Agentic payments: How AI agents are being taught to spend money safely

Agentic payments are payments started by an AI agent on behalf of a person or a company, instead of by a human clicking a pay button. The hard part is not moving the money. It is proving that the agent was allowed to spend it, how much, and on what.

Most of the work so far is about limits and proof, which is why the field reads more like security than like shopping.

A shopping errand that shows the problem

Imagine telling an assistant: “Buy me running shoes under $120, size 10, delivered this week.” The assistant searches, picks a pair and reaches checkout. Today that is where it stops, because a card number is meant for a human who can be held responsible.

Three questions follow. Did the person really authorize this exact purchase? Can the merchant trust that the agent is not making things up? If the shoes are wrong, who is liable? Agentic payments are the set of answers to those three questions.

Three building blocks: Limits, scoped credentials and receipts

Nearly every design uses the same three ideas.

• Limits set in advance. A person or an admin defines a budget, an allowed merchant type or a time window before the agent acts.
• A narrow credential. The agent never sees the real card number. It gets a stand-in that works only for a limited purpose.
• A confirmation step and a log. Risky actions need a human yes, and every call is recorded so a dispute can be traced afterward.

An analogy: a company card with a $200 limit given to a new assistant, plus a rule that anything bigger needs a manager’s signature. The card, the limit and the signature are separate controls, and agent systems copy that split.

Two public designs: Signed mandates and one-time tokens

Two protocols from 2025 show how the ideas turn into software. Both are open specifications, and neither moves money by itself.

Google announced the Agent Payments Protocol (AP2) on September 16, 2025. According to the AP2 site, it builds trust on “verifiable digital credentials”, described as tamper-evident, cryptographically signed objects. These are called mandates. A Checkout Mandate covers what is being bought and is shared with the merchant. A Payment Mandate covers the payment itself and is shared with the credential provider, the card networks and the merchant’s payment processor.

Each mandate has an open stage and a closed stage. The open stage records the user’s constraints, such as a budget and allowed payment methods. The closed stage records authorization for one finalized purchase and amount. Chained together, the mandates are meant to give a verifiable audit trail for both purchases made with the user present and purchases made while the user is away.

Stripe and OpenAI took a different route. On September 29, 2025, Stripe announced the Agentic Commerce Protocol (ACP), developed with OpenAI, alongside Instant Checkout in ChatGPT. After a buyer picks a payment method, Stripe issues a Shared Payment Token. ChatGPT passes that token to the merchant through an API, so the merchant is paid without ChatGPT holding the card details. Stripe says the token is limited to one merchant and one cart.

The designs differ in emphasis. AP2 concentrates on signed proof of what the user agreed to. ACP concentrates on a scoped token that a merchant can charge. In practice a system could use ideas from both.

Where business payments fit, including Pliant

Consumer shopping gets most of the attention, but company spending has the same structure with more rules. Finance teams already have cards, budgets, receipts and approvals, so an agent can plug into existing controls.

That is the setup in our report on Pliant’s $80M Series C. According to Pliant, agents such as Claude and ChatGPT connect to its platform and act under the role of a Pliant user. They can search transactions, attach receipts, update coding and adjust card controls, every call is logged, and changes need confirmation. The company’s own page says agents cannot move money or issue cards today, and that agentic payments will add budgets, limits and a confirmation step. No date is given.

So Pliant sits at the cautious end: agents help with the paperwork around payments first. The Next Web, as relayed in our report, also mentions a pilot by Visa, BILL and Billtrust of agents paying supplier invoices, which is a step closer to agents actually paying.

Open problems: Liability, trust and fraud

The protocols leave several questions unsettled.

• Liability: a signed mandate shows what a user approved, but it does not decide who pays when an agent misreads a request. Pliant’s investor Vinoth Jayakumar of Seaya Nova told The Next Web that “when agents move money, someone still has to be licensed, auditable and liable.”
• Vague instructions: “Something nice for my sister’s birthday” cannot be turned into a tight limit, so such tasks still need a human check.
• Manipulated agents: an agent that reads a web page or an email can be tricked by hidden instructions. A narrow credential limits the damage, but it does not prevent the attempt.
• Fragmentation: several competing standards mean merchants may need to support more than one.

The vendor material on these protocols is mostly self-description, and real-world volumes of agent-made payments have not been independently published in the sources we read.

What to watch next

Three signals will show whether agentic payments become routine.

1. Who runs the standards. The AP2 site mentions a donation to the FIDO Alliance, which suggests the specifications may move to neutral stewardship. Watch whether the card networks and large processors adopt one shared approach.
2. First regulated moves of money. Pliant and others say agents will gain payment abilities later. How regulators treat a payment started by software will matter as much as the technology.
3. Dispute handling. The first public cases of an agent buying the wrong thing will test whether mandates and logs settle arguments in practice.

For readers, the useful test of any agent payment feature is simple: ask what limits it sets, what credential the agent holds, and who has to say yes.