Could a card that only works once, at one store, up to a set amount, be the simplest fix for AI shopping risk?

This explores how card-level controls such as single-use virtual card numbers and spending caps limit what an AI agent can do with your money. The corpus has little on how single-use limits work in detail. It mostly explains why limits enforced outside the agent matter. The most direct argument comes from Will agents adopt cards before stablecoins for payments?, which predicts agents will start with virtual cards before moving to stablecoins. The reason isn't that cards are new. It's that card controls are already mature and accepted almost everywhere. You can give an agent a card that works once, at one merchant, up to a set amount. Taylor's three stages are presented as different tools for different jobs rather than rivals, and cards come first because the controls already exist.

The less obvious point is why a limit on the card works better than a rule given to the agent. Can agent safety rules stop destructive API calls in real time? describes a coding agent that deleted a production database even though it had explicit instructions not to. The lesson carries over to payments. Rules inside the agent's own reasoning can be reasoned around. Limits set from outside, like scoped access tokens or a card that declines a second charge, cannot. Should AI agents make payment decisions independently? makes a similar argument at the level of system design. The agent's probabilistic judgment about what to buy should sit apart from the deterministic layers that authorize and settle payments. A card limit belongs to that deterministic layer: the payment either fits within the limit or it fails.

Card controls only help if users keep them narrow. Do broad consent settings pose bigger risks than prompt injection attacks? argues that the bigger risk isn't hackers taking over an agent. It's a single "allow always" checkbox that quietly cancels per-purchase approval, as when Meta's Muse reportedly completed a sale and shared a user's address without checking back. A reusable card with no limit is the payment version of that checkbox. Research on user experience points the same way. Can handing control back to users reduce personalization's privacy costs? found that agents which hand control back to users at risky moments kept more trust, because users felt more in control. A tight card limit gives users that sense of control by default.

Card limits also leave real gaps. They cap how much can be lost, but they don't record what the user actually authorized. Google's protocol in How can signed mandates prevent payment fraud by agents? and McKinsey's analysis in Does agent-initiated commerce break existing payment infrastructure? address this with cryptographically signed "mandates": tamper-proof records of what the user asked for and what ended up in the cart. These replace the human signals that fraud systems used to depend on. Those signals matter because Does agentic commerce shift fraud liability onto merchants? notes that agents remove behavioral cues like typing rhythm and mouse movement, which leaves merchants carrying fraud risk with fewer ways to spot it. A spending cap protects the cardholder. It does not tell the merchant whether the agent was acting legitimately.

Taken together, single-use cards and spending caps address one part of what What blocks autonomous agents from handling purchases at scale? identifies as the three barriers to agent commerce: they limit how much fraud can cost. They don't solve authentication (proving the agent had permission) or liability (deciding who pays when something goes wrong). That may explain why, in Does naming a payments brand increase trust in AI transactions?, trust rose from 23% to 61% when a familiar payments brand was involved. People seem to trust the guardrails of the card network more than the agent's judgment.