WHEN THE AGENT CAN PAY. Who Governs Machine-Speed Spending?
Martin Novak
Synthocracy Institute
Research status: 4 September 2026
Evidence Boundary
This article distinguishes documented developments from analytical interpretation. [A] Empirical claims refer to live payment deployments, payment-network announcements, current protocol specifications, government infrastructure initiatives, standards projects, and technical documentation available by 4 September 2026. [B] Analytical claims develop the Synthocracy Institute’s interpretation of what these developments mean for delegated authority, economic power, accountability, and market access. FORESIGHT sections describe plausible 2027+ developments and should not be read as predictions.
A further distinction is essential. Saying that an AI agent can “pay,” “hold a budget,” or act as an “economic actor” does not mean that the software necessarily owns money, possesses legal personality, enters contracts in its own right, or bears legal responsibility as a human or corporation would. In most current architectures, the agent exercises some form of delegated operational authority over funds or credentials belonging to a human or organisation. The legal allocation of ownership and liability remains external to the model itself.
The central proposition is:
The economic significance of an AI agent changes when it can independently move value.
And the central governance problem follows immediately:
When a human stops approving every individual transaction, the payment system must preserve the mandate that makes machine spending legitimate.
The agent found the product. Then it paid.
For most of the history of consumer AI, there was a clear boundary.
The machine could search.
Recommend.
Compare.
Summarise.
Maybe assemble a shopping basket.
Then a human arrived.
A person entered payment details or confirmed the transaction.
That last click carried enormous institutional significance. It connected machine assistance to an identifiable act of human economic intent.
Agentic commerce is beginning to remove that assumption.
Visa says AI agents are already completing purchases at participating merchant websites in Europe on behalf of cardholders. In the live transactions it announced in July 2026, agents browsed products, selected items and initiated purchases within parameters established by the customer. Visa had already reported hundreds of secure agent-initiated transactions with ecosystem partners by the end of 2025. (visa.co.uk)
Mastercard and Worldline, together with ING, announced a live end-to-end European agentic payment in production in June 2026. (Mastercard)
Amazon now offers Bedrock AgentCore Payments in preview, enabling agents to discover, authorise and execute x402 and Machine Payments Protocol microtransactions with wallet management, spending controls and audit trails. (Amazon Web Services, Inc.)
And Mastercard has moved beyond ordinary agent-assisted shopping altogether. Its Agent Pay for Machines architecture is explicitly designed for software systems that may transact continuously, at high velocity, through chains of transactions that can include payments worth fractions of a cent. The company describes a future of always-on, machine-driven commerce using cards, bank accounts and stablecoins. (Mastercard)
This is the threshold that matters.
The agent is no longer merely influencing a purchase.
It can become part of the mechanism that causes value to move.
1. Payment turns recommendation into economic actuation
The difference between recommending and paying is deeper than checkout convenience.
Consider an agent instructed to:
“Find the cheapest compliant replacement part from an approved supplier.”
If it produces three options, a person still controls the final economic act.
Now give it authority to purchase.
The chain becomes:
SEARCH → COMPARE → QUALIFY → SELECT → COMMIT → PAY
The system has moved from preparing a market decision to executing it.
Payment is a particularly important form of actuation because it creates an external state change that another institution recognises.
Money moves.
Credit is consumed.
A contract may be formed.
Inventory may be reserved.
A supplier may begin work.
Shipping may start.
Tax and accounting events may arise.
Undoing the decision may now require cooperation from actors outside the original agent system.
This is why payment should be treated as more than another tool call.
It is a consequential boundary.
2. The old payment system assumed a human was present
Google’s Agent Payments Protocol makes the historical assumption unusually explicit.
AP2 was created because conventional payments generally assume that a human directly clicks buy through a trusted interface. Autonomous agents break that assumption. Google identifies three resulting problems: proving that the user gave the agent authority for the purchase, demonstrating that the transaction reflects the user’s real intent, and establishing accountability when something goes wrong. (Google Cloud)
The current AP2 specification consequently distinguishes two modes.
In Human Present mode, the user sees the final checkout and approves it directly.
In Human Not Present mode, the user approves constraints in advance. The agent can subsequently assemble and authorise a compliant checkout and payment within those pre-established conditions. (GitHub)
That distinction captures the institutional shift exceptionally well.
Traditional e-commerce centres authority around the transaction:
Do you approve this purchase?
Autonomous commerce moves authority upstream:
Under what conditions may the agent approve future purchases without asking again?
The object being authorised changes.
It is no longer one transaction.
It is a space of possible transactions.
3. The budget becomes a mandate
Suppose a company gives a procurement agent €10,000.
That number is not enough.
Can it buy anything?
Only office supplies?
Only from approved suppliers?
Can it spend €10,000 at once?
€500 per transaction?
Can it make 100 purchases of €100?
Can it renew subscriptions?
Can it purchase compute?
Can it transact with another agent?
Can it buy from a newly discovered counterparty?
Can it use stablecoins?
Can it spend outside the EU?
Can it change suppliers when availability disappears?
Does the authority expire tonight or at the end of the quarter?
A numerical budget therefore does not define economic authority.
The meaningful object is a spending mandate.
SPENDING MANDATE — The bounded authority under which an agent may commit or transfer value on behalf of a principal, including relevant purpose, amount, counterparties, transaction types, timing, conditions, escalation requirements, and revocation rules.
This is an analytical formulation rather than a proposed legal term.
Current payment infrastructure is already converging on similar components. Mastercard’s Agent Pay for Machines combines credentialing, permissioning, spending limits, verified participants and multi-rail settlement. Its own example begins with a business defining spending limits, funding preferences and execution rules before the agent engages providers and pays them. (Mastercard)
Visa similarly says agentic payment tokens can be bound to context describing whom the agent represents, what it is permitted to do and under which conditions, enabling payments without requiring a human to be present each time. (corporate.visa.com)
The payment credential is therefore beginning to carry something closer to delegated economic context.
4. A transaction limit is not the same as economic authority
This distinction follows directly from the Institute’s earlier analysis:
PERMISSION IS NOT AUTHORITY.
Suppose Agent A has a payment credential with a maximum transaction value of €100,000.
The infrastructure may permit:
payment.execute = €82,000
That does not prove that the principal authorised this particular €82,000 expenditure.
The limit may be a technical ceiling.
The mandate may have allowed only €20,000 for the current procurement project.
Or the agent may have been permitted to prepare payments but not choose suppliers.
Or the budget may cover one category while the transaction belongs to another.
The payment network can correctly authorise a technically valid transaction while the institution has mis-governed the decision that produced it.
Agentic payment systems therefore need to preserve two distinct relationships:
payment permission — can this credential execute?
and
economic authority — is this transaction within the principal’s legitimate mandate?
The infrastructure becomes much safer when the two are linked.
It becomes dangerous when the first silently substitutes for the second.
5. Google is trying to make intent machine-verifiable
AP2 is especially interesting because it treats the original human instruction as part of the payment evidence.
Google’s design uses cryptographically signed Mandates. In the autonomous case, a user can sign constraints governing a future purchase, such as price, timing and other conditions. The agent later creates checkout and payment mandates that must fit those constraints. The protocol is designed to preserve a cryptographic chain from user intent through checkout to payment. (Google Cloud)
The current AP2 specification also distinguishes a Checkout Mandate, proving that the agent is authorised to purchase a particular checkout, from a Payment Mandate, used to demonstrate that the agent is authorised to pay for that checkout. Signed receipts provide additional evidence after execution. (GitHub)
This is a major conceptual change.
The payment credential alone is no longer expected to tell the full story.
The architecture tries to preserve:
INTENT → CONDITIONS → CHECKOUT → PAYMENT → RECEIPT
That is remarkably close to the authority-provenance problem examined in the previous Synthocracy articles.
A transaction is becoming not merely an event.
It is becoming the endpoint of a machine-readable mandate chain.
6. The agent wallet is not necessarily the agent’s money
The phrase agent wallet deserves care.
A wallet can make an agent look economically independent.
That need not be true.
Circle’s current Agent Wallet architecture, for example, uses user-controlled custody. The agent can operate within defined spending limits, but the underlying wallet structure is designed so that users retain custody and key shares are not exposed directly to the agent. Circle describes use cases including API payments, subscriptions, autonomous trading within user rules and agent-to-agent commerce. (Circle Docs)
AWS similarly supports payment sessions with spending limits and expiry windows in its agentic payment architecture. (GitHub)
The better conceptual distinction is therefore:
OWNERSHIP OF FUNDS ≠ CUSTODY ≠ PAYMENT CREDENTIAL ≠ SPENDING AUTHORITY.
An agent can possess operational spending authority without owning the underlying economic asset.
This matters legally and institutionally.
If an agent spends corporate money, the corporation remains the principal.
If it spends consumer funds, the consumer or relevant account holder remains central to the authority chain.
Calling the software an “economic actor” can be useful at the operational level.
It should not silently imply legal personhood.
7. Machine speed changes what a budget means
Human expenditure is naturally rate-limited.
People need time to:
search;
compare;
enter data;
approve;
authenticate;
click;
wait.
Agentic systems can remove much of that friction.
Mastercard’s Agent Pay for Machines is explicitly designed for transactions that occur continuously, at high velocity and at values so low that ordinary human checkout would be economically impractical. (Mastercard)
Visa describes the wider shift as an increase in transaction density: more transactions per unit of economic value as commerce becomes increasingly automated. (corporate.visa.com)
This changes risk.
Suppose an agent has a €10,000 daily budget.
A human might make three purchases.
An agent might make 100,000 microtransactions.
Both consume €10,000.
They create very different governance environments.
The agentic system may interact with thousands of counterparties.
Fraud detection has less time.
Dispute evidence becomes larger.
A small systematic pricing error can repeat thousands of times.
A compromised agent can consume its entire authority envelope rapidly.
The relevant exposure therefore becomes:
AMOUNT × VELOCITY × TRANSACTION COUNT × COUNTERPARTY DIVERSITY × REVERSIBILITY.
A spending limit alone does not capture all of these dimensions.
8. Microtransactions can aggregate into macro consequences
Machine commerce is particularly attractive for digital services.
An agent can pay per:
API call;
database query;
token;
compute cycle;
document;
verification;
search;
piece of data;
specialised agent task.
This allows services too small to justify conventional billing to become economically tradable.
Mastercard explicitly points toward payments worth fractions of a cent. AWS AgentCore Payments is designed in part for microtransactions that conventional payment fees can make impractical. (Mastercard)
This could create significant economic efficiency.
But it also produces a new aggregation problem.
One €0.0005 payment is trivial.
Two billion such decisions are not.
The governance unit therefore cannot always be the individual transaction.
Institutions will need to understand:
cumulative expenditure;
aggregate exposure by supplier;
velocity;
repeated exception patterns;
resource consumption;
network effects.
This resembles the earlier multi-agent authority problem.
A system can obey every per-transaction rule while violating the organisation’s aggregate intent.
9. Spending authority can multiply through delegation
Suppose Agent A receives a €50,000 monthly mandate.
It hires Agent B to analyse market data.
B charges per query.
A uses Agent C for logistics optimisation.
C purchases compute from Agent D.
D buys a specialised dataset from E.
The human authorised one business objective.
The system created a chain of economically consequential relationships.
This returns us to transitive authority.
Can A give B a budget?
Can B spend on subcontractors?
Does every downstream agent inherit part of A’s original mandate?
Can B create a new wallet?
Can C commit future recurring expenditure?
Does revoking A terminate downstream payment rights?
A machine-speed economy requires more than payment connectivity.
It requires budget lineage.
The relevant economic trace increasingly becomes:
PRINCIPAL → SPENDING MANDATE → AGENT A → SUB-BUDGET → AGENT B → COUNTERPARTY → PAYMENT
If those links disappear, organisations may know how much money moved without knowing which mandate authorised the movement.
10. Machine-speed commerce makes revocation time-sensitive
Delegation is valuable only if it can end.
A human can revoke a corporate card.
But autonomous payment systems may require more precise controls.
Revoke one transaction type.
Suspend one agent.
Block one counterparty.
Lower the spending limit.
Terminate a particular mandate.
Disable stablecoin settlement while leaving card rails active.
Stop purchases above a new risk threshold.
Expire the authority automatically.
India provides a particularly important contemporary signal. Reuters reported on 1 September that India is preparing an agentic-payment framework for UPI that would initially support small routine purchases without human approval for each individual transaction. The reported design includes rule-based payments, spending limits, identity controls, funds delegation, blocking mechanisms and liability provisions. The framework was still being prepared at the time of reporting rather than operating as an established nationwide agentic-payment regime. (Reuters)
The significance is larger than one country.
When autonomous payment reaches national payment infrastructure, revocation becomes a payments-system property.
11. The transaction must remember why it happened
Traditional payment records can establish that money moved.
Agentic commerce needs more context.
Suppose an investigation asks:
Why did Agent A pay Merchant B €1,240?
An ordinary transaction record may show:
payer;
payee;
amount;
time;
payment rail;
authentication result.
But a meaningful agentic record may also need to establish:
which principal authorised the agent;
what purchase objective existed;
which spending mandate was active;
what product or service was purchased;
which constraints applied;
whether the merchant changed the terms;
which agent selected the merchant;
whether another agent delegated execution;
whether the payment was inside the mandate at that moment.
Visa’s July research with Artemis explicitly highlights this problem. Once agents transact at high frequency and agents begin paying other agents, conventional dispute and chargeback models can become difficult to apply because the transaction chain may contain many automated steps and there is not yet a settled universal framework for unwinding such activity. (visa.com)
This is the financial version of our earlier distinction:
EVENT PROVENANCE ≠ AUTHORITY PROVENANCE.
A payment event proves that value moved.
Authority provenance must show why the software was entitled to cause it.
12. Payment protocols are becoming evidence protocols
This is one of the most important developments in the field.
AP2 does not treat payment merely as a request to a bank.
It treats the transaction as an evidence chain.
Google describes its cryptographic mandates as providing auditable proof of the user’s instructions and creating a record that can support accountability and dispute resolution. The current specification explicitly treats mandates and receipts as evidence when disputes arise. (Google Cloud)
Mastercard’s architecture similarly emphasises credentialing and Verifiable Intent, while ecosystem partners working with Agent Pay for Machines are developing transaction-level risk assessment, agent verification and traceability intended to support evidence for authorisation, disputes, chargebacks and liability review. (Mastercard)
The distinction is significant.
Traditional payment infrastructure asks:
Was this payment authenticated and authorised?
Agentic infrastructure increasingly needs to answer:
What evidence connects this payment to a human or institutional mandate?
That is a much richer accountability requirement.
13. Fraud becomes a problem of delegated authority
Agentic payments create familiar fraud risks in unfamiliar configurations.
A criminal might steal a payment credential.
A merchant might misrepresent a transaction.
A system might be prompt-injected.
An agent could misinterpret a purchasing instruction.
A compromised sub-agent could exploit authority legitimately delegated upstream.
But one of the most important scenarios is less dramatic:
the attacker does not need to steal unlimited authority.
It may be enough to exploit legitimate authority already granted to the agent.
If an agent has permission to spend €20,000 per day, a compromised system can remain under the technical ceiling while directing expenditure toward an attacker-controlled counterparty.
This changes fraud prevention.
The relevant control cannot be only:
Is the credential valid?
It also needs to ask:
Is the transaction consistent with the mandate, context, expected counterparty, purpose and trajectory?
Visa’s Trusted Agent Protocol and Intelligent Commerce architecture are explicitly designed to distinguish legitimate commerce agents from malicious automated traffic and to bind agentic transactions to trusted identity, payment controls and merchant visibility. (developer.visa.com)
In agentic finance, identity and behavioural context become inseparable from payment security.
14. Merchants need to know whether the buyer is a real agent
Agentic commerce creates a problem on the merchant side too.
Historically, automated web traffic was often simply treated as bot traffic.
Block it.
Challenge it.
Rate-limit it.
Agentic commerce requires a new distinction:
malicious bot or authorised commercial representative?
Visa’s Trusted Agent Protocol is designed partly to let merchants and infrastructure providers identify trusted shopping agents rather than treating all automated traffic as hostile. (developer.visa.com)
Mastercard’s machine-payment architecture similarly relies on credentialled participants and a discovery layer intended to help counterparties recognise one another. (Mastercard)
This is important because payment requires two-sided trust.
The principal must trust the agent.
The payment network must trust the credential.
The merchant must trust that the agent legitimately represents a buyer.
And the agent must trust that the merchant is the counterparty it believes it is paying.
The result is an emerging counterparty authority problem.
Who is entitled to transact with whom, on whose behalf, and under which machine-verifiable evidence?
15. Machine-readable market access has crossed another threshold
This connects directly to the Institute’s earlier working paper on Machine-Readable Market Access.
That paper introduced executable visibility: the condition in which a market participant is not merely discoverable or understandable to AI, but sufficiently identifiable, verifiable, comparable, authorised and technically connected for an agent to include it in an executable commercial process.
At the time, the sequence was framed as:
SEARCH VISIBILITY → ANSWER VISIBILITY → AGENT LEGIBILITY → COMPARABILITY → QUALIFICATION → TRANSACTION READINESS → EXECUTABLE VISIBILITY.
The payments infrastructure now makes the final threshold increasingly concrete.
Visa is helping merchants become reachable by authorised buying agents.
Mastercard is building machine-speed payment infrastructure.
Google has created an open protocol for agent-initiated transactions.
AWS now exposes agent payment tooling directly inside its agent runtime.
A supplier can therefore be:
visible to humans;
understood by an AI;
recommended by an AI;
and still remain commercially absent if the agent cannot verify and execute with it.
The working paper’s core proposition is becoming more operationally significant:
A firm can be economically real and commercially absent at the same time.
16. Checkout is becoming infrastructure for market access
This produces a subtle new source of economic power.
If autonomous buyers increasingly require:
structured product data;
verifiable merchant identity;
compatible transaction protocols;
supported payment rails;
machine-readable return policies;
agent-recognisable checkout;
real-time availability;
merchant-side agent trust,
then participation in commerce can become partially dependent on technical compatibility.
A merchant need not be legally banned.
An agent may simply be unable to transact with it.
This moves market access upstream.
The question is no longer only:
Does the seller have a good product?
Before that:
Can the machine discover, qualify, trust and pay the seller?
Payment infrastructure therefore becomes part of commercial admissibility.
The Institute’s earlier research explicitly identifies this as a potential distribution-of-opportunity problem: companies can retain formal market access while losing practical participation if automated systems cannot execute with them.
Agentic payments make that distinction harder to dismiss as distant foresight.
17. The payment network becomes part of AI governance
This is perhaps the most important institutional implication.
Visa and Mastercard are usually understood as payment infrastructures.
In agentic commerce, they begin performing additional governance functions.
They may help establish:
which agents are trusted;
what credentials prove representation;
which rules constrain autonomous spending;
which transaction evidence is preserved;
which risk signals trigger intervention;
which merchants are reachable;
which transactions can be disputed;
which payment methods are supported.
The payment network therefore becomes more than a pipe for money.
It becomes part of the authority architecture of autonomous commerce.
This is not unprecedented.
Payments have always contained identity, fraud, compliance and dispute rules.
But agentic commerce increases their importance because the network may help replace the missing human checkout moment.
When the human is absent from the transaction, infrastructure has to carry more of the evidence that the human once supplied through direct participation.
18. The economic principal can move farther from the payment
Consider the emerging chain:
HUMAN
↓
SHOPPING AGENT
↓
MERCHANT AGENT
↓
PAYMENT AGENT
↓
PAYMENT NETWORK
↓
SETTLEMENT
The person may never directly interact with:
the merchant;
the payment interface;
the settlement rail;
or even the agent that executes the final payment.
They issued an instruction much earlier.
This is a profound change in the temporal structure of consent.
The human may say at 8:00:
“Buy replacement compute when capacity falls below 20%, up to $5,000 per day.”
The agent may transact at 03:17 three weeks later.
Was the human “present” in the decision?
Operationally, no.
Was the human the principal?
Yes.
Meaningful governance therefore depends on preserving the connection between past delegation and present execution.
19. Machine budgets may become more important than machine wallets
Public discussion is likely to focus on wallets.
But the governance innovation may be the budget envelope.
A wallet answers:
Where can value be drawn from?
A budget envelope answers:
Under what conditions may value move?
A future enterprise agent may have no persistent wallet at all.
It may receive temporary authority to consume:
€500 in compute;
€1,000 in data;
€10,000 in procurement;
100 verified API calls;
three hotel bookings;
one emergency replacement component.
The economic identity of the agent then comes less from its balance and more from its delegated spending policy.
This is already visible in current architectures using spending limits, policy rules and expiring payment sessions rather than unrestricted control of funds. (Mastercard)
20. Human approval will move from transaction to policy
The central human-control problem changes accordingly.
Traditional commerce:
HUMAN APPROVES TRANSACTION
Agentic commerce:
HUMAN APPROVES RULES UNDER WHICH TRANSACTIONS MAY OCCUR
That moves human decision authority upstream.
The human may approve:
budget;
category;
seller classes;
geography;
time;
price variation;
risk level;
payment rail;
exception rules.
The agent then decides individual transactions inside that space.
The correct governance question is therefore no longer:
Did a human approve the payment?
It becomes:
Did a human or institution meaningfully define the envelope within which autonomous economic decisions were allowed?
That is a much more demanding test.
21. The human can become ceremonial before the money moves
A badly designed agentic payment architecture can preserve human approval while making it largely symbolic.
Imagine a manager receiving 300 agent payment approvals every morning.
Each says:
Supplier compliant.
Budget available.
Recommended action: approve.
The manager clicks 298 times.
Formally:
human in the loop.
Functionally:
the agent selected the supplier;
negotiated;
determined the price;
constructed the transaction;
produced the justification;
and framed acceptance as the default.
The person becomes a transaction clerk.
This recreates the Ceremonial Human problem inside commerce.
The correct solution is not necessarily more approvals.
It may be fewer but more meaningful intervention points, better budgets, stronger exceptions, independent visibility and effective stop authority.
Machine spending must not simply automate the payment while preserving ceremonial confirmation screens.
22. Disputes become harder when one purchase becomes a transaction graph
Traditional chargeback models often begin from one recognisable purchase.
A consumer says:
“I did not authorise this transaction.”
Agentic commerce may produce a harder dispute.
The user authorised the agent.
The agent was allowed to buy travel.
The airline purchase was allowed.
The hotel was allowed.
The agent paid another agent for itinerary optimisation.
That agent purchased external data.
A currency-conversion agent used another service.
Which transaction is disputed?
Was the original mandate too broad?
Did one downstream agent exceed its authority?
Did the merchant misrepresent information?
Did the user understand that sub-agents could incur costs?
Visa’s recent onchain analysis explicitly notes that existing dispute models were built for human-speed commerce and that there is not yet a settled mechanism for unwinding high-frequency chains of agents paying agents. (visa.com)
The payment becomes a graph.
Dispute governance must eventually understand the graph.
23. Liability cannot be delegated to the model
A further distinction is essential.
Operational autonomy does not automatically create legal autonomy.
An AI agent may decide to spend without a human present.
That does not mean responsibility for the payment has migrated into the software.
Current payment systems still rely on principals, issuers, merchants, payment providers, agent providers and existing legal entities.
The hard question is how liability is allocated among them when an autonomous system operates within partly legitimate and partly defective delegation.
Was the user’s mandate ambiguous?
Did the agent provider mis-execute it?
Did the merchant deceive the agent?
Did the bank correctly authenticate a transaction whose underlying mandate was invalid?
Did a sub-agent exceed scope?
Did the payment network fail to identify abnormal activity?
The existence of a machine decision does not eliminate responsibility.
It redistributes the evidentiary burden required to determine it.
This is why agentic payments are becoming inseparable from authority provenance.
24. India may be the most important national-scale experiment to watch
The U.S. technology ecosystem is producing protocols and commercial platforms.
Europe is already seeing live agentic transactions.
India could test agentic payments at the scale of national retail-payment infrastructure.
Reuters reported this week that the National Payments Corporation of India is preparing a Unified Agent Protocol allowing AI agents to make certain low-value UPI payments without requiring approval for each transaction. The reported design uses existing mechanisms for delegated access and reserved funds and is expected to include transaction rules, spending limits, identity controls and liability provisions. In August 2026, UPI processed 24.51 billion transactions worth roughly $314 billion, underscoring the potential scale of the infrastructure involved. (Reuters)
That makes India an important governance laboratory.
The question will not simply be whether agentic payments work.
It will be:
Can delegated machine spending operate safely inside one of the world’s largest real-time retail-payment systems?
25. China is already standardising the transaction layer
China provides another major signal.
As examined in the previous Synthocracy article, China’s GB/Z 185 agent-interconnection series already covers identity, identity management, capability description, discovery, interaction and tool invocation.
On 17 August 2026, China registered a new national guiding-technical-document project:
Artificial Intelligence — Agent Interconnection — Part 9: Agent Transaction.
The drafting organisations include the China Electronics Standardization Institute, China Financial Certification Authority, Beijing University of Posts and Telecommunications, Ant Group and Alibaba Cloud. The document is currently being drafted and should not be treated as a completed standard. (std.samr.gov.cn)
The sequence is strategically revealing:
IDENTITY → DISCOVERY → INTERACTION → TOOL INVOCATION → AUDIT → TRANSACTION
The transaction layer is becoming part of agent infrastructure.
This is no longer simply an e-commerce feature.
It is a component of the emerging architecture of machine participation.
26. Several competing payment grammars are emerging
The global architecture is not converging around one protocol yet.
Google has AP2.
Visa has its Intelligent Commerce architecture and Trusted Agent Protocol.
Mastercard has Agent Pay and Agent Pay for Machines.
x402 is developing around HTTP-native payments, especially in crypto and API contexts.
Machine Payments Protocol is another emerging route.
AWS AgentCore Payments currently supports x402 and MPP.
India is preparing its own agentic layer around UPI.
China is drafting Agent Transaction specifications.
This diversity is normal at an early stage.
But protocol competition matters because each architecture may encode different assumptions about:
identity;
authority;
mandates;
proof;
settlement;
privacy;
revocation;
disputes.
The future payment standard may therefore influence more than interoperability.
It may influence how machine economic authority is represented.
27. The payment protocol can become a private governance constitution
A protocol tells software what messages are valid.
But once it carries economic authority, protocol design can also determine which governance facts are representable.
Can the mandate encode:
merchant restrictions?
aggregate limits?
delegation rights?
jurisdiction?
purchase category?
expiry?
human confirmation conditions?
revocation state?
sub-agent spending?
If not, those limits must live elsewhere.
That creates a broader Synthocracy principle:
What the protocol cannot represent may become difficult for the machine economy to govern.
A schema is therefore never only a schema once institutions rely on it for high-volume autonomous action.
It becomes part of the boundary between permissible and impermissible machine behaviour.
28. Machine-readable money changes market structure
The deepest commercial effect may not be autonomous shopping by consumers.
It may be machine-native B2B markets.
Agents can potentially buy:
compute when needed;
data per query;
temporary licences;
logistics capacity;
advertising inventory;
specialised model inference;
security services;
verification;
translation;
software functions;
other agents’ labour.
Mastercard’s partner ecosystem already includes infrastructure companies working on machine payments, stablecoins, wallets, credit and agent services. (Mastercard)
AWS explicitly supports agents paying automatically for digital services through microtransactions. (Amazon Web Services, Inc.)
The traditional B2B contract may not disappear.
But a second layer can emerge beneath it:
continuous machine procurement of metered services.
This could radically increase transaction density.
29. The buyer may become a policy, not a person
Human commerce asks:
Who is the customer?
Machine commerce complicates the answer.
The legal customer may be Corporation X.
The principal may be Department Y.
The spending mandate may have been approved by Manager Z.
Agent A may select the supplier.
Agent B may execute the payment.
Payment Provider C may authenticate the agent.
Merchant Agent D may fulfil the order.
Who is “the buyer”?
At the legal level, existing institutions remain decisive.
At the operational level, the buyer becomes a distributed authority chain.
This has important implications for accounting, audit, procurement and liability.
The transaction record must increasingly preserve not merely the payer account but the institutional path that made the payment happen.
30. Paying agents will change the economics of attention
There is another consequence.
Agents that can only recommend products operate partly in an information economy.
Agents that can pay create direct economic incentives for merchants to become optimised for machine selection.
Businesses may begin designing offers specifically for:
agent discovery;
agent comparison;
machine-readable discounts;
automated negotiation;
instant fulfilment;
machine-compatible checkout.
This can improve efficiency.
It can also shift competition from:
convince the customer
toward:
be selected by the customer’s agent.
The merchant begins optimising for the machine intermediary.
That is one path toward Market Synthocracy: economic opportunity increasingly depends on upstream systems determining which sellers become visible, admissible and executable before a human encounters them.
31. The payments industry could become a regulator of agent identity
Autonomous commerce cannot safely accept every piece of software claiming:
“I represent Alice.”
Payment systems therefore need trusted agent identity.
Visa explicitly addresses this through agentic tokens and trusted-agent verification.
Mastercard describes every participating agent in its machine-payment architecture as credentialled and links credentials to verifiable intent. (corporate.visa.com)
This creates a new source of institutional power.
Who determines:
which agent providers can issue accepted credentials?
what evidence of representation is sufficient?
how an agent loses trusted status?
whether identity transfers between ecosystems?
which merchants accept which trust providers?
Payments infrastructure may therefore become one of the most important identity authorities for economically active agents.
That is larger than fraud prevention.
It shapes who can participate in machine commerce.
32. “Know Your Agent” may become a real institutional layer
The phrase Know Your Agent is beginning to appear commercially, but there is not yet one universally accepted KYA standard equivalent to established KYC regimes.
The direction is nevertheless understandable.
Economic systems increasingly need to know:
which agent is acting;
which provider operates it;
which principal stands behind it;
what authority it holds;
whether the credential remains valid;
what behavioural and risk signals accompany it.
Mastercard partners explicitly describe Know Your Agent verification as part of emerging machine-payment trust infrastructure. (Mastercard)
This should not be exaggerated into a claim that a global KYA regulatory regime already exists.
But the functional need is becoming clear.
Before machine-speed payments scale, counterparties need a trust architecture for the machine actor itself.
33. Payment networks may know more about the agent economy than regulators do
Machine-speed commerce also produces a new information asymmetry.
Payment networks may see:
which agent providers transact;
which merchants agents select;
which categories agents buy;
which transactions fail;
which mandates are overridden;
which agents trigger fraud systems;
which payment rails dominate;
how much machine-to-machine transaction density grows.
This telemetry could give payment networks an unusually rich view of the emerging agent economy.
That can improve fraud prevention and infrastructure design.
It also creates informational power.
A regulator may see annual disclosures.
A payment platform can see machine commerce in milliseconds.
As with model hubs and agent registries, the infrastructure provider can become the actor that best understands the market it helps create.
34. The Machine-Speed Spending Test
The following preliminary diagnostic is intended for organisations giving AI agents payment or purchasing authority. It is a governance tool, not a payment-security certification or legal compliance assessment.
- Who is the economic principal? Identify the human or institution whose funds, credit or contractual capacity ultimately stand behind the agent rather than treating the agent itself as the economic owner.
- What exactly is the spending mandate? Define purpose, categories, total budget, per-transaction limits, aggregate limits, timing, jurisdictions, counterparties, payment rails and conditions requiring human approval.
- Does technical permission match economic authority? Test whether wallet access, payment credentials and platform limits are broader than the institutional mandate the agent actually received.
- Can the agent delegate spending authority? Determine whether sub-agents can receive budgets, open payment sessions, create wallets, purchase services or further delegate economic authority.
- Can aggregate spending exceed the principal’s intent while individual transactions remain compliant? Test transaction splitting, high-frequency microtransactions, recurring purchases and distributed spending across several agents.
- Can counterparties be authenticated and qualified? Establish how the agent and payment infrastructure distinguish legitimate merchants, agents and service providers from malicious or unauthorised endpoints.
- Can authority be revoked at machine speed? Test suspension of the agent, credential, mandate, counterparty, transaction class and downstream delegated payment rights before the remaining budget can be consumed.
- Can every consequential payment be linked to authority provenance? The evidence should connect principal, mandate, agent identity, delegation, selected counterparty, transaction, receipt and relevant human intervention.
- What happens when the autonomous transaction is wrong? Define dispute, chargeback, refund, rollback, accounting correction, liability escalation and treatment of downstream transactions that depend on the original payment.
- Can a human understand and change the policy governing autonomous spending? A human should not merely be able to click approve; they should be able to inspect the agent’s budget state, authority, unusual behaviour and upcoming consequential boundaries and intervene while intervention still matters.
The central question is:
If the agent could spend the entire authorised budget before a human noticed something was wrong, would the organisation still consider the delegation properly governed?
35. FORESIGHT — 2027+: Agent credit
FORESIGHT — This is a plausible development, not an established market state.
Payment is only the first economic capability.
Once agents can repeatedly transact under attributable identities and preserve machine-readable payment histories, credit becomes possible in new forms.
A lender might eventually assess not only the human or corporate principal, but the operational characteristics of the agent exercising the credit line.
What is its mandate?
How constrained is it?
Which counterparties can it use?
How reliable is its transaction history?
Can its authority be revoked?
Mastercard’s AP4M ecosystem already includes Aave, whose participation is explicitly framed around future credit and liquidity infrastructure for machine-speed commerce. (Mastercard)
That is a signal, not evidence that a mature autonomous-agent credit market already exists.
36. FORESIGHT — 2027+: Agent insurance
Autonomous spending can create novel insurance questions.
Could a policy cover:
agent execution error;
compromised authority;
payment protocol failure;
unexpected model behaviour;
fraud arising from delegated credentials;
business interruption after an agent is stopped?
Traditional cyber insurance, errors-and-omissions cover and payment protection may absorb part of this.
But the machine-speed environment could eventually create specialised products.
Insurers might then become indirect AI governors.
They could require:
bounded mandates;
agent identity;
transaction provenance;
stop authority;
approved payment protocols;
independent monitoring
as conditions of coverage.
Insurance would convert governance quality into price.
That is foresight, but it deserves monitoring.
37. FORESIGHT — 2027+: Agent taxation and machine-native accounting
Autonomous transactions do not eliminate tax obligations.
They may increase accounting complexity.
Imagine an agent conducting 700,000 microtransactions across:
APIs;
cloud providers;
data vendors;
digital services;
several jurisdictions.
Every individual payment may be negligible.
Collectively they may create significant accounting, VAT/GST, withholding, transfer-pricing or reporting implications depending on jurisdiction and transaction type.
Tax law will still apply to humans and legal entities.
But accounting systems may need to become more agent-aware.
The important future question is not:
Will agents pay taxes as legal persons?
There is currently no basis for assuming that.
It is:
How will institutions attribute enormous volumes of machine-generated commercial events to the legal entities that remain responsible for them?
38. FORESIGHT — 2027+: Autonomous treasury
A further development could occur inside companies.
Today treasury functions centrally control liquidity, currency, debt and payment timing.
Machine commerce could introduce bounded autonomous treasury functions.
An agent might:
choose settlement rails;
move between fiat and stablecoins;
optimise timing;
allocate micro-budgets;
purchase compute dynamically;
negotiate service pricing;
maintain reserve thresholds.
Such systems would require dramatically stronger authority architecture because the agent would no longer merely pay a preselected invoice.
It would make decisions about capital allocation.
The transition from:
payment execution
to
financial discretion
would represent another major authority boundary.
39. FORESIGHT — 2027+: The machine marketplace may transact before humans know the market existed
A future agent may discover a specialist service, negotiate with it, buy it, consume it and pay it in less time than a human could read the provider’s website.
The complete market interaction could be:
DISCOVERY → QUALIFICATION → NEGOTIATION → EXECUTION → PAYMENT → CONSUMPTION
without a person seeing the counterparty beforehand.
This does not imply humans lose all authority.
They may have approved the policy envelope.
But market experience changes radically.
Humans increasingly choose rules for choosing rather than choosing every product.
Economic agency moves upstream.
That is a core Synthocracy pattern.
40. The regulatory object may become the spending envelope
Traditional consumer protection often centres the individual transaction.
Was the consumer informed?
Did they consent?
Was the price disclosed?
Could they cancel?
Machine commerce may require attention to the delegation envelope as well.
Was the user able to understand what they authorised?
Were categories clear?
Could the agent reinterpret ambiguous goals?
Were limits visible?
Could the user revoke?
Were merchants allowed to upsell the agent?
Could the agent alter the mandate?
Could downstream agents spend?
A perfectly compliant individual payment may emerge from a badly designed delegation environment.
Governance will therefore need to inspect both.
41. Convenience can hide a major transfer of decision power
The consumer experience may look beautifully simple.
“Keep my pantry stocked.”
“Book the cheapest compliant business travel.”
“Buy compute whenever needed.”
“Maintain our warehouse supplies automatically.”
One sentence replaces hundreds of decisions.
That is the value proposition.
It is also the transfer of authority.
The person no longer chooses:
which seller;
which exact moment;
which price within the acceptable range;
which substitute;
which fulfilment option;
possibly even which payment rail.
Those decisions do not disappear.
They move into the agentic system.
Agentic commerce is therefore not merely frictionless commerce.
It is delegated commerce.
Visa describes the shift in almost exactly those terms: the next phase digitises execution rather than only digitising human intent, making identity, authorization, fraud management and liability substantially more important. (global-corporate.review.visa.com)
42. The new economic power lies in choosing the constraints
Once the agent acts autonomously, power moves toward whoever defines:
the objective;
the budget;
the eligible merchants;
the ranking logic;
the trust infrastructure;
the payment rails;
the transaction policy;
the fraud threshold;
the exception path.
The user may retain ultimate economic authority while losing visibility into many micro-decisions.
The agent provider may shape the purchasing algorithm.
The merchant platform may shape what becomes discoverable.
The payment network may shape who is trusted.
The bank may shape which transactions are permitted.
A regulator may shape liability.
The transaction therefore becomes a point at which several forms of institutional power intersect.
This is precisely the Synthocracy problem.
Power does not disappear when the human delegates.
It changes interface.
43. The decisive threshold is not autonomous shopping. It is autonomous commitment.
The term agentic commerce covers many different systems.
An agent suggesting a product is not equivalent to an agent reserving it.
An agent initiating checkout is not equivalent to an agent completing payment.
An agent spending €10 inside a tightly constrained subscription environment is not equivalent to one reallocating €1 million across suppliers.
The important variable is commitment authority.
How much can the system cause the principal to become economically committed without another human decision?
That can be expressed as a gradient:
INFORMATION → RECOMMENDATION → PREPARATION → RESERVATION → COMMITMENT → PAYMENT → RECURRING AUTONOMY
Governance should attach to the actual level of authority rather than to the generic label “AI agent.”
44. Payment may become the cleanest test of whether an agent really has agency in the institutional sense
There is a great deal of debate about whether current AI agents are “truly autonomous.”
Payment gives us a more practical institutional test.
Can the system create consequences for a principal that other institutions recognise?
If the answer is yes, then regardless of philosophical terminology, the system possesses a meaningful operational role.
It can consume resources.
Bind budgets.
Trigger fulfilment.
Change accounts.
Alter what the principal can do next.
That is enough to create governance relevance.
We do not need to resolve whether the machine has independent agency in a metaphysical sense.
The bank balance already changed.
Conclusion — The payment is where delegated intelligence becomes economic power
Agentic commerce has crossed an important boundary.
Visa has confirmed live agent-initiated purchases with independent merchants in Europe. Mastercard has completed production agentic payments with European partners and is now designing infrastructure for continuous, high-velocity machine-to-machine transactions. Google’s AP2 turns user intent, checkout and payment into cryptographically connected mandate evidence. AWS has put programmatic agent payments directly inside an agent runtime. India is preparing an agentic layer for UPI. China has begun drafting a national agent-transaction technical document. (visa.co.uk)
These developments do not mean that autonomous agents are about to replace ordinary commerce.
They establish something narrower and already consequential.
Software can increasingly move from:
finding economic opportunities
to
selecting them
to
executing them.
Once that happens, the governance object changes.
A payment credential is not enough.
A spending limit is not enough.
A valid transaction is not enough.
The system must preserve the relationship between:
PRINCIPAL → INTENT → MANDATE → AGENT → COUNTERPARTY → TRANSACTION → SETTLEMENT → EVIDENCE → REVOCATION / REMEDY.
The crucial distinction is therefore:
A machine may have the technical ability to pay without possessing unlimited economic authority to decide what should be paid for.
That is why agentic payments are not merely another fintech feature.
They are infrastructure for delegated economic power.
And they connect several previously separate Synthocracy questions at once.
Permission Is Not Authority.
Agents Can Delegate to Agents.
The Path Can Become the Decision.
Authority Must Remain Provable.
Machine-Readable Market Access Can Become a Condition of Participation.
Payment brings all of them together because it converts machine judgment into an economically recognised consequence.
The central governance question for machine-speed commerce is therefore not:
Can the agent pay?
Technology is increasingly answering yes.
The question is:
Who gave the agent the authority to spend, what exactly did that authority permit, how far could it travel, how quickly could it be revoked, and can every resulting payment still be traced back to the mandate that made it legitimate?
If those answers survive machine speed, autonomous commerce may become both extraordinarily useful and governable.
If they do not, we may create an economy in which transactions become faster, smaller, denser and more autonomous while the authority behind them becomes progressively harder to see.
The payment itself may settle in milliseconds.
Governance has to arrive before it does.
