Mercury, the business banking platform, has shipped a feature called Command that lets users — and the AI agents working on their behalf — query bank data and carry out financial actions through plain conversation, within permissions the account holder sets. Nathan Labenz discussed it on his podcast as an example of where agentic finance is heading. This is not a demo or a roadmap item; it is available now.

The idea, in plain terms: most people who want an AI assistant involved in their finances currently have two bad options. The first is handing the assistant a browser and your login, so it clicks through your bank's website the way a person would. That is fragile — the page changes, the automation breaks — and it means giving a tool broad access to your actual credentials. The second is piping your financial data through third-party aggregators or scraping tools, which spreads your data to more companies and more places it can leak.

Command replaces both with a purpose-built interface. Instead of an assistant pretending to be you in a web browser, the assistant talks to the bank directly through natural language, and the bank itself enforces what it can see and do. Ask how much was spent on software last month, check whether a payment cleared, or — within limits you define — initiate a transaction. The permissions live on the bank's side rather than in whatever prompt you happened to write, which is a meaningfully safer arrangement. A prompt can be ignored or worked around; an account-level permission cannot be talked past.

Who this is for is fairly specific: business owners already banking with Mercury — or willing to move — who want an AI assistant handling real financial operations rather than just summarizing statements. The clearest near-term use is agent spending: giving an assistant a bounded ability to look things up and move money without handing it the keys to everything. An individual with ordinary personal banking needs would get less from it, and it is a business bank, so it is not aimed at consumer accounts anyway.

It also matters for what it signals about architecture rather than just this one product. The recurring question in AI-assisted finance is where the guardrails live. Putting them in the account, at the institution, is the answer that scales — the assistant can be swapped out, the permission model stays. Command is an early shipping example of that pattern, and it will likely be copied.

The honest limits: this is a vendor's own feature, and the claims about it are Mercury's claims. There is no independent reporting here on how well it performs, how the permissions fail under edge cases, or what happens when an agent is given an ambiguous instruction with money attached. Natural language is a loose control surface — pay the usual vendors means different things on different days — and how Command resolves ambiguity is a question worth asking before trusting it with anything irreversible. It also locks the capability to one bank; there is no portable standard yet for permissioned agent access to accounts, so an assistant wired into Mercury's interface does not carry that access elsewhere. And none of this removes the need to check the assistant's work — a bounded agent that can still make mistakes within its bounds is safer than an unbounded one, but it is not safe by default.