How Can an AI Agent Prove It Has Permission to Buy for You?

Permission is a six-layer trust chain

It is tempting to treat “authorised agent” as a single status. That collapses several different questions.

A useful model is six layers:

That layered model is more useful than asking whether an agent is simply “trusted”. Trust has to be specific to the action.

The wider question of what an AI agent needs before it can act on a specific product remains broader than payment. This page covers only the purchase and payment-authority layer.

Agent identity is not user authority

A merchant first needs to know whether the automated request is coming from the agent it claims to be.

Visa's Trusted Agent Protocol documentation describes mechanisms for recognising approved agents and verifying signed messages. Its implementation material specifies cryptographic signatures and keys so a merchant can validate that an agent request came from a recognised party and has not been fabricated in transit.

That solves an important problem. It does not answer the next one.

A real, recognised agent may still be acting outside the user's permission. The fact that a merchant can authenticate the agent is not proof that the user authorised a £900 purchase from that merchant today.

The same distinction appears elsewhere in connected product systems: identity, authentication and ownership are not the same thing. In agentic commerce, identity and authority need the same separation.

What does “verifiable intent” mean?

An AI system can infer that a user probably wants something. A payment system needs a stronger basis than “the model thought this was what they meant”.

So the emerging protocols are moving towards signed, machine-verifiable representations of what the user permitted.

That permission may include constraints such as:

• a maximum amount;
• a specific merchant or merchant category;
• an approved product or basket;
• a time window;
• one-off or recurring authority;
• a payment method;
• expiry or revocation conditions.

The key design principle is deterministic verification. A merchant, network or issuer should be able to test the transaction against explicit permission, rather than asking another model to interpret whether the purchase “seems consistent” with the conversation.

Verifiable intent turns a vague delegation into something another system can check.

Checkout authority and payment authority are different

The Agent Payments Protocol, AP2 v0.2, makes this separation explicit through distinct mandate objects.

A checkout mandate represents the user's authority around the transaction being assembled. A payment mandate represents the authority needed for payment verification. The precise mechanics depend on whether the user is present or the agent is acting autonomously, but the architecture preserves the distinction.

These are different questions:

Did the user approve this basket from this merchant under these conditions?

and:

Is this payment instrument authorised to settle that approved transaction?

A system that proves only the second may still be missing evidence that the agent was allowed to create the purchase in the first place. A system that proves only the first may still lack valid payment authority.

AP2 is useful evidence that this split can be represented explicitly. It does not prove that every merchant, wallet, network or agent can already exchange those mandates interoperably.

How can a merchant recognise a trusted agent?

Visa Trusted Agent Protocol approaches the problem from the merchant-recognition side.

Its documentation describes approved-agent recognition, signed requests and signals that can be bound to merchant, purpose and time. That gives a merchant a cryptographic way to distinguish a recognised agent from ordinary automated traffic.

Visa's own material says the capability is in development or deployment and may not be available in all markets. It is first-party mechanism evidence, not proof of universal live adoption.

Nor does merchant recognition replace user intent. A signature can prove which agent sent a message. The signed object still needs to carry or connect to the right semantic authority for the action being attempted.

Limits, expiry and revocation are part of permission

Delegated authority should not be treated as permanent.

For an autonomous purchase, the question is not simply “did the user say yes once?” It is whether the authority remains valid for this purchase now.

An implementation needs lifecycle controls for:

• spend ceilings and cumulative limits;
• permitted merchants, categories or products;
• one-off versus recurring use;
• start and end times;
• expiry;
• revocation;
• evidence of the final transaction and receipt;
• dispute handling and auditability.

These controls matter especially when the user is not present at checkout. The permission object needs to be narrow enough that a verifier can reject something which falls outside the original mandate.

What do the live European payments prove?

By 2026, agentic payments had moved beyond specifications alone.

On 2 March 2026, Mastercard and Santander announced a live end-to-end AI-agent payment using Mastercard Agent Pay in a regulated banking context with predefined permissions and limits.

On 2 June 2026, Mastercard, Worldline and ING announced a live end-to-end agentic payment executed in production in the Netherlands using European payment infrastructure.

These prove that AI-agent-initiated payment can be executed through real payment infrastructure under bounded conditions.

They do not prove mass consumer availability, broad merchant adoption, cross-network interoperability or that one protocol has become the market standard. They are first-party deployment claims from organisations participating in the implementation, so they should be used for bounded evidence of execution rather than for general adoption claims.

Where are AP2, Visa, Mastercard and FIDO heading?

The main systems are converging on similar problems but should not be presented as equivalent.

FIDO's announcement on 28 April 2026 shows both sides. The Alliance is working on standards for trusted AI-agent interactions and drawing on existing contributions. That is evidence of serious convergence work. It is also evidence that there is not yet one settled cross-market trust model.

Product facts and purchase authority are separate

An AI shopping agent can know the right product facts and still lack authority to buy.

Conversely, an agent can have payment authority while operating on poor or unverified product information. The question of who decides what a product is made of when an AI answers for you is upstream of transaction authority, not a substitute for it.

A reliable agentic-commerce flow needs both. Product data tells the agent what it is choosing. Delegated authority tells the transaction system what it is allowed to do.

Payment permission stops at payment

This boundary is easy to lose once an agent has successfully completed a purchase.

The authority to buy does not automatically create any of the following:

• proof that the user owns a particular physical item;
• authority to access the user's support account;
• authority to arrange or approve a repair;
• authority to make a warranty claim;
• authority to transfer or resell the product;
• authority to update a product record or Digital Product Passport.

Those actions have their own identity, ownership, entitlement and service-authority rules.

A well-designed permission model should be action-specific. Reusing a purchase mandate as a general-purpose product-service credential would turn a bounded payment authorisation into something the evidence does not support.

What should an implementation team require?

Before accepting an AI-agent purchase, be able to answer all six questions:

1. Who is the agent? Verify the agent/provider rather than trusting a self-declared identity.
2. What did the user permit? Capture intent in a deterministic, auditable form.
3. Does this checkout fit? Test merchant, basket, amount and other conditions against that mandate.
4. Can this payment be authorised? Keep payment-instrument authority separate from checkout permission.
5. Is the mandate still valid? Enforce limits, recurrence, expiry and revocation.
6. Can every verifier understand the proof? Treat ecosystem acceptance and interoperability as a deployment dependency.

If any layer is missing, “the AI agent is trusted” is too broad a conclusion.

State of the standards as at 4 September 2026

• NOW: signed agent messages can be implemented; AP2 defines explicit mandate objects; named live European agentic payments have occurred using regulated payment infrastructure and predefined permissions.
• EMERGING: portable verifiable intent, interoperable agent recognition, shared mandate semantics, consistent revocation patterns and broad merchant/network adoption.
• POSSIBLE: one permission object that arbitrary agents, merchants and payment networks can verify without bilateral integration, plus broader delegation into non-payment actions with separate entitlement semantics.
• NOT SUPPORTED: agent identity proves user authority, Visa TAP is universally live, a live payment proves broad adoption, or payment authority gives an agent permission over repair, warranty, resale or account access.

What would change this answer?

Recheck the architecture when AP2 changes version, FIDO publishes normative agentic standards, Visa TAP reaches materially broader documented availability, Mastercard or other networks publish new rulebooks, or a credible public interoperability test shows mandates working across independent agent, merchant and payment ecosystems.

Protocol names will change faster than the underlying trust problem, so the six-layer model should remain the stable part of the page.

Primary sources

• Agent Payments Protocol, AP2 v0.2 specification: checkout/payment mandates, constraints and verification responsibilities.
• Visa, Trusted Agent Protocol overview: approved-agent recognition, signatures and intent-related signals. First-party mechanism evidence, not universal adoption evidence.
• Visa, Trusted Agent Protocol getting started: merchant-side cryptographic verification of approved agents.
• FIDO Alliance, standards for trusted AI agent interactions, 28 April 2026: active standardisation and convergence work.
• Mastercard and Santander, live end-to-end AI-agent payment, 2 March 2026: bounded live payment evidence with predefined permissions and limits.
• Mastercard, Worldline and ING, live European agentic payment in production, 2 June 2026: bounded production execution evidence.
• Visa, Trusted Agent Protocol use case: current first-party status and merchant trust framing.