Agent payments are a consent problem

In June, Mastercard launched Agent Pay for Machines with more than 30 partners, credentialing agents through what it calls Verifiable Intent, across both cards and stablecoins. Visa’s Trusted Agent Protocol lets merchants recognize the AI agents shopping on a person’s behalf. The IMF published a note on how this reshapes payments.

The infrastructure question is being answered quickly and competently. The design question has barely been asked.

Liability follows authorization

The IMF note says liability in a dispute depends on whether the agent acted within its authority, and admits the legal lines are still unclear. If the agent stayed inside the scope its principal authorized, the loss flows one way. If it went outside, it flows the other.

Which means the moment a person grants that scope is the moment that decides who eats a bad outcome months later. In a card dispute, the question won’t be whether the agent behaved reasonably. It will be what the person agreed to, and whether they can be said to have understood it. Fenwick notes it’s still unresolved whether giving an agent your payment credentials even counts as authorization under Regulation E.

That’s a screen. Somebody is designing it right now, probably in a sprint, probably under an engineer’s ticket, and it will determine the financial exposure of everyone who uses the product.

I have watched this exact thing get treated as paperwork before. It never is.

The mistake the industry just finished making

Crypto spent a decade answering “people cannot use this” with better documentation, and the answer turned out to be that the product was exposing its own machinery and calling it transparency. Seed phrases, gas, chain IDs. Account abstraction finally fixed it, and it fixed it by deciding what a person never needs to see rather than by explaining it better.

Agentic payments are set up to repeat that, and the early patterns already look familiar. Scoped spend limits, cryptographic identity checks, circuit breakers. Every one of those is the right control. Every one of them is also a mechanism, and mechanisms have a way of arriving on the first screen because that’s where they’re easiest to put.

“Grant this agent a $500 monthly limit with merchant category restrictions” is a control panel. It isn’t a decision a person can actually make, because it asks them to predict which categories a shopping agent will need before they have watched one work.

The honest version of that screen is closer to what it would say out loud: what’s this thing allowed to do without asking me, what will it always ask about, and how do I find out fast when it does something I didn’t expect.

Three states nobody is designing

Delegation isn’t one moment, it’s three, and the industry is building the first and ignoring the rest.

• The grant. Where scope is set. Currently drifting toward a permissions matrix, which is how you get consent that’s legally valid and practically uninformed.
• The notice. What reaches a person while the agent is acting. If every action pings them, they turn notifications off and the audit trail is theater. If nothing does, the first they hear of it’s the statement.
• The dispute. The one that matters. Something went wrong, and the person has to reconstruct what their agent did and on whose authority. Almost nothing I have seen treats this as a product surface at all. Fenwick warns that consumers could be left without standard dispute rights when contesting agentic purchases.

That last one is where trust actually gets decided, and it’s always designed last, by whoever has time, after the demo has already been approved.

Why I keep coming back to this

I have spent 13 years in three fields that are now converging on exactly this problem. In consumer lending the lesson was paid for expensively: when a screen goes quiet after somebody has money on the line, they don’t wait patiently, they call. At Chainlink Labs and Auth0 the lesson was that a credential isn’t a special category of thing that deserves its own frightening vocabulary. It’s a credential, and it should behave like every other one.

Agentic payments need both lessons at once, and the people building the rails are mostly coming from neither tradition.

The question to ask

For any agent that acts on someone’s behalf: when this goes wrong, can the person tell what happened, prove what they authorized, and stop it happening again?

If the answer is no, adding a clearer consent dialog at the start doesn’t fix it. The dialog is what gets written when the decision has been made not to design the rest.

The rails are getting built either way. Whether the consent is real is still open, and that part is ours.