Why underwriters ask about it
an agent connected through an admin login can do everything that login can — and so can anyone who hijacks the agent.
How to fix it
- Create a separate account for each agent with only the permissions its job needs — never the owner's login, never admin.
- Remove access it doesn't use (if the booking bot doesn't need payment history, take it away).
- When a staff member leaves, treat agent credentials like theirs: rotate them.
Evidence to keep
a note per agent of which account it uses and what that account can reach.