For most of this year, the major payment networks have been building infrastructure for a kind of buyer that didn't exist five years ago: one that isn't a person. Visa's Trusted Agent Protocol moved out of sandbox testing into commercial rollout, Mastercard launched Agent Pay to let software initiate transactions directly, American Express released a developer kit for registering AI agents as recognized purchasers, and Corpay introduced Agent Card, a virtual-card product built specifically for AI-driven procurement. This didn't happen because card networks got excited about AI in the abstract. It happened because AI agents are already placing real orders — booking travel, restocking supplies, comparing vendor prices and buying the winner — and the existing rails, built around a person typing in a card number, were never designed to tell that apart from fraud.
The problem these networks are racing to solve is straightforward: how does a merchant know a purchase initiated by software, with no human clicking "confirm," is legitimate rather than a bot scraping a checkout page or a stolen credential being tested. Their answer is registration and tokenization — an agent gets its own cryptographic identity, and the card number it uses is a single-purpose token scoped to that agent, not the sixteen digits printed on an employee's physical card. That's a real technical shift, but it's also, quietly, a governance shift. It gives a business the tools to let a purchasing agent spend real money without handing it the same access a person would have — and just as easily, the option to skip that step and hand it over anyway.
That second option is the one worth worrying about, because it's the path of least resistance. The fastest way to get an AI procurement or booking agent working is to type an existing corporate card number into whatever tool is doing the buying — the same shortcut that shows up constantly in AI app builders and no-code automation more broadly. It works in testing. It also means the agent holds a live credential with no limit tied to its actual job, no easy way to revoke just its access without cancelling the whole card, and no clean line in the statement between what the agent bought and what a person bought with the same number. The new agent-card products exist to close that gap, which makes using them a deliberate decision, not something that happens by default.
The practical fix looks like ordinary least-privilege access control, applied to a card instead of a login. An agent reordering office supplies from one approved vendor needs a token capped at that vendor with a sane monthly ceiling — not a general-purpose card that happens to also work everywhere else. The agent-card tooling from Corpay and the networks supports exactly this: a virtual card scoped to a merchant category, a dollar limit, and a defined agent identity, so a manipulated agent can spend at most what the limit allows, and a compromised one can be shut off by revoking its token rather than cancelling every card on the account. Setting that scope takes a few extra minutes up front. Skipping it is the same trade a business makes whenever it hands out a shared admin password because scoping access properly felt like it could wait.
There's a mirror version of this for any business that sells rather than buys. A retailer or supplier that hasn't registered with the Trusted Agent Protocol, Agent Pay, or Amex's equivalent is, in effect, telling every AI shopping agent that reaches its checkout page that it looks exactly like a bot — because to a fraud model trained on human browsing patterns, that's precisely what an agent's behavior resembles: no mouse movement, no time spent reading a page, a purchase completed in under a second. Some of that traffic gets wrongly blocked, costing a real sale. Some actual bad-actor traffic gets a pass because the business hasn't tuned its defenses for the difference. Registering as agent-aware is a real decision now, worth putting on the same list as accepting a new payment method rather than leaving to whichever team notices the shift in traffic first.
None of this requires a large program to get in front of. A business already running, or piloting, any agent that books, orders, or pays on its behalf should ask a short set of questions before that agent touches live money: which of the new agent-card products does our payment processor or card provider actually support today; what is this agent's spending ceiling, and is it enforced by the card or only by a policy someone hopes gets followed; and can this one agent's access be shut off without touching anyone else's. A business on the selling side should ask its processor and fraud-detection vendor, directly, whether their current rules distinguish a registered agent from a bot — and if the answer is no, whether registering is on the roadmap or something the business needs to push for.
Agentic payments are arriving the way computer-use agents and voice-cloning fraud both did: not as a future risk to plan around eventually, but as infrastructure that shipped this year and is already in use, whether or not a business made a deliberate choice about it. The businesses that come out ahead won't be the ones that moved fastest to let an agent hold a card number. They'll be the ones that gave it a card built for exactly what it's allowed to do, and nothing more.
- ai agents
- payments
- procurement
- spend controls
- automation risk