Revoking an agent doesn’t cancel what’s pending

On September 22 six banks published a shared set of principles for trusted agentic commerce: NatWest, ASB Bank, Bank of America, Capital One, Commonwealth Bank of Australia and ING. Hans Overeem, who runs payments at ING, put the point plainly. “As AI agents enter the payments ecosystem, customers must remain in control, understand what the agent is doing, and have confidence that their data and payments are secure.”

A week before that, Mike Lawler and Josh Gottheimer introduced the Stop Rogue AI Act, which hands NIST the job of writing standards so an organization can “allow, deny, or revoke an agent’s access, actions, and interactions at any time, so people have the final say over what it can access or do.”

This is the one thing the whole industry agrees on, and it’s correct. Revocation has to be there.

Both documents treat it as a capability. A capability is something a system has. Revoking is something a person does, at a particular second, usually because they’re alarmed, and what they need at that second is not a switch.

Authorization and the purchase come apart

A team at Southern University of Science and Technology, the Indian Institute of Technology and City University of Hong Kong modeled four agent payment protocols in Tamarin at the end of August: x402, the Machine Payments Protocol, the Agentic Commerce Protocol and AP2. Across 86 verification cases they turned up 40 findings that hadn’t been documented before. One sentence in their introduction explains why this is hard, and it’s about sequence rather than cryptography.

“A user may authorize a task before the final merchant or terms are fixed, so each subsequent step can be locally valid while the transaction as a whole is inconsistent with that authorization.”

Read that as a calendar. The person grants authority on Monday. The agent picks the merchant on Wednesday, the money moves Thursday and the box arrives the week after. Revoking on Wednesday evening lands in the middle of that, and which parts it reaches depends on plumbing the person can’t see.

The specs are detailed about the front of that sequence. AP2’s core concepts give the Intent Mandate a list of authorized payment methods, the shopping criteria and an expiration time. Taking it back isn’t on the page. Visa’s Trusted Agent Protocol announcement, from October 14, 2025, is about how a merchant recognizes an agent it can trust. The consumer’s side of revocation isn’t in it either.

Identity already wrote this down

RFC 7009 is the OAuth token revocation spec, and it’s honest in a way product copy never is. “The invalidation takes place immediately, and the token cannot be used again after the revocation.” Then, a few lines later: “In practice, there could be a propagation delay, for example, in which some servers know about the invalidation while others do not.”

It goes further. “If the authorization server does not support access token revocation, access tokens will not be immediately invalidated when the corresponding refresh token is revoked.” Pull the thing that issues access and the access it already issued can keep working.

That has been in the spec for years, in the plumbing agent payments are built on. The difference now is that the token spends money.

The revoke that counts is the bank’s

There’s also a legal answer to where the switch belongs, and it’s older than any of this. Regulation E says a transfer isn’t unauthorized when it was initiated by “a person who was furnished the access device to the consumer’s account by the consumer, unless the consumer has notified the financial institution that transfers by that person are no longer authorized.”

Everything turns on that last clause. The revocation that changes a person’s position is the one their bank hears about. Switching the agent off inside the agent’s own app, which is where a person would obviously go to do it, is housekeeping.

Six systems out of 21

Alexandra Michael and Franziska Roesner at the University of Washington reviewed 21 agent permission systems proposed between 2024 and 2026, plus five commercial agents. Their finding on this point is blunt. Of the 21, “only six clearly provide ways for users to change or revoke permissions after the policy has been specified,” and two of those six only allow the change between sessions rather than during one.

They name the assumption underneath it. These systems “assume that a one-time decision extrapolates to all future circumstances.”

They’re writing about agents in general, not payments. Payments is where that assumption carries a dollar amount.

What the screen owes a person

Visa’s own research found about half of respondents worried about “decisions made without me.” Asked whether they’d still use a shopping agent without control over their data, 54% said not very or not at all likely. Those were online surveys of card holders who shop online monthly: 1,600 in the United States, 1,600 in Australia and 500 in New Zealand.

A revoke screen that says “Access removed” answers a question about the system. The questions a person actually has are about their money, and there are four. What did my agent already commit me to? Which of those does this switch stop? Which of them is still coming anyway? Where do I go to cancel each one?

That’s a list, and lists are generated from state somebody has to go and fetch: orders placed and not shipped, an authorization approved yesterday that posts on Friday, the subscription the agent started under its own credential at the merchant. None of it is exotic. It just isn’t anybody’s ticket, because the feature shipped when the grant screen worked.

So in any review where a screen hands something authority, I ask to see the second screen in the same session. Not the confirmation. The one where a person takes the authority back, and what it lists when they land on it. The first screen is usually in high fidelity. The second one is usually a line in a backlog.

At Chainlink Labs I directed Staking v0.1, and the call I made there was about where the facts sit. The pool gauge, the reward rate and the remaining allotment went next to the stake action, so nobody had to leave the page to decide.

Charlie Liu, writing Agentic Commerce Daily on October 2, summed up the week as trust and payment infrastructure “hardening around continuous authorization and open standards.” That’s a fair read of what’s being built. Continuous authorization means the grant keeps working while nobody is watching it, which makes the moment somebody wants it to stop more consequential.

The switch most products will ship lives in the agent’s app, because that’s where the agent lives. Regulation E puts the one that changes a person’s legal position at their bank. Somebody is going to decide which of those a person gets, and on current evidence it’s whoever owns the settings page.