At checkout, how does a payment system know an AI agent is really shopping with your money and your permission?

This explores how a merchant or payment network can tell that an AI agent at checkout really speaks for a buyer, and for this specific purchase. The short answer from the corpus is that one check isn't enough. Authority has to be proven at several points: who the agent is, what the human agreed to, and what payment credential gets used. Each of those points is being solved by a different emerging protocol. Federal Reserve Governor Waller puts authentication first among the three barriers to agent commerce at scale, next to liability and fraud What blocks autonomous agents from handling purchases at scale?. McKinsey explains why it is suddenly hard. Fraud engines were built to read human signals like typing patterns, device fingerprints and the pause before clicking 'buy', and an agent gives off none of them Does agent-initiated commerce break existing payment infrastructure?.

The first layer is identity: is this a known, trustworthy agent, or a scraper or bot? Visa and Cloudflare's Trusted Agent Protocol has agents sign their web requests cryptographically, so a merchant can verify a trusted agent and see intent and consumer-recognition data in the same request Can cryptographic signatures help merchants identify trusted AI agents?. There is a non-obvious lesson here. Protecting the buyer's secrets is a separate problem from the agent identifying itself. Allglenn argues that keeping card details in a secure vault stops the agent from leaking them, but it gives the retailer nothing it can read about who is knocking Can credential vaulting alone solve merchant-facing agent identification?. Amazon's block of Meta's Muse shows what happens when that layer is missing: retailers fall back on blanket terms-of-service bans instead of a negotiated standard What identity standards do shopping agents actually need?.

The second layer is delegation: proof that a specific human gave this agent a specific scope. Researchers have extended OAuth 2.0 and OpenID Connect, the familiar 'Sign in with Google' machinery, into three tokens: one for the user, one for the agent, and a signed delegation token that links them. With these, a service can check who authorized the agent, what they allowed, and whether that permission has since been revoked How can AI agents prove who authorized their actions?. Google's AP2 brings the same idea to payments with signed 'mandates.' An Intent Mandate records what you asked for, and a Cart Mandate records the exact basket you approved. Chained together, they form a tamper-proof record that neither side can later deny How can signed mandates prevent payment fraud by agents?. Stripe and OpenAI take a narrower route at the payment step. Their Shared Payment Token is single-use and locked to one merchant and one cart total, so even a compromised agent can't spend beyond what was approved Can payment tokens let AI agents checkout safely?.

The IMF adds an architectural principle. The AI's decision-making is probabilistic and should sit in its own layer. Authorization and settlement need to stay deterministic and legally enforceable, so an agent's reasoning should never be the thing that authorizes money to move Should AI agents make payment decisions independently?. Signed mandates and scoped tokens are a way to build that wall.

The weak point may not be cryptography at all. It may be consent design. Ayeshha argues that a single 'allow always' checkbox can quietly switch off per-purchase approval. In one reported case, Muse completed a sale and handed over a user's address without checking back Do broad consent settings pose bigger risks than prompt injection attacks?. A perfectly signed mandate still only proves what the user clicked, not what they understood. Trust also has a social side. Only 23% of US adults trust AI to make payments, but 61% trust Visa to handle agent transactions Does naming a payments brand increase trust in AI transactions?. That suggests buyers may care less about the protocol than about which familiar institution stands behind it.