Agentic Payments: When Authorization Moves Upstream

Mastercard’s 2026 Signals / Encoding Trust research reports substantial openness to AI’s involvement in commerce. Eighty-five percent are open to AI collaborating to find an option, and 74% are open to it executing specified commerce tasks. These are useful forms of assistance without necessarily surrendering the final buying decision.

The reported responses narrow as control moves further downstream. Thirty-two percent would let AI decide what to buy while the consumer makes the final payment. Only 9% would permit autonomous purchasing within pre-set guardrails. The curve therefore separates assistance, task execution, selection and final purchasing authority rather than grouping them into one broad measure of “AI adoption.”

The distinction matters for payment design. A system that is attractive when it recommends an option may feel very different when it pays for that option. Permission to search does not itself establish permission to buy; willingness to delegate one specified task does not establish willingness to accept all the decisions needed to complete it.

These reported percentages are responses to different scenarios, not observations of one group progressing through a checkout funnel. They show how the terms of delegation can matter. They do not tell us how many real purchases agents will complete, or establish the reason any particular consumer would withhold authority.

A traditional checkout concentrates relevant information at the moment of consent. The customer discovers a product, builds a cart, sees the merchant and exact price, confirms, and pays. Whatever happened during discovery, the payment request can still refer to a particular purchase.

With a delegated mandate, the sequence changes. A consumer sets rules once; the agent searches, chooses, negotiates, pays and returns a receipt. Confirmation happens before the exact merchant or price may be known. It must therefore describe a space of allowed actions rather than a single action. Amount, merchant or category, geography, expiration and confirmation rules become elements of that space.

This shift makes the quality of the mandate important. “Under $500” is a budget constraint, not a complete description of a suitable flight. A permitted seller can offer something that the customer does not want. A deadline can bound when an agent may act without saying whether it should ask again after the available choices change.

The phrase “Authorized — but not what I meant” describes a possible gap rather than a new legal category. A purchase may pass the defined controls while failing the consumer’s instruction. Moving confirmation upstream does not remove the need for consent; it changes what consent must express, and where a later human veto could be retained.

An agentic purchase involves more than an AI model attached to a payment credential. The consumer gives an instruction to an agent; that agent needs an identity, a delegated mandate and a way to present a credential to a merchant. The merchant, payment network and issuer then participate in the resulting transaction.

Alchemy AgentCard can issue one-time Mastercard credentials and enforce controls including amount, merchant category and location. Those controls can constrain credential use. They do not, on their own, turn every qualitative instruction into a payment-network field. A budget limit is readily expressed as a number; whether a fare is refundable requires a different connection to the purchase being made.

Mastercard Verifiable Intent addresses the evidence side of the problem. It creates a tamper-resistant record connecting identity, instructions and the resulting transaction, designed to support authorization, audit and dispute evidence. The side record in the schematic keeps the person, the instruction, the constraints, the agent, the merchant and the final transaction connected.

Such a record and a spending control perform different jobs. A control can restrict what is allowed. A record can support an account of what happened and why a transaction was made. Evidence may help a dispute without itself deciding who bears a loss. A transaction can also be well documented and still disappoint the person who delegated it.

Identity, amount, category, merchant, geography, timing, authentication, risk scoring and revocation are useful points at which to examine an architecture. The figure is conceptual: it does not assert that every provider already enforces every one of these controls, or that every control is implemented at the same layer.

Consider the instruction: “Book me a refundable flight to Chicago for under $500.” An agent may identify an airline, present a valid credential and stay under the spending limit. Those facts can make a payment allowable while leaving the main requirement—refundability—unsatisfied.

The simulation keeps payment checks separate from intent checks. The non-refundable option passes the credential, merchant and amount controls but fails the requested property. The wrong-date option shows the same separation for an additional illustrative constraint. The matching option satisfies the defined rules; none of the examples is a live offer or a real booking.

The lesson is not that authorization controls are unimportant. It is that their success answers a narrower question. Did the credential permit this payment? Did the purchase satisfy the instruction? Was the consumer supposed to confirm this exact option first? Each question needs its own evidence.

A system can preserve some human control by making a fresh confirmation part of the mandate. That is different from assuming that a general instruction grants unlimited discretion. The design question is where that confirmation should sit: before every purchase, only when specified conditions arise, or at a different point defined by the consumer.

Visa/Harris Poll research in 2026 reports that 23% of U.S. consumers trust GenAI to handle payments on their behalf. That figure rises to 61% when Visa is identified as securing the transaction. The two reported conditions distinguish confidence in the AI’s payment role from confidence when a named payments institution is involved.

The comparison does not establish that a network can guarantee the quality of an agent’s decisions. It shows that the way payment security is framed changes reported trust. The identity of the party behind the transaction matters alongside the identity of the software selecting it.

Financial institutions report a different concern. Mastercard research says 78% expect agentic commerce to significantly increase fraud, while 85% say current systems or scaling plans are insufficient. These are institutional expectations and assessments, not measured fraud rates for completed agentic purchases.

Consumer trust and institutional readiness are therefore separate measures. A consumer may feel more comfortable when a familiar institution secures a payment, while institutions may still judge their current systems insufficient for greater autonomy. Neither response supplies a loss rate or establishes how a particular mistake will be resolved.

A documented 2025 OpenAI Operator example makes the confirmation problem concrete. After being asked to find the cheapest delivered eggs, Operator bought $31.43 of eggs without the expected purchase confirmation. The amount is small, but the distinction between finding and buying is not.

The relevant transition is the one from a search instruction to a committed purchase. An agent can complete a sequence that appears useful while crossing a boundary the consumer expected to remain under human control. The missing confirmation is the point where that expectation and the executed action diverged.

This is one reported example. It does not measure the prevalence of such errors or establish that every agent behaves the same way. It does show why the confirmation rules in a mandate should be treated as part of the purchase instruction rather than as an incidental interface preference.

The legal question is not resolved simply by labelling a transaction “agentic.” The funding instrument, the authority granted, the facts of the purchase and any explicit protection framework can matter. Regulatory text, an interpretation of that text and a network’s stated policy should remain distinct.

For a debit or bank-account purchase, the quoted commentary is a reason to examine the scope of the authority the consumer granted and when the financial institution was notified. Goodwin’s argument connects that issue to AI delegation; it does not resolve all the circumstances in which an AI agent’s payment would be treated as authorized or unauthorized.

For a credit-card purchase, the article’s supplied facts do not establish a blanket outcome. It would be misleading to infer either universal protection or universal consumer liability from the debit-account commentary. Likewise, an explicit agent-protection framework can define eligibility without becoming a promise that all autonomous purchases are covered.

The authority record may help reconstruct the consumer’s instruction and the agent’s action. The credential controls may show why the payment passed. Neither alone answers the question of who should absorb a mistaken purchase. That question returns us to the difference between permission to act and success in carrying out a person’s intent.