Authority and Delegation

AI agents can already pay. The x402 protocol alone has cleared more than 50 million stablecoin transactions, most of them worth a fraction of a cent, and Google's AP2 launched with more than 60 partners, including Mastercard, PayPal, American Express, and Coinbase. The rails exist, and they work.

So the question finance teams are asking has changed. It is no longer whether an agent can pay. It is how you stop it from paying too much.

That question has a name. Delegation. It is the single biggest barrier to institutional agent adoption, and it comes down to one problem. How does a company give an AI agent real authority to spend, without handing it unlimited access to the bank account?

The risk is easy to picture. If an agent is compromised, a blank check or a shared private key turns into a disaster in seconds. A prompt injection hidden in a web page, a bug in a workflow, a supplier's system gone rogue any of these can push an agent into spending it was never meant to do, and it will happen at machine speed.

The answer is not to trust the agent more. The answer is to make the boundary impossible to cross. That is why the industry is moving away from open-ended credit lines and toward strictly scoped, programmable permissions, where the limit is enforced by code rather than by good intentions.

Scoped Authority Frameworks

Google AP2 and Mastercard Agent Pay

These are authority layers built for the purpose. AP2 wraps every purchase in three signed mandates. An Intent Mandate records what the user actually authorized, a Cart Mandate locks the exact items and price, and a Payment Mandate carries the approval to the payment network. Mastercard Agent Pay applies the same idea on card rails through agent-specific tokens. Together they can restrict a transaction by merchant category, by maximum amount per purchase, and by total operating budget.

Stripe ACP and Shared Payment Tokens

Stripe lets platforms issue short-lived, single-purpose payment tokens. Each token executes one pre-approved commercial task without ever exposing the underlying card, credit line, or bank details to the agent. Stripe's newer Machine Payments Protocol, built with Tempo and launched in March 2026, adds a sessions model where an agent gets a pre-authorized spending cap and streams small payments inside it.

Budget Limits and Reverts

If an agent tries to act outside its mandate, the transaction is stopped before it settles. On-chain, the smart contract simply reverts. On card rails, the network declines. Either way, the machine cannot spend outside its predefined boundaries, no matter what its reasoning says.

What Is Still Unsolved

The rails are largely built. The control layer above them is not. AP2 is still a young specification, at version 0.2 as of April 2026, running mostly in pilots and not yet tested at real card network volume. It binds a mandate to the user's signing key, not to the agent's identity, which means separate systems still handle agent identity and delegation.

And the hardest problem sits above every rail. A mandate can say an agent may spend 10,000 dollars this month. Proving in real time that 4,000 separate micro payments stayed inside that limit is a metering and policy job that no protocol fully owns yet.

That gap is exactly where the next wave of agentic finance infrastructure is being built.

Enterprise adoption will not depend on how autonomous an agent is. It will depend on how verifiable its authority bounds are.

Next episode is Agentic Wallets and Runtimes • Key Management for Machines.

Dorman Review | Meaningful Insight. Informed Decisions.

Written by Aybars Dorman | 6 September 2026

#AgentEconomy #AgenticCommerce #AIAgents #Fintech #Payments #Web3 #Stripe #GoogleAP2 #DormanReview