Reference · updated 6 November 2026

Agentic payments tracker

What changed, when, and why it mattered to anyone giving an AI agent bounded financial authority. Specification releases, network programmes, platform launches, regulatory moves and the infrastructure underneath — newest first, each with its primary source.

Inclusion test: would a firm deciding how to delegate spending authority to an agent have to know this? Funding rounds appear only where the company is building authority, identity or credential infrastructure rather than an application on top of it. Where only a month is documented, only a month is shown.

2026

  1. 29 October 2026FundingAuthorityRail

    PhotonPay raises a $40M Series C and is developing a policy-based execution framework for agents on its payment platform

    PhotonPay

    PhotonPay, a Hong Kong payments company founded in 2015, announced a $40 million Series C led by Blockchain Capital, with new investor SBI Group and existing investors IDG Capital, GL Ventures and Lightspeed Faction. It reports more than 200,000 business customers in over 200 countries and territories, $65 billion in annualised transaction volume as of August 2026, and 34 payment and financial licences and authorisations across the Americas, Europe and Asia; these are the company's own figures. Its platform already offers multi-asset wallets, local collection accounts in 17 markets, receipts in more than 60 currencies, over 100 payout routes and card issuing, with 4.4 million cards issued in the past year. The funding is for stablecoin infrastructure and for agents: PhotonPay plans support for the Model Context Protocol and says it is developing a policy-based execution framework to enforce programmable authorisation rules, spending limits and transaction-level controls on the financial actions agents initiate, alongside AI-assisted risk review that identifies complex cases for human assessment. None of the agent framework is described as available. Underneath its stablecoin flows, Dfns (partnership announced 29 September) provides programmatic wallets, transaction signing, and a policy engine with limits, allowlists and approval workflows applied before anything is signed, with an exportable audit trail; Dfns does not describe agent features or fiat rails. In May, PhotonPay and Mastercard ran a live demonstration in which an agent booked and paid for a ride with a tokenised PhotonPay card, within what the release calls the test flow.

    mnd8t assessment

    The authority model for agents is being built into the platform that already holds the accounts, issues the cards and moves the money, by a company with existing distribution rather than a new entrant. For a business whose agents pay only through PhotonPay, configuring their permissions there is the natural choice, and an outside authority service would have to justify another integration. The wallet policy engine underneath shows how quickly a platform can assemble limits and approvals through a partner. What the announcement describes is governance across the rails one platform connects, which is not the same as one delegation held across platforms run by different operators: a limit shared with a treasury system or a custodian's wallet elsewhere, a revocation that reaches them, a supplier restriction that holds whichever provider the agent picks. Whether enterprises will buy that separately, rather than consolidate onto one platform, is not shown by this round or by anything else yet.

    Sources
  2. 29 October 2026FundingIdentityGovernance

    Mintive, formerly MintMCP, raises a $7M seed for identity, tool permissions and approvals for enterprise agents

    Mintive

    Mintive announced a $7 million seed round led by Cowboy Ventures, with Coatue, Operator Collective and Hustle Fund, bringing its total funding to about $11 million. It gives each enterprise agent its own identity and authorisations, separate from those of the employees it serves, and runs an MCP gateway that controls which services agents can reach and what actions they can take, an LLM gateway that can cap model costs, and monitoring across a company's agents. Its documentation describes human approval of individual tool calls, shown and consumed per exact call with its arguments, and customer-written gateway middleware that can call external services and be set to fail closed. It reports more than 50 enterprise customers since its February launch, naming Ro, Modern Treasury, the University of Michigan, Coursera, Apax and Stability AI. Modern Treasury's use is reported as a bank-operations agent; no report describes Mintive agents initiating payments.

    mnd8t assessment

    Enterprises are now buying a control plane for what their agents can reach and invoke, which is evidence of budget for agent governance rather than for financial authority. Permission to call a payment tool says nothing about whether this payment, to this beneficiary, against this period's remaining budget, is within what was delegated. Per-call approval with exact arguments and fail-closed middleware mean a gateway could carry simple payment rules on its own, so a check before the agent spends is not a distinction. What a gateway does not hold is a delegation shared across agents and financial systems, with its exposure, lifecycle and evidence; and a control placed only at the gateway is skipped by any route around it, which is why the executing system has to check the authority itself. The model-cost caps limit spend on models, not delegated financial authority.

    Sources
  3. 26 October 2026PlatformAuthorityCredentialRail

    Link adds a funded balance for AI agents, starting with Instinct, so purchases under a per-purchase limit need no approval

    Stripe (Link)

    Link, Stripe's digital wallet, began rolling out a funded balance for AI agents to eligible US users of Instinct, a personal AI assistant. The user adds money with a supported debit or credit card and sets a maximum amount per purchase; the agent can buy below that amount without asking, and larger purchases still need the user's approval. Until now Link's agent wallet asked the user to approve each purchase or a budget before the agent was issued a payment credential. Stripe Crypto's technical account describes the stack underneath: card funds converted to a dollar stablecoin by Stripe's onramp and held on Tempo, a wallet with keys and signing from Privy, the user's spending permissions applied by Link's agent wallet, and a Stripe Issuing virtual debit card backed by the balance, so the merchant takes an ordinary card payment. Stripe calls it its first consumer deployment of Financial Accounts backed by Privy's non-custodial wallets; reporting also describes a custodial version in which Bridge, a Stripe company, holds the assets. The limit applies to each purchase separately and is not a total budget. Stripe has not disclosed how many people use the balance or what it has processed.

    mnd8t assessment

    A continuing permission to spend, granted once and used many times without asking, is now part of a consumer product from a major payments company, not a demonstration. Funded balance, per-purchase limit and escalation above it are the core of a simple mandate, held by the platform that also issues the card and settles the payment, which is where native controls are expected to win. The launch shows what one wallet governs for one agent; it is silent on what a principal means by the delegation as a whole. A $100 limit on each purchase and $100 for the task are different instructions, and a $500 balance under a $100 limit can be spent in five purchases that each comply. Link's agent page also offers approval of a budget, so this is a question about which control a user picks, not a gap in Link. What no single wallet holds is a limit shared with agents and payment systems outside it.

    Sources
  4. 21 October 2026PlatformAuthorityRail

    Stripe launches Treasury for agents, letting startups' agents pay invoices and move money under permissions the business sets

    Stripe

    Stripe introduced Stripe Treasury for agents, which lets startups run financial operations on Stripe Treasury through agents, including ChatGPT and Claude, connected through Stripe's MCP server. Agents can check balances, pay invoices, move money between accounts and convert currencies; creating cards is listed as coming later, and spending limits for agents are expected in the coming weeks. The business chooses which accounts and data each agent can reach, whether it can only read or can also act, and when a money movement requires human approval. Stripe's example founder has the agent prepare payments that he approves before funds move. Stripe is not a bank; the checking accounts are provided by Fifth Third Bank, N.A. The announcement does not state availability by country or whether the product is generally available.

    mnd8t assessment

    A payments platform now offers its own authority model for agents acting on business money: scoped accounts, read or act, and rules for when a human approves. Those are the first parts of a mandate, set inside the platform that also holds the account and executes the payment, and spending limits are announced rather than shipped. Within Stripe, a business may find these controls enough. The open questions are the ones a single platform does not answer by itself: whether the same delegation holds when the agent also pays through a card, a bank or a wallet outside Stripe, and what record of a refused or escalated action exists beyond Stripe's own logs.

    Sources
  5. 21 October 2026PlatformCredentialCommerce

    Anthropic opens Claude Duet, a work agent that buys for small businesses through Stripe Link with approval for each spend

    Anthropic and Stripe

    Anthropic opened Claude Duet, an agent for work and small businesses, as a research preview by waitlist for US Pro and Max subscribers, on iOS, Android and claude.ai. It can buy items for a business through Link, Stripe's digital wallet: it confirms the item with the user, Link asks the user to approve the spend, and payment is made with a virtual card so the real card number is not shared. It can also check out at online stores with Shopify's Shop Pay. Anthropic says Duet shows what it plans to do before any payment and waits for approval, and that trading securities and moving money between accounts are off-limits even with approval. No spending limit or budget is described.

    mnd8t assessment

    A second general-purpose agent from a frontier lab reaches the payment moment and hands it back to a person, as Meta's Muse did with the same wallet in September. Per-purchase approval is a sound default for a preview, and it is a confirmation step rather than delegated authority. The fixed exclusions are worth noting: some actions are withheld from the agent whatever the user approves, which is a rule set by the platform, not by the business. Moving a business from approving every purchase to a standing allocation, with amounts, suppliers and an expiry it sets itself, is the step this launch leaves open.

    Sources
  6. 21 October 2026IndustryIdentityAuthorityRail

    PPRO, BLIK, EPI, Bancontact and DIAS form a Local Payments Council for agentic commerce, with mandates and delegated authority in scope

    PPRO, BLIK, EPI, Bancontact Company and DIAS

    PPRO launched the Local Payments Council for Agentic Commerce with BLIK, EPI (the scheme behind Wero), Bancontact Company and DIAS as founding members; PPRO says further payment schemes have committed to join. Its aim is common technical standards so that local payment methods work securely as agents take over purchasing. It names five work areas: out-of-band authorisation and session hand-off; agent identity and attestation for non-card rails; consent, mandates, and delegated authority; disputes, refunds, and liability; and discoverability and agent-surface eligibility. It will work through working groups, technical collaboration and hackathons, and contribute its findings to the protocols and frameworks forming elsewhere. No protocol is named and no timetable or output date is given. In August PPRO announced work with BLIK on agent-initiated transactions in Poland.

    mnd8t assessment

    Mandates and delegated authority are now on the agenda for account-to-account and local schemes as well as cards, which makes creating and verifying a mandate a likely standard capability on each family of rails rather than a product in itself. Each standard will govern authority within its own schemes. The council says nothing about an organisation whose agents pay through several of them and through cards or stablecoins at once, and whose single delegation has to hold across all of them. It is a statement of intent; nothing has been published.

    Sources
  7. 20 October 2026NetworkAuthorityCredentialRail

    Mastercard shows an agent making nine payments to two merchants under one approved budget, and opens early access to Agent Pay for Machines

    Mastercard

    At Cloudflare Connect, Mastercard showed Agent Pay for Machines, announced in June with programmatically enforced spending limits and settlement over cards, bank accounts and stablecoins, completing a pilot end to end. The marketing agency Hype gave an AI agent a campaign task and funded it within a budget Hype approved. The agent bought social media research from AIsa and eight campaign images through Cloudflare AI Gateway: nine payments to two providers, with no separate billing relationship with either. Payment uses x402: a provider answers with HTTP 402, the agent returns a signed voucher within its spending authority, and the provider verifies it before delivering; vouchers can be batched and redeemed later rather than settled one by one. Coinbase Developer Platform supplied the wallet infrastructure, Base the settlement network, and BVNK, which Mastercard acquired in August, the agent wallet and payment and settlement through Mastercard's infrastructure. Developers can now apply for early access to the buyer- and seller-side APIs, a toolkit and a sandbox. The service is a pilot and not commercially available, and no budget figure or transaction volume was given.

    mnd8t assessment

    The first public demonstration by a card network of one approved budget governing a sequence of payments to unrelated suppliers, with the authority checked at each payment rather than at a single checkout. That makes continuing, bounded authority across several merchants a network feature, not a gap an independent provider can claim. The announcement does not describe several agents drawing on one budget, changing or revoking the budget while vouchers are outstanding, or the same limit holding when the agent pays through a provider outside Mastercard's network. Their absence from a demonstration is not evidence that Mastercard cannot provide them. The question it leaves for an independent authority layer is narrower: whether an organisation needs one delegation to hold across systems that no single network, wallet or bank controls.

    Sources
  8. 20 October 2026NetworkIdentityCredentialCommerce

    Visa, BILL and Billtrust run a live pilot of AI agents completing buyer-approved invoice payments through supplier portals

    Visa, BILL and Billtrust

    Visa, BILL and Billtrust launched what they describe as the first live pilot of trusted AI agents initiating and completing approved buyer invoice payments end to end through supplier portals. BILL's Payment Agent is registered through Visa's Trusted Agent Protocol and Agentic Directory, part of Visa Intelligent Commerce, and pays supplier invoices for BILL customers with tokenised payment credentials and controls aligned with the buyer's approved payment instruction. Billtrust authenticates the agent through the Trusted Agent Protocol and gives it access to the supplier portal, so no portal login is shared. The release lists controls tied to the approved instruction, a payment path tied to the specific invoice, visibility of each payment's authorisation and completion, and the supplier's acceptance policy. Its FAQ states: “The agent only executes eligible payments that have already been approved by the buyer.” The pilot is processing end-to-end transactions with participating buyers and suppliers; no volumes were given. Spending limits and revocation are not described.

    mnd8t assessment

    Delegated execution, not delegated discretion: the buyer's existing approval workflow decides what is paid, and the agent removes the manual portal step. Where the financial decision has already been approved invoice by invoice, the network's agent identity and the platform's approvals cover the authority question, and a separate authority layer adds little. It also shows the acceptance side working: a supplier platform recognising a registered agent and letting it in, which is the step institutions are refusing to outside agents that hold customers' credentials. The authority problem that remains is the other model, an agent choosing what to pay within a continuing allocation.

    Sources
  9. 19 October 2026RegulationIdentityAuthorityGovernance

    FCA says it will develop a trusted framework for agentic finance, with approaches to agent identity and delegated authority

    Financial Conduct Authority

    In a speech at Bloomberg's UK Policy Series, Jessica Rusu, the FCA's chief data, information and intelligence officer, said the FCA will work with industry, other regulators and frontier AI labs on a “trusted framework for agentic finance”, with clear approaches to agent identity and delegated authority as well as to accountability and execution. No timetable, form or consultation was given. She said agentic systems require “continuous, conditional assurance”, because a system that is safe when deployed may behave differently later, under stress or when its underlying models change, and that the existing duty to report major incidents should extend to significant AI failures and near-misses. The speech notes that agents can now manage payments and investments and that the FCA's AI Lab is tracking firms building agent-led payments. Six days earlier, the FCA's chief executive told the Treasury Committee that the FCA is not writing AI-specific rules for firms. The FCA publishes the text as drafted, which may differ from the speech as delivered.

    mnd8t assessment

    The most specific statement yet from the UK conduct regulator that an agent's delegated authority needs a defined approach of its own, named separately from the agent's identity, rather than being left to existing consent and authentication rules. It is an intention with no document behind it, and the FCA's stated position is still that existing rules apply. Continuous assurance and near-miss reporting both favour a decision record kept for every attempted action, refused and escalated as well as approved, rather than a record of completed payments alone. HM Treasury's payment services consultation, closed on 6 October, remains the route to legislation; the framework described here would sit beside it, and its form, whether guidance, a standard or rules, is open.

    Sources
  10. 16 October 2026PlatformIdentityRailGovernance

    JPMorgan, Schwab, Citi and Bank of America restrict outside AI agents from acting in customer accounts

    JPMorgan Chase, Charles Schwab, Citigroup and Bank of America

    On JPMorgan's third-quarter earnings call on 13 October, Jamie Dimon said the bank would not “allow just any outside agent to come inside the company”. A spokesperson said it acts when it detects a third-party agent “attempting to access accounts by obtaining customers' banking credentials”, and that it supports “secure, customer-authorized data sharing through open banking providers”. On Schwab's earnings call on 15 October, Rick Wurster said an agent “coming to our site and trying to log in on behalf of a client” is not safe and will not be allowed, that Schwab blocks outside agents using clients' credentials or browser automation, and pointed clients to Schwab's own assistant, Charley. On 16 October the Financial Times reported that Citigroup and Bank of America were also restricting third-party agents from logging into or transacting in customer accounts, and connected the restrictions to concern that agents could move idle balances into higher-yielding products. Coverage reports Citi as still allowing limited read-only data access through open banking providers. No bank has published a policy document; the positions are from earnings calls, spokespeople and press reports.

    mnd8t assessment

    What is being refused is a method of access, not agentic finance: an outside agent holding the customer's credentials and operating the bank's own interface. Customer-authorised data sharing through approved providers, and the banks' own assistants, continue. The consequence for an independent authority layer is that a principal's delegation, however well evidenced, does not oblige the institution holding the money to accept the agent or the channel it uses. Delegated authority, institutional acceptance and execution are separate questions, and only the first is the principal's to answer. The reporting gives security and liability as the stated reasons and deposit economics as a likely one; both point to banks preferring to issue and enforce agent permissions through their own infrastructure or approved partners.

    Sources
  11. 16 October 2026InfrastructureRail

    Jack Henry plans to integrate Google Cloud Universal Ledger, bringing tokenised deposits to community banks and credit unions through their core provider

    Jack Henry and Google Cloud

    Jack Henry announced an expanded collaboration with Google Cloud under which it will become the first core banking technology provider to integrate with Google Cloud Universal Ledger (GCUL), so that its bank and credit union clients can offer tokenised deposits with programmable, around-the-clock settlement. The release cites deposit retention, near real-time settlement, integration through Jack Henry's existing architecture, and automated clearing and multilateral netting without pre-funded accounts. Jack Henry serves more than 7,200 clients. No participating institution, launch date or pricing was given, and the release does not describe agent-specific controls. GCUL is a managed, permissioned ledger in Preview, open to allowlisted organisations: accounts sign transactions with their own keys and hold roles that govern what they may do (ROLE_PAYER to send tokens, ROLE_RECEIVER to receive them), with operator, token-manager and clearinghouse accounts managing supply and settlement. Of its two testing networks, only gcul-user-testing handles live transactions, on request for limited use cases. In March, BMO announced plans with CME Group to offer tokenised cash on GCUL for institutional margin, collateral and settlement.

    mnd8t assessment

    The significance is the route to market rather than the ledger: programmable deposits could arrive at smaller banks as a feature of the core platform they already run, with no blockchain project of their own. A ledger that already carries signatures and account roles does not need an outside service to decide whether an account may send tokens. What a role does not express is why an agent was authorised to instruct a transfer, whether the transfer fits a budget the organisation shares across agents and other rails, or whether that budget has already been spent elsewhere. That is the same continuing-delegation question left open by single-rail controls generally, and the core provider is well placed to answer it too for any institution that uses one bank and one ledger. It is a planned integration of a preview product, with no named adopters.

    Sources
  12. 15 October 2026RegulationAuthorityGovernance

    Financial Stability Board publishes final sound practices for AI, with deterministic controls and kill switches for agents

    Financial Stability Board

    The FSB's final report sets out 12 sound practices for financial institutions adopting AI, following a June 2026 consultation. It states that they are “non-prescriptive and do not constitute a binding international standard”. Among agentic AI risks it lists unauthorised actions, where an agent pursues an assigned objective through actions “inconsistent with organisational policies, legal requirements, delegated authority, or other intended constraints”. It recommends strictly separating an agent's goals, its permissions (“actions it is allowed to take”) and its rules (“e.g. when to seek human approval”) from the data it can access. Under human oversight, it describes deterministic controls “introduced at design and implemented as code in the control plane (the layer where decisions are made about what an agent can and cannot do)”, with examples including prohibited actions, limits on an agent's access to external systems, risk-based triggers for human approval “before approving financial transactions above a certain value”, and tested kill-switch mechanisms to pause, limit, override or remove an agent's access. It calls for unique identifiers for each agent and records of whether an agent “acted within its permissions”, and notes that such controls do not by themselves settle who is accountable, which institutions address internally by naming accountable individuals and externally through contracts with third parties.

    mnd8t assessment

    The most specific statement yet from an international standard setter that an agent's financial authority should be held outside the agent, in deterministic code, with escalation thresholds, revocation and a record of each decision against its permissions. It is addressed to institutions governing agents they deploy themselves, not to customers' agents reaching a bank from outside, and it names no protocol or provider. It describes what a control plane for agents should do; it does not say whose control plane an institution should trust.

    Sources
  13. 14 October 2026InfrastructureIdentityAuthorityCommerce

    GoDaddy, Infoblox, Google and Cloudflare demonstrate a cross-platform Chain of Trust, with AP2 mandates from an independent approval service

    GoDaddy, Infoblox, Google and Cloudflare

    Announced at GovWare 2026 in Singapore, the Chain of Trust reference architecture was developed with Singapore's Infocomm Media Development Authority (IMDA) against its Model AI Governance Framework for Agentic AI. A simulated purchase of a Madrid to Singapore flight ran across four independently deployed agents on three clouds and four domains: a buyer agent on AWS, a seller agent on Cloudflare Workers, and an approval service (the mandate authority) and an independent verifier on Google Cloud. The agents had no prior relationship. The buyer found the seller through signed DNS (DNS-AID) and ARD, checked its ANS registration and SPIFFE instance identity, and collected signed quotes. The person approved with a passkey; the approval service applied the person's own limits, which can include a per-purchase ceiling, period budgets, blocked sellers and a minimum Open Trust Index score for the seller, and signed AP2 v0.2 Checkout and Payment Mandates as key-bound SD-JWTs. The buyer closed both mandates and completed the checkout over UCP, with payment through a Stripe PaymentIntent in test mode. Before touching money the seller ran ten checks, the last a live read of the mandate's status at the approval service, so a cancelled approval or a stopped agent is refused at the next attempt. Forged and tampered requests from rogue agents were refused. Each party kept a hash-chained ledger, checkpointed to a public SCITT log, and the verifier compared the mandate chains held by buyer and seller and published a signed scorecard. The organisers describe it as a prototype and give no availability date.

    mnd8t assessment

    Portable, verifiable authority for a single purchase can now be assembled from open standards: identity from DNS, ANS and SPIFFE, authority from AP2 mandates, evidence from SCITT. Signed approvals and checkable transaction records are therefore not what distinguishes an independent authority service. The architecture does give mandate issuance its own role, held by neither agent nor the payment provider, and its approval service is close to what mnd8t does: it applies the principal's limits, including period budgets, before signing, and the merchant checks revocation live against it. The AP2 specification defines neither revocation nor cumulative limits across transactions; both are the approval service's own. What was not shown is one continuing delegation governing several agents and several rails at once: an aggregate budget held consistently under concurrent use, revocation reaching a card, a bank transfer and a stablecoin wallet alike, and a record linking each decision to the version of the delegation it applied. It is one simulated flight purchase in test mode.

    Sources
  14. 13 October 2026NetworkAuthorityCredentialGovernance

    American Express publishes its Intent Intelligence framework, scoping an agent's payment credential to an authenticated purchase intent

    American Express

    American Express made public Intent Intelligence, its recommended approach for capturing and authenticating a customer's purchase intent before an AI agent transacts, and for keeping that intent as a control through the rest of the transaction. A Create Intent API captures the customer's instructions and constraints, such as the merchant and a maximum budget; the customer authenticates and signs off the intent; and Amex returns an Intent ID and a Proof of Intent Token representing its high-level constraints. The token is used to obtain a digital payment credential, so the agent does not use the card number at checkout, and the Intent ID and token can be applied downstream to check that a purchase matches the authorised intent and to support authorisation, fraud and dispute decisions. Amex says the framework is designed to work regardless of who captures the intent, that it is available through the ACE Developer Kit with further integrations in development, and that it is engaging with EMVCo and supporting the x402 Foundation. The release does not describe expiry, revocation or intents covering more than one purchase, and names no implementing partners.

    mnd8t assessment

    Turns the authenticated intent behind Agent Purchase Protection into a published pattern: constraints captured before the agent acts, a token that scopes the credential, and an identifier that carries the intent into authorisation and disputes. It is the closest a card network has come to issuing a mandate and checking each transaction against it. Its scope is one purchase intent on an Amex credential, approved by the Card Member at the time; it does not express a standing delegation, a budget shared across purchases, agents or rails, or the revocation of authority already given. Saying that any party may capture the intent leaves room for an intent captured and evidenced outside Amex to be presented to it, which is where an independent authority record would have to fit. A published framework available in a developer kit, with no live deployments named.

    Sources
  15. 13 October 2026PlatformRailCredential

    Rain launches embedded stablecoin wallets that fund its cards, virtual accounts and bank payouts from one balance

    Rain

    Rain introduced embedded stablecoin wallets that its partners can offer inside their own apps, describing the wallet as the account at the centre of its platform. Non-custodial wallets are available to partners now and support twelve blockchains: Arbitrum, Avalanche, Base, BNB Smart Chain, Celo, Ethereum, Monad, Optimism, Plasma, Polygon, Solana and ZKsync. They hold USDC, USDT and other stablecoins and crypto assets, with functionality varying by network. Wallet balances natively back Rain-issued cards, which Rain says are accepted at more than 175 million merchant locations; money arriving through a Rain virtual account lands in the wallet as stablecoins, and funds can be converted and sent to local bank accounts through Rain's off-ramps and payouts. Partners can keep a third-party non-custodial wallet and still use Rain's cards, on-ramps and payouts. Custodial wallets, and earning on balances through third-party providers, are planned before the end of 2026. Rain is a Visa and Mastercard principal member; Digital Transactions names Kast, RedotPay and Western Union as distribution partners. The release describes no agent-specific controls; AI agents appear only in the company boilerplate, among the customers Rain serves.

    mnd8t assessment

    One balance now reaches three execution paths with different native controls: card authorisation under scheme and issuer rules, on-chain transfers under wallet signatures, and bank payouts under the payout provider's screening and limits. A delegation to an agent spending from that balance has to hold across all three, consuming one budget and revoked once, and none of that is described here. Rain could add such controls close to execution, and a firm using Rain alone may find native controls and its own approvals sufficient. The case for authority held outside the platform rests on firms whose agents spend across more than one provider, and on showing that a change of payment method cannot quietly change what the principal authorised. A live product, not a proposal, with no agent authority model.

    Sources
  16. 9 October 2026SpecificationIdentityAuthorityCommerce

    Sierra and Meta publish a draft Personal Agent Protocol, with standing permissions for consequential actions

    Sierra and Meta

    Sierra announced the Personal Agent Protocol (Poppy) on 6 October 2026, developed with Meta, Genesys, Instinct, NiCE, Rocket, Shopify, Stripe and Walmart, and on 9 October published Draft 0.1 and named 35 further design partners, including Visa, Mastercard, PayPal, Adyen, OpenAI, Okta, Plaid, Bank of America, BBVA and Wells Fargo. A company publishes /.well-known/poppy.json describing how agents may work with it; a personal agent identifies itself by a client_id URL that resolves to a metadata document; the customer signs in through OAuth; and the resulting DPoP-bound session token works across the company's website, APIs and its own agent. An optional Operations extension covers actions with consequences: the company proposes an operation with an id, a revision, terms and an expiry; the agent confirms a specific revision; each operation runs at most once; and a confirmation records approved_by as either "user" or "standing_permission", an earlier permission that must cover the company, account, action and every term. A company can set user_approval_required to refuse standing permissions. The specification states that a confirmation shows that a specific agent, in a specific session, stated that the user approved the terms, and that it does not prove the user saw or approved them; the company may revoke the agent's client_id if it confirms without the approval it claims. Payments are listed as an open topic.

    mnd8t assessment

    Agent permission is becoming general internet infrastructure rather than something defined only by payment networks and wallets, and the Operations extension already standardises much of what an authority layer would otherwise build around an action: an identifier, revisions that invalidate earlier approval, a lifecycle and at-most-once execution. The gap it names itself is the authority behind a standing permission. The company learns which agent asserted coverage, not what the customer delegated, whether the terms fell inside it, or whether it had expired or been revoked; its remedy is to trust the agent, revoke it afterwards, or ask the customer directly. That is the distinction between an authenticated agent and an authorised action, and Poppy's extension mechanism, through which companies and agents advertise optional capabilities by domain-prefixed name, is the natural place for verifiable delegated authority to be presented at confirmation. Poppy is framed around a personal agent acting for one user, not an enterprise agent acting under an organisation's delegation. It is Draft 0.1 and design partnership is not deployment.

    Sources
  17. 1 October 2026InfrastructureIdentityAuthorityGovernanceRail

    t54 reports 10 million agentic transactions on the XRP Ledger, screened by Trustline

    t54 Labs

    t54 Labs announced 10 million agentic transactions on the XRP Ledger and 20 million through Amazon Bedrock AgentCore. Its Trustline product states that over 20 million agentic transactions have been screened and more than 41,000 agents taken through Know Your Agent. Trustline describes four checks run before settlement: agent identity, authorisation and intent (its interface shows an “owner mandate verified” signal), transaction risk, and signed evidence for disputes and chargebacks. It lists integrations with AP2, ACP, Mastercard Agent Pay, Visa TAP, Web Bot Auth, x402, A2A and MCP, and positions the product across payments, credit and tokenised assets. Separately, t54's RLUSD CLI has the agent prepare a deterministic plan that an external runtime executes; a modified plan fails with an integrity error, and each execution produces a receipt. t54 contributed the x402 support in Ripple's XRPL AI Starter Kit, published in June.

    mnd8t assessment

    Transaction counts are not transaction value, and machine-to-machine micropayments produce very large counts cheaply. The architecture is the signal: a decision layer between agent and settlement, with the model kept out of execution, is now a product people buy, not a proposal. Trustline is a risk decision — should this transaction be trusted? — and checks the owner's mandate as one input to it. The question it leaves to whoever holds the mandate is the narrower one: was this agent delegated authority for this exact action, and would every other rail it uses reach the same answer from the same delegation? A low-risk payment to a legitimate supplier can still be outside what was delegated.

    Sources
  18. October 2026IndustryAuthorityRail

    Wells Fargo adds an AI agent section to its Online Access Agreement, effective 24 November 2026

    Wells Fargo

    Wells Fargo published an updated Online Access Agreement, effective 24 November 2026, with a new Section 15 on AI agents. It defines an AI agent broadly, as software acting autonomously, semi-autonomously or non-autonomously for a person or organisation. Subject to applicable law, the bank may treat instructions submitted by an agent the customer has authorised as the customer's own, without further verification. The customer is responsible for supervising the agent, including actions beyond the authority the customer intended. The customer must revoke an agent's authorisation properly, keep evidence of the revocation and give it to the bank on request, and remains responsible for the agent's activity until the bank is notified, to the extent the law allows. The bank reserves the right to restrict, suspend or prohibit agent access, including by requiring registration or controlling the interfaces agents use. American Banker reported the revocation-evidence requirement on 2 November, with comment from a Wells Fargo spokesperson. The terms do not say that agents may operate accounts without restriction, and the reporting does not show that they displace statutory protections for unauthorised electronic transfers.

    mnd8t assessment

    A bank has separated an agent's access to an account from the customer's responsibility for what the agent does, and has declined to enforce the private limits between customer and agent: a payment above the customer's own ceiling, or to a supplier outside the approved list, can arrive properly authenticated. Revocation is the clearest case. The bank cannot see a withdrawal made on an agent platform, so the customer carries the burden of proving it. That shows a signed mandate and a signed revocation are evidence of what the principal decided, not a change to what the bank enforces, unless the bank receives and recognises them. It validates the problem of current authority for the receiving institution. It does not show that a bank will buy or accept an independent service for it; it may instead restrict agents or hold delegations in its own systems.

    Sources
  19. 30 September 2026NetworkIdentityAuthorityCredential

    Mastercard expands Agent Pay with trust and intelligence services, working with Cloudflare and Skyfire

    Mastercard, with Cloudflare and Skyfire

    Mastercard set out an Agent Pay Trust Framework of five elements (identity, intent, controls, execution and intelligence) and announced trust and intelligence services for AI-initiated transactions. The services combine identity, intent, behavioural and fraud signals to support authorisation decisions. The first is a probability score for whether a transaction was initiated by an AI agent, which is being rolled out for testing in the US. Cloudflare is working with Mastercard on privacy-preserving environments that combine web and payment-network signals about AI-driven payment activity. Skyfire contributes its Know Your Agent technology for agent identity and verification.

    mnd8t assessment

    The network now treats agent-initiated payments as a separate trust problem, not as one more kind of card-not-present fraud. That matters in practice: a legitimate agent that buys a flight, a hotel and ground transport from three merchants within seconds looks anomalous to a model trained on people. Every signal in this service answers whether the agent and its behaviour can be trusted. None answers whether this particular action is within what its principal delegated. A verified agent with normal behaviour and a valid token can still exceed a supplier list, a per-transaction limit or a quarterly budget its deployer set. The framework names controls as its own element and leaves open where they are defined. Inside the network, the answer is the token's rules. For a firm that also pays by bank transfer or from a wallet, that answer covers only one of its rails.

    Sources
  20. 29 September 2026RegulationAuthorityIdentityGovernance

    Federal Reserve Governor Waller sets out what agent-delegated payments need

    Federal Reserve Board

    Speaking at Sibos, Governor Christopher Waller distinguished agent-assisted commerce, where the buyer keeps the purchase decision and the payment, from agent-delegated commerce, where the buyer grants an agent authority to shop and pay within constraints. He said assisted use will come first because delegation carries a higher risk of unintended purchases. He described the authentication question as shifting from who the buyer is to whether the agent has authority to pay on the buyer's behalf, and called for technical standards for registering agents and logging cardholders' approvals. On liability he asked who is on the hook if an agent buys the wrong thing, and said standards recording what the buyer intended and how the agent carried it out would reduce ambiguity in disputes. He set out no Federal Reserve action.

    mnd8t assessment

    A central bank governor has now described the problem in the same terms as the six-bank principles a week earlier: the hard part is proving delegated authority and keeping a record of intent and execution, not moving the money. It is a speech, not policy, and it is addressed to the card model. Its value is the vocabulary it legitimises: “agent-delegated” is the case that needs an authority record, and the speech treats the absence of one as the reason delegation lags assistance.

    Sources
  21. 28 September 2026PlatformCommerceAuthority

    Shopify opens its checkout to browser agents through WebMCP

    Shopify

    Shopify added WebMCP tools to checkout so a browser agent can read the checkout state, update supported fields and submit the order. The tools run inside Shopify's checkout and use the same state as the checkout page, with no new API and no merchant configuration. Submitting the order requires buyer confirmation, and control passes back to the buyer whenever their input is needed, such as 3-D Secure authentication. The checkout tools follow storefront and cart tools released earlier, so a browser agent can carry a purchase from discovery to order on eligible Shopify stores.

    mnd8t assessment

    The reach is the news: an agent can now drive checkout across Shopify stores without each merchant doing anything. The authority model is unchanged from Muse: the agent prepares everything and the buyer confirms the order. Nothing in the tools carries a standing limit, a supplier list or a budget that the agent could act within without a confirmation. As agent-ready checkouts become the default, the bottleneck moves from whether a merchant accepts agents to whether anyone can state in advance what the agent may buy without asking.

    Sources
  22. 28 September 2026SpecificationIdentityAuthorityGovernance

    Primitive publishes AFSP v0.1 for agent admission at regulated banks

    Primitive

    Primitive published the Agentic Financial Services Protocol v0.1 as a public review draft, with comments open until 16 November 2026. It standardises the moment an AI agent reaches a regulated institution on a person's behalf: up to five signed trust signals (agent provenance, biometric consent, federated referral, financial identity, session integrity) are assembled into one package, the institution returns a signed clearance decision, and on PROCEED_TO_KYC a single-use session token is minted. v0.1 covers agent-assisted deposit account opening. The v1.0 roadmap adds pre-execution revalidation of every agent-initiated execution (AFSP-09), moment-level behavioural monitoring (AFSP-10) and a tamper-evident lifecycle audit log (AFSP-11). Provisional patent applications cover the roadmap components, with essential claims to be licensed on FRAND terms.

    mnd8t assessment

    The first specification written from the bank's side of the door rather than the merchant's or the network's. It answers admission precisely and treats it as a separate question from KYC and from execution. The roadmap is the part to watch: once every agent-initiated execution is revalidated and logged, AFSP is no longer only about admission. Whether authority is held in each protocol's session tokens or in a mandate that outlives them is the question it brings into the open.

    Sources
  23. 22 September 2026IndustryAuthorityGovernance

    Six banks publish shared principles for trusted agentic commerce

    ASB, Bank of America, Capital One, Commonwealth Bank, ING and NatWest

    ASB Bank, Bank of America, Capital One, Commonwealth Bank of Australia, ING Group and NatWest Group co-authored “Building Trust in Agentic Commerce”, five voluntary, non-binding principles: transparency, safety, privacy and data, choice, and interoperability. Under safety, consumers “should have appropriate control over the authority they grant to AI agents, including the ability to view and manage delegations” (2.2), and providers should use “secure and auditable methods” to authorise purchase intents and payments (2.3). Under privacy and data, providers “should maintain auditable records to evidence consumer instructions, authentication, intent, and transaction decisions and outcomes” (3.2). The paper names unclear liability “if an AI agent exceeds its authority” as a safety risk, and promises a second paper on implementation through protocols and standards.

    mnd8t assessment

    The first time a group of issuing banks has written down, in one document, that delegated authority and the evidence of it are the unsolved part — not the credential, not the rail. Principle 3.2 reads as a specification for a record that links what the customer instructed, what the agent intended, what was decided and what happened, and it is addressed to every service provider in the chain rather than to the networks. That moves the question from whether an agent can transact to whether anyone can later show it was entitled to. The paper is deliberately high-level; the implementation paper it promises is the one that will say whose record counts.

    Sources
  24. 22 September 2026InfrastructureRailAuthorityGovernance

    GoCardless completes the UK's first agentic bank payment inside the FCA's AI Live Testing

    GoCardless

    GoCardless processed what it describes as the UK's first agentic account-to-account payment: a recurring donation to the charity Trussell, set up in a conversation with an AI agent. The donor chose a monthly amount from three fixed options (£5, £10 or £15), entered bank details when the agent asked for them, and a Direct Debit mandate was created, all within the chat. The flow was built within the FCA's AI Live Testing programme, which GoCardless joined earlier in 2026. GoCardless cited its own research that 64% of UK adults surveyed are open to AI managing recurring payments if they keep control over limits or final approval.

    mnd8t assessment

    The first UK precedent for an agent setting up a bank payment under regulatory observation, and it is a mandate in the Direct Debit sense: a standing authority over future payments, created once. The design keeps every decision with the payer; the agent fills in a form the person completes. That is the right first step under supervision, and it shows where the next one is: a standing instruction whose limits the payer sets in advance and the agent then acts within. GoCardless's own survey names those limits as the condition for trust.

    Sources
  25. 8 September 2026PlatformCredentialAuthority

    Meta launches Muse, a personal agent that buys, with Stripe Link as the credential

    Meta and Stripe

    Muse is a general-purpose personal agent that sends emails, books travel, fills forms, negotiates and checks out, running in a dedicated virtual machine with a separate agent approving its internet-bound actions and a full audit trail of what it did. Payment runs through Link: at businesses that accept it, Muse checks out with the consumer's saved method; elsewhere Link issues Muse a single-use virtual card scoped to the approved purchase. Stripe states that “for every purchase, consumers are asked to approve the transaction total directly in the chat interface, and Muse never sees their underlying payment details”.

    mnd8t assessment

    Muse makes the boundary between payment capability and delegated authority unusually visible, and it is the most consequential entry in this tracker for that reason rather than for its technology. The agent can discover, negotiate and prepare a transaction on its own; at the moment money moves, authority collapses back to a human approving a total in a chat window. That is the right conservative default for a consumer launch at this scale, and it is not delegation — it is a very good confirmation step. For agents to act repeatedly without returning to the person each time, per-transaction approval has to become bounded standing authority: amount, purpose, counterparty, duration, and the conditions under which a human is asked anyway. Nothing in this launch does that yet, which is precisely what makes it evidence of where the gap is.

    Sources
  26. 1 September 2026SpecificationIdentityAuthorityCredentialGovernance

    EMVCo opens its draft Agentic Payments framework, with Intent Services, for comment

    EMVCo

    EMVCo published a draft Agentic Payments — Framework for Specifications v1.0 for public comment, closing on 30 September 2026. Its central proposal is Intent Services: a shared, interoperable layer through which payment participants register, reference, retrieve and manage consumer-authorised intent before, during and after a transaction. EMVCo names recurring purchases, cumulative budgets and post-transaction activity as cases where intent has to be managed over time. The framework also contemplates future Know Your Agent capabilities and Agentic Transaction Indicators, and may inform changes to EMV 3-D Secure, Payment Tokenisation, Secure Remote Commerce and the Digital Payment Credential. EMVCo says it is coordinating with the FIDO Alliance, OpenID Foundation, OpenWallet Foundation and W3C. After the comment period closed, EMVCo said its Agentic Payments Task Force is collating feedback and reviewing next steps, without giving a timeline, and that intent must be managed across its lifecycle because participants may need historical information for dispute resolution.

    mnd8t assessment

    Card-network proposals so far have mostly treated authority as a message: an instruction is captured and presented when the agent pays. Intent Services treat it as state that has a lifecycle, is consumed by transactions and is read by several parties, which is the part of the problem a mandate with budgets and versions already addresses. It is also a card-specific answer. EMVCo's scope is card payments, and an enterprise agent paying one supplier by card, another by bank transfer and a third in stablecoins is delegated once and executed in several places. The competitive reading is that a service which only stores a limit and shows it to card participants may become native card infrastructure. The durable position is upstream of it: the mandate stays the canonical authority, an Intent Service is one representation derived from it, and the record of which version applied when a decision was made has to survive amendment and be available for disputes. This is a draft; what EMVCo standardises, and when, is not yet known.

    Sources
  27. 4 August 2026InfrastructureAuthorityIdentityRail

    Cloudflare announces Wallets with owner-set allowances for agents, and opens Monetization Gateway in beta

    Cloudflare

    Cloudflare announced Wallets: an Account Wallet holding stablecoins, Virtual Wallets issued to individual agents, and cloudflare.pay handles that give each wallet a persistent name. The Account Wallet owner sets guardrails for each Virtual Wallet, including an allowance, an allow list and a maximum transaction size, with a weekly budget given as an example. An agent that exceeds its limits can request a manual override from a person authorised to change the Account Wallet. Payments use x402. At announcement, handles could be claimed and the rest was described as coming soon. On 30 September Cloudflare opened Monetization Gateway, the seller side that lets sites, APIs and MCP tools charge agents through x402, as a closed beta.

    mnd8t assessment

    This is an authority model, not only a rail: owner-set allowance, allow list, per-transaction ceiling and escalation to a named human are the controls a mandate expresses. It is promoted for that reason. Its boundary is the wallet: the limits govern stablecoin spend through Cloudflare's own wallets and say nothing about the same agent paying by card or bank transfer. No signed record of which limits applied to a payment is described. As announced, it is a capable single-rail enforcement point, which makes the cross-rail mandate and its evidence the remaining question.

    Sources
  28. August 2026NetworkGovernanceCommerce

    Mastercard publishes a Signals report on trust in agentic commerce

    Mastercard

    Mastercard's Signals series turned to agentic commerce, setting out the trust problems the network sees as unresolved: proving a human authorised an agent, recognising a legitimate agent at the merchant, and settling disputes when the buyer was not present.

    mnd8t assessment

    Network research is a leading indicator of network rules. When a scheme publishes a taxonomy of a problem, scheme mandates addressing that taxonomy tend to follow within a year or two — which is when merchant behaviour actually changes.

    Sources
  29. 16 July 2026InfrastructureAuthority

    Ramp ships spend controls for AI token consumption

    Ramp

    Ramp launched AI token spend management: a single view of what a company spends across AI providers, with alerts and real-time controls intended to stop overruns.

    mnd8t assessment

    Notable less for what it controls than for who it treats as the spender. The first budget most finance teams gave a model was its own inference bill; the controls built for that bill are the ones they will reach for when the model starts buying other things.

    Sources
  30. 14 July 2026RegulationGovernance

    HM Treasury consults on modernising payment services regulation

    HM Treasury

    The consultation asks how the regulatory framework should be updated for innovations in tokenised payments, Open Banking and agentic payments, noting that agentic AI has the potential to unlock an era in which AI agents act on behalf of consumers and businesses. It closes on 6 October 2026.

    mnd8t assessment

    The significant part is the question it opens: whether an instruction a person gave once, in advance, to a system that later acts alone is the same kind of consent the rules were drafted around. Any answer that survives will need the instruction to have been recorded in a form that can be produced afterwards.

    Sources
  31. 29 April 2026NetworkRailCredential

    Visa expands Agentic Ready, its live-testing programme for agent-initiated payments

    Visa

    Agentic Ready lets issuers and payment partners test agent-initiated payments in controlled real-world environments, using live cards at real merchants, and assess the trust, security and control mechanisms involved. Visa reported it live with more than 20 partners in the UK and Europe, expanding to more than 85 across Asia Pacific and Latin America, with Visa Intelligent Commerce already carrying live transactions in the United States.

    mnd8t assessment

    Worth reading for what it concedes: a network that already has the credential and the rail is running a programme to work out whether the control mechanisms hold when an agent acts. Nobody in the payment path yet treats the authority question as settled.

    Sources
  32. 28 April 2026SpecificationAuthorityIdentityGovernance

    Google and Mastercard contribute AP2 and Verifiable Intent to the FIDO Alliance, which forms two working groups

    FIDO Alliance

    The FIDO Alliance announced an Agentic Authentication Technical Working Group (chaired by CVS Health, Google and OpenAI) and a Payments Technical Working Group (chaired by Mastercard and Visa). Google contributed the Agent Payments Protocol; Mastercard contributed Verifiable Intent. American Express, Amazon, 1Password, Dashlane, LastPass, OneSpan, OpenAI, PayPal, Prove, Thales and Visa were named as participants.

    mnd8t assessment

    The single most consequential governance event so far. Two vendor protocols became one standards process, chaired by the two card networks and three of the largest agent platforms. It also relocates the argument: the hard question — how a person's delegation is captured, scoped and revoked — is now an authentication problem owned by the body that standardised passkeys.

    Sources
  33. 17 April 2026SpecificationCommerceCredential

    ACP adds cart, product feed, orders, authentication and MCP compatibility

    OpenAI and Stripe

    The Agentic Commerce Protocol's 2026-04-17 snapshot extended the specification beyond checkout into carts, product feeds and orders, added authentication, and aligned the surface with the Model Context Protocol.

    mnd8t assessment

    ACP started as a way to complete a purchase and is becoming a way to run a merchant relationship. That expands what a merchant integrates once, and it raises the stakes on the delegated payment half of the spec, which is where the buyer's authority is actually represented.

    Sources
  34. 14 April 2026NetworkAuthorityCredentialGovernance

    American Express ties agent purchase protection to the customer's authenticated intent

    American Express

    American Express published its Agentic Commerce Experiences (ACE) Developer Kit and announced Agent Purchase Protection for registered agents. The kit's Account Enablement, Intent Intelligence and Payment Credentials specifications were available at launch; Agent Registration and Cart Context were still in development. Amex states that verified agents should transact only after the Card Member approves a purchase intent, with active intents and spend controls managed in the Amex app. The protection covers eligible US Card Members when a registered agent's purchase deviates from the authenticated intent it sent to Amex, for the full charge and reasonable costs of the error; claims may be denied where the intent was subjective or unverifiable, and the Card Member must first seek a return from the merchant. On 6 October 2026 Amex restated the protection in a merchant playbook and opened a pilot Merchant AI Advisory Council. As of that date no registered agents were listed and the full terms were still to be published.

    mnd8t assessment

    The first network to write down who pays when an agent gets it wrong, and the test it chose is whether the purchase matched an authenticated, specific intent. That makes the record of what was authorised the deciding evidence in a dispute rather than an afterthought, and it excludes vague instructions by design. It covers a consumer's single purchase intent captured inside Amex's own surface; a business delegating standing, bounded authority to an agent across several rails is outside it. Announced, not live: registration, the agent list and the terms are all pending.

    Sources
  35. April 2026SpecificationAuthorityCredential

    AP2 v0.2 restructures its mandates

    Google

    AP2 v0.2 reorganised its verifiable digital credentials around a Checkout Mandate, shared with the merchant, and a Payment Mandate, shared with credential providers, networks and processors — each with an opening stage that carries the user's constraints and a closing stage that binds them to a finalised order.

    mnd8t assessment

    The opening/closing split is the most useful idea in the protocol. It separates 'what I authorised in advance' from 'what was actually charged', which is exactly the pair a dispute needs and exactly the pair most current integrations cannot produce.

    Sources
  36. 5 March 2026SpecificationAuthorityIdentity

    Mastercard publishes Verifiable Intent

    Mastercard

    Mastercard introduced Verifiable Intent, an open, standards-based framework that binds a consumer's identity, their instruction, and the resulting transaction into a single tamper-resistant record, to be integrated into Agent Pay's intent APIs.

    mnd8t assessment

    This is a network arguing that the evidentiary record, not the credential, is the scarce thing. It was contributed to FIDO seven weeks later, which is a strong signal that the networks expect intent capture to be standardised rather than competed on.

    Sources
  37. March 2026RegulationGovernance

    FCA puts agentic AI payments in its regulatory priorities

    Financial Conduct Authority

    The FCA's payments regulatory priorities said it is examining what regulation is needed to support agentic AI payments — a step beyond its usual position that existing frameworks apply to new technology as written.

    mnd8t assessment

    Regulators rarely open the question of rewriting rules for a technology that has not yet produced a large loss. Reading it charitably, the FCA has concluded that consent given once to a system that acts repeatedly does not map cleanly onto the existing authorisation model, and would rather resolve that before the losses arrive.

    Sources
  38. 30 January 2026SpecificationCommerceCredential

    ACP adds extensions, discounts and payment handlers

    OpenAI and Stripe

    The 2026-01-30 snapshot introduced an extension mechanism, discount handling, and pluggable payment handlers, loosening the specification's original coupling to a single payment provider.

    Sources
  39. 16 January 2026SpecificationCommerce

    ACP adds capability negotiation

    OpenAI and Stripe

    Capability negotiation let an agent and a merchant establish what each side supports before attempting a checkout, rather than failing partway through.

    Sources
  40. 11 January 2026SpecificationCommerce

    Google and Shopify announce the Universal Commerce Protocol

    Google, Shopify and retail partners

    Announced at NRF 2026 and published under Apache 2.0, UCP covers discovery, capability negotiation, checkout and post-purchase handoff, and is positioned to work alongside A2A, AP2 and MCP. Google wired it into AI Mode and the Gemini apps for participating retailers.

    mnd8t assessment

    UCP is the merchant-side counterpart to ACP, and its arrival made the split explicit: the commerce conversation is being standardised by whoever owns the demand surface, while the payment authorisation underneath is being standardised elsewhere. A merchant now integrates two protocols to answer one question.

    Sources

2025

  1. 12 December 2025SpecificationCommerce

    ACP adds fulfilment

    OpenAI and Stripe

    The first substantive revision after launch extended the checkout specification to cover fulfilment states.

    Sources
  2. October 2025NetworkIdentityCommerce

    Visa introduces the Trusted Agent Protocol

    Visa

    Visa and more than ten partners published Trusted Agent Protocol, a framework built on existing web infrastructure that lets a merchant distinguish a legitimate commerce agent from a malicious bot. It carries three classes of signal — agent identity, consumer recognition, and payment information — using signatures that are specific to the merchant and purpose, time-bound, and non-replayable.

    mnd8t assessment

    TAP answers the merchant's first question ('should I serve this traffic at all?') and deliberately does not answer the buyer's ('is this within what I authorised?'). Treating those as separate problems is correct, and is why TAP and an authority layer are complements rather than alternatives.

    Sources
  3. 29 September 2025PlatformCommerceCredential

    OpenAI and Stripe publish the Agentic Commerce Protocol and launch Instant Checkout

    OpenAI and Stripe

    ACP's initial release shipped alongside Instant Checkout in ChatGPT, under Apache 2.0, with two OpenAPI specifications: an agentic checkout API and a delegated payment API. The delegated payment specification defines how a buyer's payment provider issues a scoped token to an agent instead of exposing a stored card.

    mnd8t assessment

    The delegated payment half is the part that outlives the shopping surface. A token minted for one merchant, one amount and a short window is a genuine reduction in blast radius — and it is also the narrowest possible expression of authority: it can say how much, but not why, not for what purpose, and not under what conditions the buyer would have wanted a human asked.

    Sources
  4. 16 September 2025SpecificationAuthorityCredential

    Google publishes the Agent Payments Protocol

    Google

    AP2 was published under an open licence as an extension to A2A, with mandates expressed as verifiable digital credentials, explicit human-present and human-not-present flows, and card rails first with x402 demonstrated in samples. More than sixty organisations were named at launch, including Mastercard, PayPal, Coinbase, American Express and Salesforce.

    mnd8t assessment

    AP2 was the first serious attempt to make the user's authorisation a first-class, signed object rather than an implicit property of a session. Everything since — Verifiable Intent, the FIDO working groups — has argued with its details rather than its premise.

    Sources
  5. 28 August 2025InfrastructureIdentity

    Cloudflare ships signed agents

    Cloudflare

    Cloudflare extended its verified bots programme to agents that sign their requests with HTTP Message Signatures, publishing verification keys and listing verified agents in a public directory, so a site can distinguish a user-directed agent from an unattributed crawler.

    mnd8t assessment

    The first widely deployed answer to 'who is this agent?' — and it arrived from the edge, not from finance. It establishes the pattern the payments specifications now assume: identity is proved per request with a signature, not asserted in a user-agent string.

    Sources
  6. 1 July 2025InfrastructureIdentityRail

    Cloudflare blocks AI crawlers by default and opens pay-per-crawl

    Cloudflare

    Cloudflare began blocking AI crawlers by default for new domains and opened a beta allowing sites to charge for crawl access, using HTTP 402 as the mechanism for a machine-to-machine price.

    mnd8t assessment

    This is where machine-to-machine payment stopped being a thought experiment. A crawler that must pay to read is an agent with a budget, and a budget implies someone who set it.

    Sources
  7. 6 May 2025SpecificationRail

    Coinbase publishes x402

    Coinbase

    x402 revived the reserved HTTP 402 Payment Required status code as a payment protocol: a server answers an unpaid request with the price and the accepted settlement terms, the client pays in stablecoin, and retries. It settles principally in USDC on low-fee chains.

    mnd8t assessment

    x402 solves settlement for payments too small and too frequent for card rails, and solves nothing about authority — by design. An agent with a funded x402 wallet can spend it all in a second. That is precisely why the rail is interesting to anyone who has to bound it.

    Sources
  8. 30 April 2025NetworkCredentialRail

    Visa announces Intelligent Commerce

    Visa

    Visa opened APIs letting developers embed payment functions into AI agents, including identity verification and consumer-set spending controls, with Anthropic, OpenAI, Microsoft, Stripe and Samsung named among launch partners.

    mnd8t assessment

    The networks moved before the protocols did, and they moved with the same instrument they always use: a token, scoped and provisioned centrally. Everything since has been a negotiation about what other information travels alongside that token.

    Sources
  9. 29 April 2025NetworkCredentialIdentity

    Mastercard launches Agent Pay

    Mastercard

    Agent Pay introduced Agentic Tokens — tokenised credentials, an extension of Mastercard's tokenisation service, tied to a specific user, registered to a specific agent, and constrained by rules the user sets: merchant, category, amount, timeframe and usage. Microsoft, IBM and Braintree were named as launch partners.

    mnd8t assessment

    Agentic Tokens put the spend rules inside the credential. That makes them enforceable by the network at authorisation, and it also means the rules can only be as expressive as the token format allows — which is why the same firm went on to publish Verifiable Intent for everything the token cannot carry.

    Sources

Reading the pattern

Three things are visible across eighteen months. The networks moved first and moved with credentials, because a constrained token is the instrument they already had. The platforms moved second and moved with commerce protocols, because the surface where an agent shops is the surface they own. And the standards bodies arrived third, taking custody of the part neither could settle alone: how a person's instruction is captured, scoped, proven and withdrawn.

What has not been settled anywhere is the case that matters most — an agent acting alone, hours after the human went to bed, on authority granted in general terms. Every credential in the tracker bounds a transaction. Very little bounds a sequence of them, and nothing yet agreed says who answers when the sequence was wrong.

Meta's Muse is the clearest illustration to date. It is a capable general-purpose agent with a well-designed credential underneath it, and at the moment of payment it asks a person to approve a total. That is a sound default and it is also the boundary in plain view: the agent's autonomy ends exactly where money begins, because there is nothing standing in between to say what it may spend without asking.

The comparison tables set out the specific trade-offs; the glossary disambiguates the vocabulary, which four groups are currently using inconsistently.

Last reviewed 6 November 2026. Corrections: hello@mnd8t.com.