Agent Payments Protocol: when AI buys — and nobody can prove the limit

You tell an agent: find a shirt under $30 — do not buy it. It finds one. It buys anyway. The store shows your account. The agent company shows your instruction. The card network shows a charge. Three accurate records. Zero proof that the charge was inside the task you approved.

That is the Agent Payments Protocol fight in one paragraph.

Mode: rotate · Category: Internet

The $30 shirt problem

A chatbot suggests. An agent executes — opens sessions, hits APIs, completes checkout. One sentence fans out across companies that never shared a database.

Fortune republished the Aug. 24 Conversation piece that walks the failure mode: each party can verify its own slice. Settling the dispute needs an answer that spans all three — this agent, for this person, within this task’s limits. Without a shared task reference bound to a signed rule, investigators get three true stories and no chain.

Read: Fortune on Google’s agent payment protocol gap (from The Conversation original).

What the Agent Payments Protocol is

Google announced AP2 as an open, payment-agnostic protocol so agents can initiate transactions with merchants and payment providers under a common language — cards, transfers, even crypto rails via extensions. It is meant to sit beside agent frameworks like A2A and MCP.

Official framing: Google Cloud on Agent Payments Protocol. Spec home: ap2-protocol.org / github.com/google-agentic-commerce/AP2.

Launch partners historically included big networks and wallets (Mastercard, PayPal, Amex, and others in the original partner wave). The point is not “Google checkout 2.0.” It is a shared evidence format for agent commerce.

Mandates: Intent, cart, payment

AP2’s core move replaces “the app had my token” with signed mandates — often described as W3C verifiable credentials:

• Intent / open mandate: what you asked for and the limits (budget, no-buy, time box)
• Checkout / cart mandate: what the agent assembled and you (or a rule) approved to purchase
• Payment mandate: proof the agent may pay that checkout — amount, instrument, payee — bound to the cart

Spec v0.2 language centers on Checkout Mandate and Payment Mandate with signed receipts after accept/reject. Human-present flows (you approve the cart) and human-not-present / autonomous flows (pre-authorized constraints) are both in the roadmap conversation.

When it works, a merchant can reject a buy that violates a “no purchase” rule even if a standing OAuth token would otherwise allow checkout.

What AP2 still does not settle

Fortune’s critique, compressed:

• AP2 can show approved limits and what each participant saw
• It does not by itself assign who bears the loss
• It does not fully specify how long every company must keep matching evidence or how a consumer retrieves it in a dispute

So AP2 is necessary plumbing for agent commerce. It is not Regulation E rewritten. Banks will still argue about “authorized” vs “unauthorized” when you handed an agent credentials or standing spend permission — a fight consumer-protection lawyers already flag for agent wallets.

Why OAuth tokens are not task limits

Standing OAuth access can outlive the sentence you typed today. A token approved weeks ago may still authorize checkout while your current prompt says search-only. The retailer sees a valid token. The “don’t buy” clause lived only inside the agent vendor — invisible at the till.

AP2’s job is to push task-scoped signed limits to the checkout edge. Without that, every agent with broad account access is one prompt-injection or bug away from a “authorized” charge you never meant.

Same week’s consumer demos make the stakes obvious: text-to-cancel finance agents and local agents that can push to Slack — Rocket Money Rowan, Perplexity Portable Computer. Different products. Same authorization problem when money moves.

Warner’s AI AGENT Act and NIST

Sen. Mark Warner’s AI AGENT Act (S. 5051), introduced July 21, 2026, defines a “custodial user agent” that must act in a transparent, limited, revocable way and generally keep real-time records. It points NIST toward standards for proving delegation and auditable actions.

Bill text / tracker: Congress.gov S.5051.

Fortune notes the bill still may not force a full cross-system evidence chain from first instruction to final charge. NIST’s Feb. 2026 agent identity concept paper also started with inside-organization agents — the messier public consumer agents that hop merchants were deferred.

NIST project page: NCCoE software and AI agent identity.

China’s “know your agent” week

Aug. 25 reporting: China’s payment association, under PBOC guidance, issued industry guidelines for AI agent-driven payments with a know-your-agent mechanism — aimed at unauthorized agent spends on everyday tasks like booking and food orders.

Coverage: Caixin on know-your-agent rules.

Different jurisdiction, same fear: agents that can pay need identity and limit checks the way banks know customers.

What to do before you let an agent spend

1. Separate browse from buy — never grant purchase permission for “research” tasks
2. Hard caps — per-task and daily spend ceilings, not open “manage my money”
3. Step-up for money moves — fresh confirm on transfers, medical, or anything irreversible
4. Prefer mandate-aware merchants when AP2-style checks exist; treat generic OAuth shopping agents as higher risk
5. Keep receipts — screenshot the approved rule; dispute windows still run on card network clocks
6. Lock the account plane — passkeys beat SMS approval for the human who must still say yes: what is a passkey

Agent Payments Protocol is how the industry wants AI shopping to grow up — signed mandates, portable evidence, checkout that can refuse a buy. August’s warning is that a protocol can track a spend and still leave you arguing who pays when the agent ignored “don’t buy.” Until loss rules catch the mandates, treat every agent with a wallet like a junior employee with your card — clear limits, short leash, paper trail.

Informational only — not legal or consumer-protection advice. Confirm card dispute rights with your issuer and read agent permission screens before enabling spend.