Agentic payments tracker
What changed, when, and why it mattered to anyone giving an AI agent bounded financial authority. Specification releases, network programmes, platform launches, regulatory moves and the infrastructure underneath — newest first, each with its primary source.
Inclusion test: would a firm deciding how to delegate spending authority to an agent have to know this? Funding rounds appear only where the company is building authority, identity or credential infrastructure rather than an application on top of it. Where only a month is documented, only a month is shown.
2026
- 8 September 2026Platform
Meta launches Muse, a personal agent that buys, with Stripe Link as the credential
Meta and StripeMuse is a general-purpose personal agent that sends emails, books travel, fills forms, negotiates and checks out, running in a dedicated virtual machine with a separate agent approving its internet-bound actions and a full audit trail of what it did. Payment runs through Link: at businesses that accept it, Muse checks out with the consumer's saved method; elsewhere Link issues Muse a single-use virtual card scoped to the approved purchase. Stripe states that “for every purchase, consumers are asked to approve the transaction total directly in the chat interface, and Muse never sees their underlying payment details”.
mnd8t assessmentMuse makes the boundary between payment capability and delegated authority unusually visible, and it is the most consequential entry in this tracker for that reason rather than for its technology. The agent can discover, negotiate and prepare a transaction on its own; at the moment money moves, authority collapses back to a human approving a total in a chat window. That is the right conservative default for a consumer launch at this scale, and it is not delegation — it is a very good confirmation step. For agents to act repeatedly without returning to the person each time, per-transaction approval has to become bounded standing authority: amount, purpose, counterparty, duration, and the conditions under which a human is asked anyway. Nothing in this launch does that yet, which is precisely what makes it evidence of where the gap is.
Sources- Meta — introducing Muse ↗ · 8 September 2026
- Stripe — helping Muse shop across the internet with Link ↗ · 8 September 2026
- August 2026Network
Mastercard publishes a Signals report on trust in agentic commerce
MastercardMastercard's Signals series turned to agentic commerce, setting out the trust problems the network sees as unresolved: proving a human authorised an agent, recognising a legitimate agent at the merchant, and settling disputes when the buyer was not present.
mnd8t assessmentNetwork research is a leading indicator of network rules. When a scheme publishes a taxonomy of a problem, scheme mandates addressing that taxonomy tend to follow within a year or two — which is when merchant behaviour actually changes.
- 16 July 2026Infrastructure
Ramp ships spend controls for AI token consumption
RampRamp launched AI token spend management: a single view of what a company spends across AI providers, with alerts and real-time controls intended to stop overruns.
mnd8t assessmentNotable less for what it controls than for who it treats as the spender. The first budget most finance teams gave a model was its own inference bill; the controls built for that bill are the ones they will reach for when the model starts buying other things.
- 14 July 2026Regulation
HM Treasury consults on modernising payment services regulation
HM TreasuryThe consultation asks how the regulatory framework should be updated for innovations in tokenised payments, Open Banking and agentic payments, noting that agentic AI has the potential to unlock an era in which AI agents act on behalf of consumers and businesses. It closes on 6 October 2026.
mnd8t assessmentThe significant part is the question it opens: whether an instruction a person gave once, in advance, to a system that later acts alone is the same kind of consent the rules were drafted around. Any answer that survives will need the instruction to have been recorded in a form that can be produced afterwards.
Sources- HM Treasury — Modernising Payment Services Regulation ↗ · 14 July 2026
- 29 April 2026Network
Visa expands Agentic Ready, its live-testing programme for agent-initiated payments
VisaAgentic Ready lets issuers and payment partners test agent-initiated payments in controlled real-world environments, using live cards at real merchants, and assess the trust, security and control mechanisms involved. Visa reported it live with more than 20 partners in the UK and Europe, expanding to more than 85 across Asia Pacific and Latin America, with Visa Intelligent Commerce already carrying live transactions in the United States.
mnd8t assessmentWorth reading for what it concedes: a network that already has the credential and the rail is running a programme to work out whether the control mechanisms hold when an agent acts. Nobody in the payment path yet treats the authority question as settled.
Sources - 28 April 2026Specification
FIDO Alliance takes over AP2 and Verifiable Intent, forms two working groups
FIDO AllianceThe FIDO Alliance announced an Agentic Authentication Technical Working Group (chaired by CVS Health, Google and OpenAI) and a Payments Technical Working Group (chaired by Mastercard and Visa). Google contributed the Agent Payments Protocol; Mastercard contributed Verifiable Intent. American Express, Amazon, 1Password, Dashlane, LastPass, OneSpan, OpenAI, PayPal, Prove, Thales and Visa were named as participants.
mnd8t assessmentThe single most consequential governance event so far. Two vendor protocols became one standards process, chaired by the two card networks and three of the largest agent platforms. It also relocates the argument: the hard question — how a person's delegation is captured, scoped and revoked — is now an authentication problem owned by the body that standardised passkeys.
- 17 April 2026Specification
ACP adds cart, product feed, orders, authentication and MCP compatibility
OpenAI and StripeThe Agentic Commerce Protocol's 2026-04-17 snapshot extended the specification beyond checkout into carts, product feeds and orders, added authentication, and aligned the surface with the Model Context Protocol.
mnd8t assessmentACP started as a way to complete a purchase and is becoming a way to run a merchant relationship. That expands what a merchant integrates once, and it raises the stakes on the delegated payment half of the spec, which is where the buyer's authority is actually represented.
- April 2026Specification
AP2 v0.2 restructures its mandates
GoogleAP2 v0.2 reorganised its verifiable digital credentials around a Checkout Mandate, shared with the merchant, and a Payment Mandate, shared with credential providers, networks and processors — each with an opening stage that carries the user's constraints and a closing stage that binds them to a finalised order.
mnd8t assessmentThe opening/closing split is the most useful idea in the protocol. It separates 'what I authorised in advance' from 'what was actually charged', which is exactly the pair a dispute needs and exactly the pair most current integrations cannot produce.
- 5 March 2026Specification
Mastercard publishes Verifiable Intent
MastercardMastercard introduced Verifiable Intent, an open, standards-based framework that binds a consumer's identity, their instruction, and the resulting transaction into a single tamper-resistant record, to be integrated into Agent Pay's intent APIs.
mnd8t assessmentThis is a network arguing that the evidentiary record, not the credential, is the scarce thing. It was contributed to FIDO seven weeks later, which is a strong signal that the networks expect intent capture to be standardised rather than competed on.
- March 2026Regulation
FCA puts agentic AI payments in its regulatory priorities
Financial Conduct AuthorityThe FCA's payments regulatory priorities said it is examining what regulation is needed to support agentic AI payments — a step beyond its usual position that existing frameworks apply to new technology as written.
mnd8t assessmentRegulators rarely open the question of rewriting rules for a technology that has not yet produced a large loss. Reading it charitably, the FCA has concluded that consent given once to a system that acts repeatedly does not map cleanly onto the existing authorisation model, and would rather resolve that before the losses arrive.
Sources- FCA — Payments Regulatory Priorities, March 2026 ↗ · March 2026
- 30 January 2026Specification
ACP adds extensions, discounts and payment handlers
OpenAI and StripeThe 2026-01-30 snapshot introduced an extension mechanism, discount handling, and pluggable payment handlers, loosening the specification's original coupling to a single payment provider.
- 16 January 2026Specification
ACP adds capability negotiation
OpenAI and StripeCapability negotiation let an agent and a merchant establish what each side supports before attempting a checkout, rather than failing partway through.
- 11 January 2026Specification
Google and Shopify announce the Universal Commerce Protocol
Google, Shopify and retail partnersAnnounced at NRF 2026 and published under Apache 2.0, UCP covers discovery, capability negotiation, checkout and post-purchase handoff, and is positioned to work alongside A2A, AP2 and MCP. Google wired it into AI Mode and the Gemini apps for participating retailers.
mnd8t assessmentUCP is the merchant-side counterpart to ACP, and its arrival made the split explicit: the commerce conversation is being standardised by whoever owns the demand surface, while the payment authorisation underneath is being standardised elsewhere. A merchant now integrates two protocols to answer one question.
2025
- 12 December 2025Specification
ACP adds fulfilment
OpenAI and StripeThe first substantive revision after launch extended the checkout specification to cover fulfilment states.
- October 2025Network
Visa introduces the Trusted Agent Protocol
VisaVisa and more than ten partners published Trusted Agent Protocol, a framework built on existing web infrastructure that lets a merchant distinguish a legitimate commerce agent from a malicious bot. It carries three classes of signal — agent identity, consumer recognition, and payment information — using signatures that are specific to the merchant and purpose, time-bound, and non-replayable.
mnd8t assessmentTAP answers the merchant's first question ('should I serve this traffic at all?') and deliberately does not answer the buyer's ('is this within what I authorised?'). Treating those as separate problems is correct, and is why TAP and an authority layer are complements rather than alternatives.
- 29 September 2025Platform
OpenAI and Stripe publish the Agentic Commerce Protocol and launch Instant Checkout
OpenAI and StripeACP's initial release shipped alongside Instant Checkout in ChatGPT, under Apache 2.0, with two OpenAPI specifications: an agentic checkout API and a delegated payment API. The delegated payment specification defines how a buyer's payment provider issues a scoped token to an agent instead of exposing a stored card.
mnd8t assessmentThe delegated payment half is the part that outlives the shopping surface. A token minted for one merchant, one amount and a short window is a genuine reduction in blast radius — and it is also the narrowest possible expression of authority: it can say how much, but not why, not for what purpose, and not under what conditions the buyer would have wanted a human asked.
- 16 September 2025Specification
Google publishes the Agent Payments Protocol
GoogleAP2 was published under an open licence as an extension to A2A, with mandates expressed as verifiable digital credentials, explicit human-present and human-not-present flows, and card rails first with x402 demonstrated in samples. More than sixty organisations were named at launch, including Mastercard, PayPal, Coinbase, American Express and Salesforce.
mnd8t assessmentAP2 was the first serious attempt to make the user's authorisation a first-class, signed object rather than an implicit property of a session. Everything since — Verifiable Intent, the FIDO working groups — has argued with its details rather than its premise.
- 28 August 2025Infrastructure
Cloudflare ships signed agents
CloudflareCloudflare extended its verified bots programme to agents that sign their requests with HTTP Message Signatures, publishing verification keys and listing verified agents in a public directory, so a site can distinguish a user-directed agent from an unattributed crawler.
mnd8t assessmentThe first widely deployed answer to 'who is this agent?' — and it arrived from the edge, not from finance. It establishes the pattern the payments specifications now assume: identity is proved per request with a signature, not asserted in a user-agent string.
- 1 July 2025Infrastructure
Cloudflare blocks AI crawlers by default and opens pay-per-crawl
CloudflareCloudflare began blocking AI crawlers by default for new domains and opened a beta allowing sites to charge for crawl access, using HTTP 402 as the mechanism for a machine-to-machine price.
mnd8t assessmentThis is where machine-to-machine payment stopped being a thought experiment. A crawler that must pay to read is an agent with a budget, and a budget implies someone who set it.
- 6 May 2025Specification
Coinbase publishes x402
Coinbasex402 revived the reserved HTTP 402 Payment Required status code as a payment protocol: a server answers an unpaid request with the price and the accepted settlement terms, the client pays in stablecoin, and retries. It settles principally in USDC on low-fee chains.
mnd8t assessmentx402 solves settlement for payments too small and too frequent for card rails, and solves nothing about authority — by design. An agent with a funded x402 wallet can spend it all in a second. That is precisely why the rail is interesting to anyone who has to bound it.
- 30 April 2025Network
Visa announces Intelligent Commerce
VisaVisa opened APIs letting developers embed payment functions into AI agents, including identity verification and consumer-set spending controls, with Anthropic, OpenAI, Microsoft, Stripe and Samsung named among launch partners.
mnd8t assessmentThe networks moved before the protocols did, and they moved with the same instrument they always use: a token, scoped and provisioned centrally. Everything since has been a negotiation about what other information travels alongside that token.
- 29 April 2025Network
Mastercard launches Agent Pay
MastercardAgent Pay introduced Agentic Tokens — tokenised credentials, an extension of Mastercard's tokenisation service, tied to a specific user, registered to a specific agent, and constrained by rules the user sets: merchant, category, amount, timeframe and usage. Microsoft, IBM and Braintree were named as launch partners.
mnd8t assessmentAgentic Tokens put the spend rules inside the credential. That makes them enforceable by the network at authorisation, and it also means the rules can only be as expressive as the token format allows — which is why the same firm went on to publish Verifiable Intent for everything the token cannot carry.
Reading the pattern
Three things are visible across eighteen months. The networks moved first and moved with credentials, because a constrained token is the instrument they already had. The platforms moved second and moved with commerce protocols, because the surface where an agent shops is the surface they own. And the standards bodies arrived third, taking custody of the part neither could settle alone: how a person's instruction is captured, scoped, proven and withdrawn.
What has not been settled anywhere is the case that matters most — an agent acting alone, hours after the human went to bed, on authority granted in general terms. Every credential in the tracker bounds a transaction. Very little bounds a sequence of them, and nothing yet agreed says who answers when the sequence was wrong.
Meta's Muse is the clearest illustration to date. It is a capable general-purpose agent with a well-designed credential underneath it, and at the moment of payment it asks a person to approve a total. That is a sound default and it is also the boundary in plain view: the agent's autonomy ends exactly where money begins, because there is nothing standing in between to say what it may spend without asking.
The comparison tables set out the specific trade-offs; the glossary disambiguates the vocabulary, which four groups are currently using inconsistently.
Last reviewed 9 September 2026. Corrections: hello@mnd8t.com.