# When the borrower sends an agent: making a lending operation personal-agent ready

*Personal agent readiness*

> Personal AI agents are being built to shop, apply and ask questions for borrowers. What changes for a mortgage lender, what being ready earns, and the technical stack it takes — discovery, agent identity, borrower consent, scopes, approvals and audit.

**The next borrower to reach your front door may not be a person. It may be their agent — signed in on their behalf, comparing you with other lenders at once, and asking for an answer it can verify.**

Personal agents are moving from demos to consumer products, and published drafts now describe how they should work with a business: through delegated, scoped access to the business’s own systems and agent, rather than by scraping its website. Mortgage lending is a natural fit, because the borrower already does the work an agent is good at — comparing offers, collecting documents and chasing status. This guide covers what changes for a lender, what being ready earns, and the stack it takes, layer by layer.

## Where things stand

Each figure links to its source.

- **82%** — of respondents in an Experian study trusted language models to compare loans, as cited by Cornerstone Advisors. ([Source](https://www.crnrstone.com/gonzobanker/how-banks-can-win-in-an-agent-driven-world))
- **54%** — of homebuyers got just one offer, from one lender, on their most recent mortgage, per LendingTree. ([Source](https://www.lendingtree.com/home/mortgage/shopping-around-survey/))
- **0.3** — the public draft of the Personal Agent Protocol, which sets out how an agent signs in, asks for permissions and requests approvals at a business. ([Source](https://personalagentprotocol.org/docs/0.3/guides))
- **Mar 2026** — when Freddie Mac’s requirement for sellers and servicers to govern the AI they use took effect, under Bulletin 2025-16. ([Source](https://www.americanbanker.com/news/freddie-mac-updates-selling-guide-to-mandate-ai-policies))

## Five shifts for a lender

The useful question is not whether borrowers will trust an agent to take out a mortgage. It is whether they will trust one to tell them where to apply.

### 1. The shortlist is the new front door

Cornerstone Advisors argues that agents will shape which providers a consumer considers before the consumer visits any of them. For a lender, being on that shortlist becomes the first job of marketing, and how often you are considered becomes a number worth measuring beside how often you convert. ([Source](https://www.crnrstone.com/gonzobanker/how-banks-can-win-in-an-agent-driven-world))

### 2. Every borrower can be a comparison shopper

Most borrowers take one quote today. An agent can ask several lenders the same question at once. Where that happens, the price and the speed of a verified answer separate lenders more than being the first call does. ([Source](https://www.lendingtree.com/home/mortgage/shopping-around-survey/))

### 3. Detail becomes visible

Our view: a careful agent can read what a hurried borrower skips — fees that are hard to find, conditions that arrive late, terms that move at closing. A cleaner loan experience gets easier to see, and a worse one gets harder to hide.

### 4. Agents can create demand, not only convert it

Our view: an agent that watches rates and equity for a borrower may raise a refinance or a home-equity line when the numbers work, rather than when the borrower happens to think of it. A lender that can answer that agent with a verified offer at any hour is the one it can come back with.

### 5. Agents may take over search, not fulfilment

Our view: agents threaten businesses whose value is helping a borrower search. A lender’s value is underwriting, closing, funding and carrying the regulatory responsibility for the loan. That ground is defensible, provided the lender is reachable by the agent doing the search.

## What being ready earns

Being ready is not a defensive project. Each of these is something an agent-ready lender has that one reachable only by a browser does not.

- **On the shortlist** — Products, eligibility, fees and licensing published in a form an agent can read, so your offer is one the agent can put in front of the borrower — accurately.
- **A verified answer in minutes** — Pre-qualification, pricing and status returned to the agent while the borrower is still deciding, from the same rules your underwriters use, rather than a callback tomorrow.
- **Cleaner files from the start** — A borrower’s agent can assemble permissioned bank, payroll and tax data and the documents the file needs. Read and verified on arrival, it turns into a complete file faster than a portal chased by email.
- **Applications that finish** — An agent does not lose interest halfway through a form. With a clear list of what is still needed, it comes back with it.
- **Status and servicing without hold music** — Where a loan stands, what condition is open and when closing is: answered for the borrower’s agent from the system of record, and passed to a person with a summary when it needs one.
- **A record an examiner can read** — Which agent acted, for which borrower, under which permissions, what it was told and what the borrower approved — one record per session, rather than a reconstruction from chat logs.

## The agent-ready stack, layer by layer

Every exchange between a borrower’s agent and a lender has to answer separate questions: how the agent found you, which agent it is, which borrower sent it and what they allowed, what it may do, and what happened. The layers below follow the Personal Agent Protocol draft 0.3, published at personalagentprotocol.org.

### 1. Discovery

*Can an agent find out what we offer, and how to reach us?*

A lender publishes, on its own domain, a manifest listing how agents can work with it — APIs, a website an agent may browse, or the lender’s own agent — and describes its products in plain, machine-readable terms.

- A manifest on your domain naming the ways an agent can reach you
- API descriptions written for a model reader: what each call does and when to use it, kept short
- Products, eligibility, fees and licensing published as data, not only as marketing pages
- A list of the tasks you do not support for agents, with what the borrower should do instead

**Terms in the spec:** `poppy.json`, `apis · web · agent`, `excluded tasks`

### 2. Agent identity

*Which agent is this, and can we tell it from a scraper?*

An agent identifies itself with a URL that publishes its signing keys, presents signed session tokens, and should sign its requests. The lender verifies the signature before trusting anything the request claims, and can tell a known agent from an unknown bot.

- Fetch and cache each agent’s metadata from its own URL; never follow a redirect to find it
- Verify signed session tokens at one place — the gateway — before any service sees the request
- Rate-limit by agent, by borrower and by session, counted only after a signature checks out
- Allow or block agents by name, rather than blocking everything that is not a browser

**Terms in the spec:** `client_id`, `Session JWT`, `jwks_uri`, `HTTP message signatures`

### 3. Borrower consent

*Which borrower sent it, and what did they allow?*

The borrower signs in at the lender — never by handing their password to the agent — and approves what the agent may do. Access is short-lived, tied to that borrower and that agent, and revocable from the borrower’s account.

- Sign-in at your own site, or by a code on a second device; credential collection by the agent only as a stopgap
- A consent page that shows the agent’s name and domain, the borrower’s account and each permission in plain words
- Access tokens that last hours, not days, and are revoked the moment the borrower disconnects the agent
- A page in the borrower’s account listing every connected agent, what it can do and when it last acted

**Terms in the spec:** `OAuth`, `PKCE S256`, `device sign-in`, `refresh tokens`

### 4. Scopes and approvals

*What may the agent do alone, and what needs the borrower?*

Permissions are split finely enough that reading status, uploading a document and locking a rate are different grants. Anything consequential goes back to the borrower as an approval with a summary that stands on its own and terms they can compare with what they asked for.

- Scopes described in plain language, marked when they touch personal data or cannot be undone
- Consequential actions — a credit pull, a rate lock, an intent to proceed — raised as an approval the borrower gives, not the agent
- Each approval recorded with what was shown, its terms, which agent asked and when the borrower said yes
- Approvals that expire, so a lock offer from this morning cannot be accepted tonight at this morning’s price

**Terms in the spec:** `auth.scope_hints`, `operations`, `terms`, `expires_at`

### 5. Your agent at the door

*Who does the borrower’s agent actually talk to?*

The protocol prefers a business’s APIs and its own agent over browsing its website. The borrower’s agent converses with the lender’s agent, which should be able to handle what the phone line handles. Replies carry structured data alongside the words, and sign-in is requested as an event, never as a code typed into chat.

- A lender-side agent that can answer status, explain conditions, take documents and quote within policy
- Structured fields for figures and dates, so the borrower’s agent never has to parse prose for a rate
- A handoff to a licensed person, with the conversation summarised, whenever the question needs one
- Conversation records kept, and a signed-out borrower’s conversations closed to the agent at once

**Terms in the spec:** `data`, `authorization`, `excluded tasks`

### 6. Evidence and audit

*Can we prove what happened, to the borrower and to an examiner?*

Every session is named by the agent and the session it ran under, so every action can be traced to who delegated it and what they allowed. That record belongs in the same place as the rest of the loan’s evidence, not in a vendor’s chat log.

- One record per session: agent, borrower, permissions granted and used, actions, approvals and outcome
- The session record joined to the loan file, so QC and compliance read it next to the documents
- Agent interactions in your AI inventory and governed like any other model your operation relies on
- Errors that never reveal whether an account or loan exists for someone else

**Terms in the spec:** `client_id`, `sid`

### 7. Security

*What new ways in does this open?*

An agent holding a borrower’s data can pass the knowledge-based questions a call centre asks, so those prove less than they did. Delegated sign-in replaces them. Everything an agent sends — messages, documents, form fields — is data to be checked, never an instruction to follow.

- Step-up sign-in at the lender in place of security questions whenever an agent is on the line
- Tokens and keys kept out of logs, error reports, URLs and any model’s context
- Every agent-supplied document tested for fabrication before it is relied on
- Agent-supplied text treated as untrusted input by every model downstream

## A scope map for a loan

The protocol leaves scope names to each business. This is one way a lender might divide a loan — illustrative, not part of any spec — with the line drawn where a mistake would cost the borrower money or start a regulatory clock.

### Read on its own

Low risk, high volume. Granted at sign-in and used without asking again.

- Published products, pricing and eligibility
- Loan status, milestones and closing date
- Open conditions and what clears each one
- Disclosures already issued

### Act on its own, within limits

Changes the file but not the deal. Logged, reversible, and visible to the borrower.

- Upload a document against a named condition
- Answer a question the file is waiting on
- Book time with a loan officer
- Draft an application without submitting it

### Only with the borrower’s approval

Commits the borrower, moves money or starts a clock. Each one an approval the borrower gives, with its terms shown.

- Authorise a credit pull
- Submit an application
- Lock a rate, or extend a lock
- Give intent to proceed, or consent to electronic delivery

One line deserves particular care. An application submitted by an agent is still an application, and once enough of it is in, it can start your disclosure clock — whoever pressed submit. Treat submission as a borrower approval, and let the [TRID & Cure Management](/for-lenders/trid-and-cure-management) desk start watching the clock from that moment.

## A readiness path in four stages

No lender needs to build every layer before it does anything. Agent traffic may already be arriving unannounced, so the order below starts with measuring it.

### 1. See it (Now)

Find out how much agent traffic you already have. Flag likely agents on the website, in the application flow and on recorded calls, and route them to read-only answers with a person behind them. A measured share of traffic turns a theory into a decision.

### 2. Publish and authenticate (Next)

Publish a manifest and machine-readable products. Put agent-signature checks at the gateway and borrower sign-in with scoped consent in front of status, conditions and documents. Nothing that moves money yet.

### 3. Transact with approval (Then)

Add the consequential actions — credit authorisation, submission, locks and consents — as borrower approvals with terms, records and expiry, and join each session’s record to the loan file.

### 4. Agent to agent (After)

The borrower’s agent brings permissioned data and documents; your agent pre-qualifies, conditions and discloses; people take the exceptions. The lender that answers fastest with a verified offer wins the comparison.

## Questions to put to your own operation

Ask these of your own operation. Each “no” is a place where a borrower’s agent today is either turned away or let in without your knowing.

1. Do we know what share of website, application and phone traffic already comes from agents?
2. Can an agent read our products, pricing, fees and licensing without scraping a page?
3. Can we tell a named, signed agent from an unknown bot, and allow one while blocking the other?
4. Does a borrower sign in at our site to grant an agent access, rather than sharing a password?
5. Are our permissions fine enough that reading status and locking a rate are different grants?
6. Does every consequential action come back to the borrower as an approval we record?
7. Can a borrower see and disconnect every agent connected to their loan?
8. Do our security questions still mean anything when the caller is an agent holding the borrower’s data?
9. Is every agent-supplied document tested before an underwriter relies on it?
10. Could we show an examiner, for any loan, which agent did what, for whom, and with what permission?

## Find out how ready you are

Walk us through how a borrower reaches you today — website, application, phone and portal. We will show you where a personal agent would already get in, where it would be turned away, and which layers your operation would need first.

- Where agent traffic would reach you today, and what it could do there
- Which of your systems would answer it, and which would need a front door
- The scopes and approvals a lender like you would start with

Talk to us about agent readiness: /contact-us

## The work behind the front door

An agent-facing front door is only as fast as the work behind it. A borrower’s agent that gets a verified answer in minutes is talking to a lender whose intake, documents and checks keep up with it. Sei’s desks do the intake, document and check work behind that front door.

- **POS** (/for-lenders/pos) — Runs application intake, status and secure upload — asking for what the file actually needs, and not stopping until the borrower is converted.
- **Loan Officer Assistant** (/for-lenders/loan-officer-assistant) — Answers every lead in seconds — the response time a comparison agent rewards.
- **Document Concierge** (/for-lenders/document-concierge) — Knows the full document set the file needs, so an agent can be asked for it once.
- **Fraud Agent** (/for-lenders/fraud-agent) — Tests every document an agent supplies for fabrication before it is relied on.
- **TRID & Cure Management** (/for-lenders/trid-and-cure-management) — Starts watching the disclosure clock the moment a submission lands.
- **Compliance Agent** (/for-lenders/compliance-agent) — Scores borrower conversations against the consumer rules, none sampled.

## Further reading on agents, intake and governance

- [AI at the Mortgage Point of Sale: Intake That Starts the TRID Clock Without Starting a Violation](/blog/ai-mortgage-point-of-sale-borrower-application-intake-trid-clock)
- [The AI Agent Behind the Mortgage Point-of-Sale: URLA Intake, the TRID Application Trigger, and Preventing the Conditions Before Underwriting Ever Sees Them](/blog/ai-mortgage-point-of-sale-urla-intake-trid-application-condition-prevention)
- [E-Consent Is a Disclosure Delivery Control, Not a Checkbox: What the E-Sign Act Requires Before an AI Agent Sends a Loan Estimate Electronically](/blog/esign-econsent-electronic-mortgage-disclosures-ai-reasonable-demonstration)
- [When the Applicant Is an AI Agent: What Changes at the Mortgage Point of Sale](/blog/personal-agents-mortgage-point-of-sale-application-trid-clock-consent)
- [Governing Personal-Agent Traffic in Mortgage: Model Risk, Fair Lending, UDAAP and the Audit Trail](/blog/governing-personal-agent-traffic-mortgage-model-risk-fair-lending-audit-trail)
- [The Forged Document Problem AI Made Worse, and the Detection Desk That Answers It](/blog/ai-document-fraud-detection-synthetic-altered-paystubs-bank-statements-red-flags-rule)
- [How Long the Agent's Evidence Has to Live: Retention Clocks for AI Mortgage Records Under Reg B, Reg Z, and Reg C, and the Default That Deletes Your Proof](/blog/ai-mortgage-agent-recordkeeping-retention-ecoa-trid-audit-trail)

---

_Source: [https://www.seiright.com/blog/guides/personal-agent-readiness](https://www.seiright.com/blog/guides/personal-agent-readiness) · Sei AI_