AI Agents Can Move Money. But Who Proves the Intent?

Research cut-off: 2026-07-30

The difficult part of agentic payments is no longer showing that software can submit a transaction. It is proving that a particular transaction remained inside the authority a person or organization intended to delegate.

An API key can identify software. A wallet signature can prove control of a private key. Neither necessarily proves that the buyer asked for this product, from this merchant, at this price, under this cancellation policy, at this time. Once agents compare offers, negotiate, and pay other agents at machine speed, the gap between technical authorization and human intent becomes an operational risk.

What changed

In July 2026, Visa and Artemis published an analysis of agentic-payment protocols and live on-chain activity. Visa described emerging card and crypto-native standards and raised unresolved questions about accountability, disputes, and transactions initiated through chains of agents. The report is industry-funded and its measurements should be read with that conflict in mind, but it is direct evidence that payment networks are treating agentic commerce as an operating problem rather than a distant scenario.

Mastercard’s 2026 material describes a Verifiable Intent framework that links consumer identity, original instructions, and transaction outcome in a tamper-resistant record. Its agentic tokens can carry scoped limits such as merchant category, amount, purpose, and time window. Visa separately emphasizes agent identity, authorization, and auditable confirmation of buyer intent.

These systems differ in implementation, but they point toward a common architecture: identify the agent, bind it to a principal, constrain the grant of authority, preserve evidence of the instruction, and allow the authority to expire or be revoked.

A signature is necessary but not sufficient

Suppose an agent has a wallet containing 1,000 units. A valid signature proves that the transaction was authorized by the wallet’s key. It does not explain why the agent selected the merchant, whether a 100-unit limit applied, whether the user excluded subscriptions, or whether the instruction was cancelled seconds earlier.

The payment rail sees a technically valid instruction. The user may see a breach of mandate. A useful intent record has to connect them.

That record should be specific enough to evaluate a dispute without revealing more personal data than the transaction requires. A broad prompt stored in plain text is not an ideal answer: it may contain private information, be ambiguous, and be difficult for another institution to verify.

Bounded delegation

Delegated authority should be treated as a capability, not a permanent copy of the owner’s wallet.

A capability can define:

• permitted assets or payment methods;
• maximum amount per transaction and period;
• accepted merchants or categories;
• geographic or jurisdictional restrictions;
• start and expiry times;
• whether recurring payments are allowed;
• when human confirmation is required; and
• how the grant is revoked.

The agent should not be able to expand these constraints. If it needs a new permission, it should return to the principal or an authorized policy service.

This is where rule-based finance and predictive systems meet. The agent can reason about options. A deterministic authorization layer decides which actions it may take.

Identity, credentials, and attestations

Agent identity answers “which software actor made this request?” Principal identity answers “on whose behalf?” Credentials can attest to properties of the agent, merchant, or principal. An attestation can record that a model, device, or policy version met a defined requirement.

Trust does not come from attaching more credentials. Verifiers must know who issued them, what was checked, when they expire, and how revocation works. A credential from the agent developer is weaker evidence of independent compliance than a credential from a party accountable for that check.

Zero-knowledge proofs may help prove a limited fact—such as a valid mandate with a sufficient spending limit—without revealing the full credential or prompt. They do not prove that the mandate was wise, that the merchant will deliver, or that the user understood every consequence.

Accountability and dispute evidence

Agentic commerce can separate decisions across multiple entities: the user, model provider, agent platform, credential issuer, payment network, merchant, wallet, and automation service. When a payment fails, each may have a valid log describing only part of the event.

A dispute-ready record should connect:

1. the principal’s grant of authority;
2. the agent and policy version that acted;
3. the material transaction terms presented;
4. the agent’s selected action;
5. the authorization and payment result; and
6. any revocation or exception in effect.

Logs should be tamper-evident and minimized. Recording every reasoning trace creates privacy, security, and interpretability problems. The objective is not total surveillance of the agent. It is enough evidence to test whether the action was within scope.

Revocation at machine speed

Traditional payment permissions often assume a person will notice and stop a problem. An agent can initiate many transactions before a human reviews an alert. Revocation therefore needs rapid propagation across the systems that recognize the mandate.

Expiry and one-time capabilities reduce the window of exposure. Per-period limits bound cumulative loss. Step-up approval can interrupt unusual actions. Circuit breakers can pause activity after a threshold or anomaly.

These controls also create false positives and availability risk. A cautious system should fail in a way proportional to the transaction. Blocking a nonessential purchase is different from blocking a time-critical business payment.

PraxiHub interpretation

Financial autonomy without verifiable intent creates delegated risk.

The central design question is not whether an agent is intelligent enough to pay. It is whether the payment system can prove that the agent had current, bounded, and revocable authority for the action that occurred.

No single standard yet resolves identity, privacy, cross-platform interoperability, liability, and disputes. The current convergence around scoped tokens and signed mandates is important, but most public evidence still comes from the firms building the rails. Independent measurement will be needed as real transaction volume grows.

What to watch next

• Whether intent records become interoperable across payment methods
• Whether users can inspect and revoke mandates in one place
• How chargebacks and merchant disputes use agent-generated evidence
• Whether credentials minimize data or create new correlation identifiers
• How multi-agent transaction chains allocate responsibility
• Whether independent audits test mandate enforcement under adversarial inputs

Sources

1. Visa and Artemis. “Agentic Payments from the Ground Up.” Updated 2026-07-14. Accessed 2026-07-30. https://www.visa.com/en-us/thought-leadership/innovation/agentic-payments-from-the-ground-up
2. Visa. “AI agents and security: Building trust in the age of agentic commerce.” Accessed 2026-07-30. https://corporate.visa.com/en/solutions/commercial-solutions/knowledge-hub/agentic-ai-agents-and-security.html
3. Mastercard. “Get Ready for AI-Powered Shopping Experiences.” 2026. https://www.mastercard.com/content/dam/mccom/eu/news-and-trends/business-thought-leadership/digital-payments/pdfs/Get_ready_for_AI-powered_shopping_experiences.pdf
4. Mastercard. “Mastercard Launches Agent Pay for Machines.” 2026-06-10. https://investor.mastercard.com/investor-news/investor-news-details/2026/Mastercard-Launches-Agent-Pay-for-Machines-to-Unlock-Super-Fast-Always-On-Payments/default.aspx
5. World Wide Web Consortium. Verifiable Credentials Data Model v2.0. 2025-05-15. https://www.w3.org/TR/vc-data-model/

Conflict disclosure

PraxiHub is associated with Praxifi. The author may hold roles or ownership interests in Praxifi, whose research interests include financial automation and verifiable authority. Visa and Mastercard sources describe their own commercial initiatives and are treated as conflicted primary sources.