Who in your company decides what an AI agent is allowed to buy? Not which tool you use, but which person signs off on the spending limit, the vendor list, and the review schedule before an agent completes its first purchase. In most of the businesses we talk to, nobody owns that decision yet, even though the payment rails to support it are already live.
An AI agent payment policy is a short, written set of rules that says which agents may spend, on what, up to what amount, with whose approval, and how every transaction gets reviewed. Card networks and AI platforms now let agents complete purchases on their own, so the policy has to exist before the credential does, not after.
For years, an AI assistant could research a purchase but had to hand checkout back to a person. That gap closed between late 2025 and 2026. Google announced its Agent Payments Protocol, AP2, in September 2025 with more than 60 launch partners, including Mastercard, American Express, PayPal, Coinbase, Revolut, Etsy, Salesforce, and Intuit. Weeks later, OpenAI and Stripe released the Agentic Commerce Protocol behind Instant Checkout in ChatGPT, where encrypted payment tokens are authorized only for specific amounts and specific merchants.
The card networks moved in parallel. Mastercard's Agent Pay Acceptance Framework, published in October 2025, registers and verifies AI agents before they can transact and gives each one agentic tokens so every transaction is traceable. Visa introduced its Trusted Agent Protocol the same month, developed with Cloudflare, which lets merchants cryptographically recognize approved agents and separate them from malicious bots.
The shift that matters most for operations leaders is the move into business-to-business payments. In October 2026, Visa, BILL, and Billtrust launched a live pilot in which trusted AI agents pay approved supplier invoices end to end through supplier portals. Agentic payments are no longer a consumer shopping experiment. They are arriving in accounts payable.
Here is the view we would push back on: that agent payments are risky because the technology is immature. The protocols above are built by organizations that have run payment security for decades, and they bake in identification, tokenization, and authorization records. The weak point is inside the buying company, where nobody has decided how much authority an agent should hold or who reviews what it did.
Look at how the BILL pilot is designed. According to Visa, the agent only executes eligible payments the buyer has already approved, uses controls aligned with the buyer's approved payment instructions, and does not make payment decisions. That is a policy decision encoded in software. The rails carry out whatever rules you give them. If the rules are vague, the rails carry out vague rules very efficiently.
This is the same pattern we saw with AI tools generally, which is why AI adoption is a governance problem, not a technology one. Payment authority simply raises the stakes, because mistakes now settle into your bank account instead of a draft document.
Ownership belongs with the person who already owns the budget the agent will spend from, usually a finance or operations leader, not IT. IT can configure credentials and logging, but it cannot judge whether a $900 software renewal is a sensible business decision. When ownership defaults to whoever set up the agent, spending authority ends up governed by technical convenience rather than business priorities.
The owner's job is narrow and concrete: approve which agents get a credential, set the limits, review activity on a schedule, and decide when scope expands. That is a few hours a month for most small and mid-sized companies. Compare that with the cost of discovering a quarter's worth of unreviewed agent purchases during year-end close, and the business case for naming an owner is straightforward. It is also the same accountability principle behind our view that every AI tool needs a named supervisor.
The failure is rarely dramatic fraud. It is quiet, authorized spend that nobody intended. In a July 2026 CPA Practice Advisor column, Andrew Jamison argues that the biggest risk in agentic commerce is unauthorized autonomous spend: purchases a system can initiate because its authority is too broad, its controls too loose, or its audit trail too thin. His example is an assistant that renews a routine software subscription after the contract terms changed or the amount crossed an approval threshold, and nobody notices until an audit.
That example should feel familiar to any finance team, because it is the same thing that happens when an employee renews a tool on a personal card, the classic path into shadow IT. The difference is speed and volume. Jamison notes that AI compresses the path from instruction to completed transaction into seconds, which puts pressure on controls designed around human pacing and after-the-fact review.
The business cost shows up in three places: spend that leaks past budget owners, reconciliation work that grows every month, and disputes you cannot win because you cannot prove what the agent was told to do. Who absorbs a bad purchase in that last scenario is a legal question with uncomfortable answers, and it is separate from the operational controls this article covers.
Each protocol tries to answer the same question: can everyone in the transaction prove that a real person authorized this specific purchase? AP2 uses signed digital records called mandates. As Digital Commerce 360 reported at launch, an Intent Mandate captures the request and conditions such as price limits and timing, a Cart Mandate locks in the items and price, and Google describes the chain from intent to cart to payment as a non-repudiable audit trail.
| Protocol or program | Backed by | Core mechanism |
|---|---|---|
| Agent Payments Protocol (AP2) | Google, with 60+ launch partners | Signed mandates linking user intent, cart, and payment |
| Agentic Commerce Protocol | OpenAI and Stripe | Payment tokens limited to a specific amount and merchant |
| Agent Pay Acceptance Framework | Mastercard | Agent registration plus agentic tokens on the card network |
| Trusted Agent Protocol | Visa, developed with Cloudflare | Cryptographic signatures that let merchants recognize approved agents at checkout |
The common design principle is sound: an agent should hold exactly the spending authority it needs for one task, for one window of time. Whether it is configured that way inside your company depends on whether someone knows to set it up that way. A protocol that supports a $200 cap does nothing if the person configuring the agent enters $20,000 because it was the default.
A workable policy fits on two pages and answers who, what, how much, and how you check. Vendor guidance is converging on the same core controls. Ramp's guide to AI agent spending controls recommends scoped single-use cards, budget caps per agent or use case, approval workflows for high-value actions, and locking agents to approved merchants and categories. Translated into policy, that looks like this:
Roll it out in stages. Start with one low-risk, high-volume category such as office supply reordering, where amounts are small and the vendor list is fixed. Run it with full logging and human spot-checks for a defined trial period, then expand scope or raise caps only when the data supports it. That gives the policy owner real evidence of how the agent behaves before its authority grows.
If agents in your company already touch finance workflows, our AI Lab guidance on where AI should assist, flag, and never move money is a useful companion, and so is our look at whether human-in-the-loop review is actually working, because an approval step only protects you if the approver is looking.
When a client wants to connect an agent to a payment method, we treat it as an access decision first. We inventory which agents exist and what credentials they can reach, apply the same least privilege access discipline we apply to human accounts, and work with the finance owner to translate the policy above into actual caps, merchant scopes, and approval routes inside the tools they already use.
We also make sure the logging holds up. That means agent activity lands in a place your finance team and auditors can review, and that someone is alerted when an agent's spending pattern changes. The point is not to slow adoption. It is to let your team expand agent purchasing with evidence rather than hope. A structured AI readiness assessment is often the fastest way to see where those gaps sit today.
Agent payments are moving from consumer checkout into accounts payable, and the companies that benefit will be the ones that wrote the spending rules first. Pick the owner, write the two-page policy, and start with one narrow category before any agent gets a broader credential.
If your team is moving faster with AI than your guardrails are, start with structured training rather than another tool. AI University gives your people role-based AI training with security built into the material, not bolted on afterward.
If you would rather talk through your specific environment first, book a strategy call with Securafy and we will walk your current AI usage, exposure, and the fastest path to safe adoption.