Agentspay

Explainer

Agentic Payments: How Agentic AI Payments and AI Agent Payment Rails Work

Agentic payments move money with no human at the checkout. The rails to do it all shipped during 2026. The part most teams have not solved is deciding, before the money moves, whether the agent was allowed to spend it.

Last updated August 2026

Agent Payments Console

Pick an agent

Payment intent

intent:

Policy evaluation

Human approval required

This spend is over your approval threshold. Approve it to issue a scoped card, or deny it.

Scoped virtual card issued

Agentspay

single-use

Wallet budget

spent of

Audit trail

In short

Agentic payments are transactions an AI agent initiates and completes on its own, inside limits a human set in advance. Instead of a person typing a card number at checkout, the agent carries a scoped credential (a single-use virtual card, a tokenized network credential, a signed mandate, or a wallet key) that proves what it was authorized to buy and up to what amount. Four rails carry that credential today: scoped virtual cards, card network agentic tokens from Visa and Mastercard, open checkout protocols such as ACP, AP2 and UCP, and stablecoin rails such as x402. None of those rails decides whether a particular purchase should happen. That decision sits above the rail, in a control plane that enforces the budget, the approval threshold, and the audit trail.

What are agentic payments?

An agentic payment is a payment where the buyer is software. An AI agent is given a goal and a budget, it goes and finds what it needs, and it pays without a person clicking anything at the final step. The word that matters in the definition is autonomy. Scheduled transfers, autopay and recurring billing have automated when money moves for decades, but a human decided the amount and the counterparty in advance. In an agentic payment the agent decides the counterparty, often the amount, and always the timing, working from context rather than a fixed script. That is the whole difference, and it is why the existing payment stack struggles: card networks, fraud engines and checkout pages were all built on the assumption that a person is present. Take the person away and every transaction starts to look like card-not-present fraud unless something new travels with it to prove authority.

How agentic payments work, step by step

Every agentic payment, whatever the rail, runs the same five beats. One, authorization. A human grants the agent authority with limits attached: what it may buy, from whom, up to how much, for how long. Depending on the stack this is a policy record, a signed payment mandate, or a card provisioned with caps. Two, identity. The agent gets something that proves which agent it is and which human stands behind it, because a merchant that cannot identify the buyer cannot price the risk. Three, a scoped credential. The agent receives a credential that is deliberately near-worthless outside the purchase it was issued for: a single-use card locked to one merchant, a network token bound to an agent and a consent policy, or a session key with a balance ceiling. Four, the authorization check. The purchase is tested against the limits before money moves, and declined at the boundary if it fails. Five, the record. The transaction is written down in a way that ties the dollar amount to the agent, the task that triggered it, and the person who owns that agent. Most vendors do steps two and three well. Step four is where products genuinely differ, and step five is what finance will ask you for at month end.

The four agentic payment rails

There is no single agentic payment rail, and the four that exist solve different problems. Scoped virtual cards are the pragmatic default in the United States: the agent gets a real card number that works at any merchant that takes cards, with the issuer enforcing merchant locks, MCC blocks and per-card caps at authorization. Stripe Issuing, Lithic and Ramp Agent Cards all sit here. Card network agentic tokens are the networks own answer. Mastercard Agent Pay uses Agentic Tokens that bind a tokenized credential to a specific agent, merchant scope and consent policy, and Visa Intelligent Commerce issues merchant-specific tokens with scoped permissions; our Visa and Mastercard comparison covers how the two programs differ. Open checkout protocols standardize the handshake rather than holding money: the Agentic Commerce Protocol, Google AP2, and the Google and Shopify Universal Commerce Protocol, plus the Machine Payments Protocol for machine-to-machine buying. Stablecoin and metering rails such as x402 let an agent pay fractions of a cent per API call over ordinary HTTP, which cards simply cannot do economically. Read the deeper breakdown in AP2 vs ACP vs x402. Most US teams end up on cards for merchant purchases and a metering rail for machine-to-machine spend, which is the strongest argument for keeping your governance layer separate from any one rail.

Agentic commerce vs agentic payments: what is the difference?

The two terms get used interchangeably and they are not the same thing. Agentic commerce is the broad shift: AI agents doing commercial work on behalf of a person or a business, from discovery and comparison through sourcing, negotiation, purchase and reconciliation. Agentic payments are the narrower financial mechanism inside it, the part that actually moves money and proves the move was authorized. Agentic commerce is the shopping trip; agentic payments are the moment at the register. The distinction matters commercially, because the vendors selling into each are different. Agentic commerce products are mostly sell-side, aimed at merchants who want agents to be able to buy from them. Agentic payments products are split between sell-side acceptance and buy-side control, and if you are the company whose agents are doing the spending, almost everything marketed at you is really sell-side. Our explainer on agentic commerce covers the merchant half.

How big will agentic payments actually get?

Every forecast agrees the direction is up and they disagree about the size by roughly an order of magnitude, because they are quietly counting different things. Accenture estimated in May 2026 that more than 30 percent of online commerce could run through AI agents by 2030, close to 3.1 trillion dollars globally. McKinsey put global agentic commerce at 3 to 5 trillion dollars by 2030, with as much as 1 trillion in orchestrated US retail revenue. Bain, publishing in December 2025, landed far lower at 300 to 500 billion dollars, or 15 to 25 percent of US e-commerce. The gap is a definition problem, not a disagreement about AI. Bain deliberately excludes journeys that merely use AI-assisted search or discovery and counts only purchases an agent initiates, influences or completes. McKinsey reaches further, capturing the logistics and payment activity the transaction pulls along with it. Accenture is measuring global online commerce flowing through agents rather than US retail. The practical read for a buyer: treat any single headline number with suspicion, check the scope in the footnote, and plan for agent-initiated spend to be a real line item in your own budget within two to three years rather than a rounding error.

Where agentic payments break

Three failure modes show up repeatedly, and none of them is fixed by encryption or by picking a better rail. The first is the runaway loop: an agent retries a failed purchase, or misreads a quantity, and buys the same thing forty times in ninety seconds. No human is watching, so nothing stops it until a statement arrives. The second is prompt injection. An agent that reads web pages, emails or tool output can be steered by text an attacker planted there, and if that agent holds spending authority the attack converts directly into money. This is why every serious guardrail design puts the spending limit outside the model, enforced by infrastructure the agent cannot talk its way past. The third is quieter and hits later: reconciliation. A charge lands on a statement with a merchant name and no indication of which agent made it, under which task, for which internal owner. Finance cannot code it, so it gets queried, and the whole program stalls at month end. See runaway agent spend and prompt injection and agent spend for the detail.

The controls that make agentic payments safe

The safety model is boring and it works. A hard per-agent budget evaluated before every authorization, not a wallet balance the agent can drain in one call. Merchant and category allowlists, so a compromised agent can only reach counterparties you already approved. A human approval threshold, with a tiered model: automatic below a small amount, notify in the middle band, require a named person to approve above it. Single-use, merchant-locked credentials, so a leaked card number is worth nothing to whoever leaked it. An immutable record tying every charge to agent, intent and human owner. The critical design point, and the one teams get wrong, is that all five must be enforced outside the agent. A limit written into a system prompt is a suggestion. A limit enforced at the authorization boundary is a limit. Amazon documented the same principle when it shipped Bedrock AgentCore Payments in preview on May 7, 2026, enforcing a per-session spend ceiling and an expiry time at the infrastructure layer, explicitly outside agent code, so that prompt injection cannot lift them.

B2B agentic payments and agentic bill pay

Most public discussion of agentic payments is about a consumer telling a chatbot to book a flight. The money in the near term is duller and larger. Inside US businesses, agents are already buying cloud capacity, ad inventory, API calls, SaaS seats, freight and supplier goods, which is spend that used to route through a purchase order, a corporate card or an AP run. B2B agentic payments inherit all the existing constraints that consumer flows do not: approval hierarchies, spend policy, cost center coding, supplier onboarding, tax treatment and an auditor who will eventually ask who authorized this. That is why the buy-side control question is sharper in B2B than in retail. An agent that raises a purchase requisition and waits for a threshold approval is not a worse agent than one that buys instantly; it is the only version a controller will sign off on. If you are heading here, start with the agents that buy the same thing repeatedly from a small set of known suppliers, because allowlisting is trivial and the audit story writes itself. Our procurement agent and bill pay agent pages cover the workflows in detail.

Agentic payments infrastructure: what to build and what to buy

A full agentic payments stack has five layers, and you should not build all of them. The rail (cards, tokens, stablecoins) you buy, always. Identity you buy or adopt as a standard; Skyfire KYA became the identity layer for Experian Know Your Agent in April 2026, and our Know Your Agent explainer covers what it requires. Credential issuance you buy from the issuer. Policy and approval is the layer teams try to build in-house, usually as a few checks in application code, and it is the layer that fails first, because the checks live inside the same process the agent influences and they multiply once you have more than a handful of agents. Reporting and audit gets deferred until finance asks, and then gets built badly against statement data that no longer contains the agent context. The honest build-versus-buy line: build the parts specific to your product, buy the parts where being wrong costs money you cannot claw back. A useful sanity check on any vendor is to demand a demo of the failure case rather than the happy path. Have an agent try to exceed its budget and watch what happens. If the transaction succeeds with a warning, you do not have a limit.

Where Agentspay fits

Agentspay is the control plane, not the rail. It sits above whichever agentic payments rail you use and answers the question none of them answer: should this specific purchase happen right now? Agents get an agent wallet, hard spend limits evaluated before every authorization, human approval above the threshold you set, scoped virtual cards that are merchant-locked and single-use, and an immutable audit trail that names the agent, the intent and the human owner on every line. Because it is rail-neutral, you are not betting your architecture on one protocol winning a standards race that is still wide open. If you are comparing categories rather than vendors, start with AI agent payment platforms compared, which breaks the market into five product types and is honest about which one you actually need.

Whatever standard moves the money, Agentspay is the rail-neutral control plane that keeps it governed. See how it works and the control surfaces that enforce policy, approvals, and audit on every transaction.

Side by side

The four agentic payment rails compared

What each rail gives an agent, and what it leaves to you. Capabilities as documented by each vendor and specification in August 2026; verify pricing directly, it moves fast.

Scoped virtual cards Network agentic tokens Checkout protocols Stablecoin and metering rails
Examples Stripe Issuing, Lithic, Ramp Agent Cards Mastercard Agent Pay, Visa Intelligent Commerce ACP, Google AP2, UCP, MPP x402, Skyfire, Nevermined
What the agent holds A single-use card number A token bound to agent, merchant and consent A signed mandate, no funds A wallet key or session credential
Where it is accepted Any merchant that takes cards Merchants enabled by the network program Only merchants that adopted the protocol Machine-to-machine endpoints, rarely retail
Hard limit before authorization Yes, per-card caps and merchant locks Scope and consent policy, not a running budget No, a mandate is not a budget Balance ceiling, metered after the call
Economics at tiny amounts Poor, fixed fee per authorization Poor, same card economics Depends on the underlying rail Strong, fractions of a cent per call
Human approval step Not built in Only at consent time Only at mandate signing Not built in
Best for Agents buying from ordinary US merchants Merchants accepting agent checkout at scale Standardizing the agent-to-merchant handshake Agents buying APIs, data and compute per call

The forecasts

What the major agentic commerce forecasts actually say

The headline numbers differ by roughly ten times because each firm counts something different. Check the scope column before quoting any of them.

Source Headline figure What it counts Published
Accenture More than 30% of online commerce, close to $3.1 trillion by 2030 Global online commerce running through AI agents. Accenture estimate based on GlobalData May 2026
McKinsey (global) $3 trillion to $5 trillion by 2030 Global agentic commerce, including the logistics and payment activity the transaction pulls along October 2025
McKinsey (US) Up to $1 trillion by 2030 Orchestrated US retail revenue October 2025
Bain & Company $300 billion to $500 billion, 15% to 25% of US e-commerce by 2030 US purchases initiated, influenced or completed by third-party or retailer-hosted agents. Excludes journeys that only use AI-assisted search or discovery December 2025

Frequently asked

Questions people ask about Agentic Payments

What is the difference between agentic payments and traditional automated payments?

Decision autonomy. Autopay, standing orders and recurring billing automate when a payment happens, but a human fixed the amount and the payee in advance. In an agentic payment the AI agent chooses the counterparty and usually the amount at run time, from context, within limits a human set earlier. The rules move from the schedule into a policy.

What is an agentic payment rail?

An agentic payment rail is the underlying system that actually carries the money and the agent's proof of authority. Four are in production: scoped virtual cards, card network agentic tokens from Visa and Mastercard, open checkout protocols such as ACP, AP2 and UCP, and stablecoin rails such as x402. Pick the rail from what your agent buys, not from which standard sounds most future proof.

Which companies are building agentic payments infrastructure?

The field splits by layer. Card issuers include Stripe, Lithic and Ramp. Card networks run Visa Intelligent Commerce and Mastercard Agent Pay. Protocol work comes from OpenAI (ACP), Google (AP2, and UCP with Shopify) and Coinbase (x402). Identity is led by Skyfire KYA with Experian. Cloud providers added guardrails, with Amazon shipping Bedrock AgentCore Payments in preview on May 7, 2026.

Are agentic payments safe?

They are exactly as safe as the controls wrapped around them. The two live risks are a runaway loop repeating a purchase and a prompt injection steering the agent into buying something an attacker chose. Neither is solved by encryption or tokenization. Both are contained by a hard per-agent budget, merchant-locked single-use credentials and human approval above a threshold, all enforced outside the model.

Do agentic payments require stablecoins or crypto?

No. Stablecoin rails such as x402 are genuinely better for machine-to-machine spend, where an agent pays fractions of a cent per API call and card fees would swamp the transaction. But most of what US business agents buy (SaaS, cloud, ads, travel, supplier invoices) comes from merchants that take cards and not USDC, so scoped virtual cards remain the practical default.

How do I set a spending limit on an AI agent?

Set it outside the agent. A limit written into a system prompt is a suggestion the model can be talked out of. A real limit is enforced at the authorization boundary by infrastructure the agent cannot reach: a per-agent budget checked before every transaction, a per-card cap at the issuer, plus merchant allowlists and an approval threshold above a set amount. See how to set spend limits for an AI agent.

Who is liable if an AI agent makes a payment I did not authorize?

Liability in 2026 is unsettled and depends on the rail, the card agreement and whether authority was provably delegated. Practically, the business that deployed the agent carries the exposure, which is why signed mandates and an audit trail matter commercially, not just technically. Our page on AI agent purchase liability covers the current position.

Do agentic payments work at merchants that have not adopted any protocol?

Yes, if the agent pays by card. A scoped virtual card is an ordinary card number to the merchant, so it clears anywhere cards are accepted with no integration on their side. Protocol-based flows such as ACP and UCP only work where the merchant implemented them, which is why card rails still carry most real agent spend today.

Keep reading

More explainers

Agent payment platforms

AI Agent Payment Platforms

Five different kinds of product now call themselves an AI agent payment platform, and they solve five different problems. Picking the wrong category is the expensive mistake, not picking the wrong vendor inside a category.

Read

Universal Commerce Protocol

the Universal Commerce Protocol (UCP)

Google and Shopify shipped UCP as an open standard so an AI agent can check out at any merchant that supports it. Here is what the specification actually defines, where it is live for US buyers, and the one thing it deliberately leaves to you.

Read

MCP Payments

MCP Payments

MCP payments are how an AI agent discovers a payment tool and calls it to move money. The catch: the Model Context Protocol carries the tool call, not the spending decision, so nothing in the stack asks whether the purchase should have happened.

Read

Visa Intelligent Commerce vs Mastercard Agent Pay

Visa Intelligent Commerce vs Mastercard Agent Pay

Visa Intelligent Commerce and Mastercard Agent Pay are the two big card networks racing to let AI agents pay. They take different routes to the same idea, and neither one decides whether a given purchase should have happened.

Read

Agentic Commerce Protocol

the Agentic Commerce Protocol

ACP is the open standard behind agentic checkout in ChatGPT. It tells a merchant how to sell to an AI agent. It says nothing about whether your agent should have made the purchase.

Read

AP2 vs ACP vs x402

AP2 vs ACP vs x402

AP2, ACP, and x402 are the three standards shaping how AI agents pay. They solve different layers of the problem, and most real systems will touch more than one.

Read

Machine payments protocol

Machine payments protocol

As software starts paying software, machine payments protocols define how value moves without a human at the keyboard. The harder question is how to keep that spending governed.

Read

Know Your Agent (KYA)

Know Your Agent

KYA, or Know Your Agent, extends the idea of customer due diligence to autonomous software. When an agent spends, you need to know which agent, on whose authority, and under what limits.

Read

Keep agent spending governed

Add policy, hard limits, human approval, and an immutable audit trail across any protocol or rail. Start in the sandbox today.

Never moves money without policy