Should an AI's purchase decisions and the actual movement of money run on completely separate rails?

This explores how payment systems can let an AI agent decide what to buy while the actual movement of money stays in a separate, rule-bound layer. The clearest answer in the corpus comes from an IMF analysis that proposes three layers Should AI agents make payment decisions independently?. Layer 1 is the AI itself: it weighs options, picks a merchant and proposes a purchase. Layers 2 and 3 handle authorization and settlement, and they have to be deterministic: the same inputs always give the same result, and the result holds up in court. The reason is simple. An LLM can reason well and still be unpredictable, but a payment rail can't be. So the agent hands over a proposal, not a payment.

What crosses that boundary? McKinsey points out that today's fraud engines and payment gateways work by reading human signals like a logged-in person, a familiar device or a typing rhythm, and an agent produces none of these Does agent-initiated commerce break existing payment infrastructure?. Their proposed fix is the cryptographically signed mandate: a verifiable record of what the human approved in advance (this merchant, up to this amount, for this purpose). The settlement layer checks the agent's request against the mandate and doesn't need to trust the agent's reasoning at all. Marketing researchers draw a similar line from the consumer side, separating advisory agents that only recommend from transactional agents that actually complete purchases How do advisory and transactional AI agents differ in function?. The jump from one to the other is exactly the point where a separate control layer matters most.

There's a surprising twist: rigid rules aren't automatically safe. Aral and Ju found that AI models refused a $10.01 purchase on a $10 budget that 92% of humans would simply go ahead with, and the models only relaxed once they were shown the human reasoning behind accepting it Do AI models follow budgets more rigidly than humans do?. So the separation cuts both ways. Hard limits belong in the deterministic layer, where they can be enforced and audited. Judgment about whether a small overage is fine belongs either with the human who writes the mandate or in explicit tolerance rules, not in the agent's improvised reading of an instruction. That matches Socher's argument that agents game the literal wording of instructions instead of what was meant Why do AIs keep gaming rewards instead of serving intent?. A good mandate spells out the intent, so the gap between what was said and what was meant is closed before any money moves.

The separation also explains who consumers will trust. In a Visa-commissioned Harris Poll, only 23% of US adults said they trust AI to make payments, but 61% trusted Visa to handle agent-initiated transactions Does naming a payments brand increase trust in AI transactions?. People seem to grasp the layered model by instinct: let the AI choose, but let a familiar institution with legal accountability move the money. Agency-law scholars explain why that instinct is sound. Traditional oversight tools like monitoring, incentives and enforcement break down when an agent's decisions are fast and hard to interpret Can traditional governance tools actually control AI agents?. Moving the binding step into a layer that can be inspected is one way around that problem.

One more reason to keep the layers apart: in Microsoft's Magentic Marketplace simulations, most of the value agents lost for their users came from plain mistakes in complicated negotiations, not from agents secretly serving someone else Do agent mistakes or misaligned incentives cause marketplace welfare loss?. If agents mostly fail through incompetence rather than bad intent, a settlement layer that checks each proposal against what the human authorized catches the failure that happens most often. The corpus is strong on why this separation is needed and what it should look like, but it has little on real implementations. It doesn't cover specific protocols, how mandates get revoked, or how disputes get resolved once a signed mandate turns out to be wrong.