, and log every call.
What does the connection involve, and who owns it?
A card management system holds the life of every card: issue, activation, status, controls, limits, replacement and closure. Connecting an agent to it lets customers fix card problems at any hour. It also puts a fraud-sensitive system within reach of software that reads untrusted text all day.
The card platform owner approves each capability. Information security owns the boundary with card data. The fraud team owns hold rules. The integration team builds and runs the connection. Our guide to AI agents in banking covers where this sits among other banking systems.
Which capabilities should you expose, and at what depth?
| Capability | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Read card status and controls | Looks up status, last four digits, controls | 1 | Nothing |
| Freeze and unfreeze | Applies or lifts a temporary freeze | 3 | Unfreezing a card frozen by the fraud team |
| Cancel | Permanently blocks on authenticated request | 3 | Cancellations without full authentication |
| Order replacement | Orders to the address on file | 3, or held | Any order that trips an address or velocity rule |
| Adjust card controls | Switches online, abroad or contactless use on or off | 3 | Nothing within customer choices |
| Change spending limits | Prepares the change | 2, or held | Any increase beyond the customer's set limits |
| Reveal PIN or full card number | Not available | withheld | Customer's own secure channel only |
Freezing is the clearest case for agent action; the reasoning is in whether an AI agent can freeze a customer's card. Replacement carries more risk, for reasons set out in whether an AI agent can issue a replacement card.
How do you connect it, step by step?
- Person, card platform owner: approves the capability list. Start with read and freeze; add others as the agent is certified to the depth each needs. Evidence: an approved list.
- Information security: keeps card data out of the agent's path. The agent receives tokens and last four digits, never the full card number or security code. That keeps the agent, its prompts and its logs outside the card data environment that PCI DSS v4.0 governs. Evidence: a data flow diagram and masked samples.
- Integration team: creates one route per capability. "Freeze card" is a route; "update card" with a free-form payload is not. Evidence: route list.
- Integration team: gives the agent its own identity. Not the identity used by the mobile app or contact centre. Evidence: identity and grants.
- Fraud team: writes hold rules. Recent address change, several replacements in a short time, a freeze applied by fraud, failed authentication. Evidence: rules as versioned bounds.
- Platform, on each call: checks the minimum chain. Capability in scope, certificate in date, sources signed, customer's limits, platform guardrails. Evidence: verdict per call.
- Integration team: wires revocation. Each capability can be switched off alone, and the whole connection can be cut in one step. Evidence: revocation drill results.
- Platform: logs every call. Agent, customer, card token, capability, verdict, outcome. Evidence: the log, kept with the verdict record.
Which controls matter, and what evidence do they leave?
Tokens, not card numbers. Evidence: no full card numbers anywhere in agent context or logs, checked by automated scanning.
Customer authentication before change. The agent may read and freeze with lighter checks; it may cancel, replace or change controls only for an authenticated customer. Evidence: authentication result on each verdict.
Fraud freezes are sticky. A freeze placed by the fraud team can only be lifted by the fraud team. Evidence: refused verdicts when the agent attempts it.
Hold rules enforced at the action. Evidence: held verdicts naming the rule.
Revocation per capability. If replacements go wrong, you switch off replacements, not freezes. Evidence: per-capability switch history.
Depth earned. Card operations suit depth 3 once evidence exists, but not before; the argument is in card operations suit depth 3. Evidence: a certificate per agent.
What should you measure?
- Calls per capability, and verdict mix.
- Held replacements confirmed as fraud attempts.
- Attempts to lift fraud freezes. Any number above zero needs a look at the agent's brief.
- Time to freeze from customer request.
- Card data scanning results. Should show nothing.
- Control changes reversed within a day, such as online or abroad use switched back, which can show the agent misread the request.
Where does it usually go wrong?
One wide integration account. The agent connects with the same credentials the contact centre desktop uses and inherits every right it has, including ones nobody intended.
Card numbers leak into transcripts. A customer types their full card number into chat. The agent must mask it on intake and never repeat it.
Fraud and service freezes are confused. A customer asks to unfreeze; the agent obliges; the freeze was the fraud team's.
Replacements bypass the address check because the route did not pass the address history to the platform.
Every system is connected the same way. Card systems need hold rules and data masking that other systems may not. Compare with connecting an agent to your collections system, where the sensitive part is customer contact rather than card data.
Questions people ask
Does connecting an agent bring it into PCI DSS scope?
It depends on whether card data reaches it. Designing the connection so the agent sees only tokens and last four digits is the simplest way to keep it outside the card data environment. Confirm your scope with your assessor.
Can the agent change a card's spending limit?
It can prepare the change. Decreases the customer asks for can run within bounds; increases beyond the customer's own set limits are held for a person.
Should the agent activate new cards?
It can, at depth 3, when the customer is authenticated and the card was sent to the address on file. Activation for a card sent elsewhere should be held.