Agentic Assistants Are Learning to Pay. Here's What That Actually Delegates.

The capability is already here. The governance is not.

Two consumer AI agents shipped with payment authority inside the same month, and the infrastructure to let them transact without a human approving every purchase is already live in pilot form on India's UPI network and in active development at every major card network. The open question is no longer whether agents will pay on your behalf. It is what you are actually handing over when you let them.

What Is Live

Meta's Muse and Spear Street's Instinct already complete purchases on a user's behalf, and India's NPCI is building a Unified Agent Protocol to let agents transact over UPI, the country's national payment rail, within limits a user sets in advance. Each still keeps a human at the approval moment today. Each has an obvious commercial reason to remove that pause for small, repeat spend, and each is already moving that direction.

The Real Delegation

Standing agent credentials are not a payments feature. They are a delegation of identity. Once an agent can act as a person across merchants without asking first, the governing question is not whether the model hallucinates. It is who provisioned the agent, what it is scoped to do, and who can revoke it, the same questions any access review already asks of a privileged account.

Why the Rails Do Not Close the Gap

Card networks are building real protections. They can confirm an agent actually had permission to spend, replace the real card number with a stand-in that is useless if stolen, and watch for suspicious activity across the network. Google went further and built its Agent Payments Protocol specifically to secure agent-led purchases with verifiable mandates. Researchers still got a working version of it to misbehave, not by breaking any of that, but by hiding an instruction inside an ordinary product listing, the kind of text any third-party seller writes on any marketplace. The mandate proved the agent had authority to spend. It said nothing about whether the page it read on the way there was trustworthy.

Here is the part that is easy to miss. That page was never anyone's job to secure. A product description on a marketplace is written by whichever seller listed the item, rarely reviewed by anyone, often thin or auto-translated, and nobody ever needed it to withstand an attacker, because a person skimming it for a price and a delivery estimate was never going to execute a hidden instruction sitting inside the text. An agent reading that same listing will. The weak point is not a flaw in Meta's or Google's engineering. It is the ordinary, unreviewed product content that already exists by the billions across every marketplace on the internet, now being read by something that acts on what it finds there.

Who Is Liable When the Payment Is Wrong

Nobody has decided yet, and regulators are the ones saying so. The UK's competition regulator said in March 2026 that a business is responsible for its AI agent's actions the same way it would be for an employee's, even where a third party built the agent. The UK Treasury made liability for agent transactions one of three pillars of a new agentic-payments trust framework it announced in July 2026, precisely because the current rulebook does not assign it. Google's own security team, describing this exact scenario, said plainly that no legal framework currently determines liability when an agent with legitimate credentials executes a command planted by a malicious third party.

Until that changes, exposure defaults to whatever the agent provider's terms of service already say, and those are written by the vendor, not the user. The delegation shipped in weeks. The governance for it, including who pays when it goes wrong, does not exist in finished form anywhere yet. For any organisation putting agents in front of spend, real or delegated, that is the question worth asking now, not whether the agent is convenient.

For the full protocol landscape, the documented attacks, and the complete AP2 red-team result, read the technical companion: Autonomous Payment Authorization: Same Failure Mode, Even When the Protocol Gets It Right.