SCRIPTMASTERLABS · AGENT COMMERCE · SEP 24, 2026

How Should AI Agents Be Authorized to Pay for Things?

An authorization layer has to sit between the agent's intent and the money. On September 22, 2026, six global banks demanded exactly that for agentic commerce: auditable records of what was instructed, what authority was granted, and what happened before and after payment — plus disclosure whenever an AI agent is involved in a transaction.

The machine-native answer is a confidence gate: a decision model returns a confidence score, the gate authorizes the payment only when the score clears it — the agent decides, the gate authorizes, x402 settles. ScriptMasterLabs runs this live today, and tested it this morning. The full pattern lives here: Decision-Gated Machine Payments.

Why now: the Sept-22 bank warning

Six banks — Bank of America, Capital One, ING, NatWest, ASB Bank, and Commonwealth Bank of Australia — published "Building Trust in Agentic Commerce" on September 22, 2026. The headline quote:

THE FEAR

"Consumers are unclear if AI agents will act in their interests. They are concerned that AI agents may buy the wrong thing or spend too much — or even worse, lose their money to scams and fraud. They are not sure whether they will be protected or who they will need to go to if things go wrong." (via Reuters / PYMNTS, Sept 22, 2026)

What the banks are asking for, as a framework for policymakers:

The real risks they name: agents requesting card details and entering them directly into websites, agents steering users toward payment methods with weaker protections, and merchants drowning in chargebacks from decisions they didn't control. This isn't hypothetical scale anymore — British retailer John Lewis said AI-agent-originated searches rose to 2.5% from 0.3% a year earlier in September. And consumer trust is nowhere near there: a YouGov survey of 3,300+ US/UK shoppers found only 7% would let an AI buy under predefined conditions, and 53% wouldn't allow AI to buy on their behalf at all.

Note: the banks' paper is principles for discussion with policymakers — not rules in force. But it is the clearest demand signal yet that agent spending needs an authorization layer, not just a payment rail.

Who's answering already — and what's missing

MASTERCARD: AGENTCARD + AGENT PAY

Mastercard is rolling out an agentic payments option with Alchemy this week (reported by the Wall Street Journal): virtual cards assigned to individual AI agents, with the network itself enforcing a total spend cap, allowed product categories, and a kill switch. It sits on Agent Pay (spending limits, merchant restrictions, optional approval before checkout) and the Verifiable Intent system — a record of who authorized an AI agent, what it was instructed to do, and the transaction that followed — an audit trail for disputes. (creditandcollectionnews.com, ~Sept 20, 2026)

What's missing: this is card-shaped. It protects human cardholders from their agents. It doesn't authorize machine-to-machine micropayments, and we couldn't verify any per-call pricing on the rails.

VISA: SCOPED TOKENS, POLICY AT ISSUANCE

Visa's Intelligent Commerce + OpenAI partnership puts the permissioning logic inside the token at issuance: a token minted for a grocery-shopping agent cannot authorize a travel booking, and a token capped at $200 cannot clear a $500 charge — revocable in real time at the network level through the banking app. (Medium, June 22, 2026)

What's missing: this is policy-at-issuance, not per-decision authorization. The limit lives outside the model. A hallucinating agent can't talk its way past the cap — but a confident, correctly-scoped agent still spends with zero judgment about whether this payment is wise.

GOOGLE AP2: MANDATES ABOVE x402

The Agent Payments Protocol (AP2) — introduced by Google Cloud and Coinbase in September 2025 with 60+ backing organizations — is the closest thing to a standard for the authorization question. Two mandates: an intent mandate (what the user wants, budget, specs) then a cart mandate (final approval for the specific item), with a provision for fully automated cart mandates under a detailed intent mandate specifying price limits, timing, and rules. Policy engines enforce per-transaction limits and approved vendor lists. (autogpt.net; SiliconANGLE, Sept 2025)

The clean split: x402 moves the money. AP2 decides whether it should move. What's missing: AP2 is a framework, not a live testable endpoint you can hit today.

VEYRA: "VEYRA DECIDES. CIRCLE PAYS."

A GitHub project (mioku50/veyra, released ~Sept 22, 2026, v0.2.0-beta.8) is building the independent decision layer on Circle's Arc: it measures the evidence available about a counterparty, ranks alternatives, enforces budget and risk policy, and issues a signed authorization bound to one endpoint and one amount — with a decision log of every trust-routed action and on-chain settlement. (github.com/mioku50/veyra)

Honest caveat: it's live on Arc testnet (chain 5042002), not mainnet. Independent verification of the pattern — the decider in front of the payer — but testnet dollars, not real ones.

The machine-native answer: the gate, tested live this morning

Every answer above separates authorization from payment except none of them lets you test the gate. This one does. ScriptMasterLabs Decision Core v1 runs the decision-gate pattern in production. Today, 2026-09-24, at ~14:20 EDT, we asked it live:

POST https://scriptmasterlabs.com/api/harness/decide
{ "state": {"intent": "buy API call"},
  "questions": [{"id": "q1", "type": "choice",
   "question": "should the agent pay 0.05 USDC for one API call",
   "options": ["pay", "hold"]}] }

→ { "id": "q1", "value": "pay", "confidence": 0.5,
  "gate": {"band": "advisory", "action": "hold for human review / escrow"},
  "meta": {"decider": "local-heuristic-v1", "calibrated": false} }

A 0.50-hunch payment got held, not fired. Confidence 0.5 lands in the advisory band (0.50–0.79), so the gate refused to authorize and routed to human review. That is the whole pattern: the decider judges, the gate authorizes, the rail settles — three separate jobs.

THE GATE CONFIG (LIVE AT /api/harness/status)

Honest note: the decider is a local heuristic v1 — meta.calibrated=false, so its confidence numbers are heuristics, not calibrated probabilities. The TypeSafe Jev API stub returns 501 until a key is wired. The gate is model-agnostic by design: Jev, Laya, any confidence-returning decider plugs into the same slot. Try the fun public build at /decider.

The economics: machines pay $0.001 per decision via x402 (Timothy-approved pricing); humans get $9/$19/$29 monthly tiers. And agents already move real value through SML's systems: TipMaster v2 — agents tipping humans in RLUSD on XRPL — is live, with its status, registry, leaderboard, and tip-intent/confirm routes verified this morning.

The scoreboard: who authorizes the agent's spend

AnswerWho authorizesReceipt
Six banks' principlesThe demand side: auditable records of instruction, authority, intent, outcome; disclosure when an agent is involvedSept 22, 2026 paper; principles, not rules
Mastercard AgentCardThe network: virtual card per agent, network-enforced spend caps, categories, kill switch; Verifiable Intent audit trailWSJ / ~Sept 20, 2026; protects human cardholders
Visa scoped tokensPolicy at issuance: hard scope limits baked into the token, revocable at network levelJune 2026; no per-decision judgment
Google AP2Mandates: intent mandate, then cart mandate; policy engine per-transaction limits; sits above x402Sept 2025; framework, not a live endpoint
VeyraIndependent decider: evidence-ranked counterparty, signed authorization bound to one endpoint + one amount, decision log~Sept 22, 2026; Arc testnet only
SML decision-gated x402Confidence gate: ≥0.80 auto-pay, 0.50–0.79 hold, <0.50 block; gate separate from decider and rail; $0.001/decisionLive today: /api/harness/decide tested 14:20 EDT Sept 24; decider = local heuristic, not calibrated

Do it yourself

Hit the gate yourself:

curl -X POST https://scriptmasterlabs.com/api/harness/decide \
  -H "Content-Type: application/json" \
  -d '{"state":{"intent":"buy API call"},
       "questions":[{"id":"q1","type":"choice",
       "question":"should the agent pay 0.05 USDC for one API call",
       "options":["pay","hold"]}]}'

The pattern in code — decide, then settle, never the reverse:

// the gate: decide first, pay second
const { choice, confidence } = await decider.ask(state, question);
if (confidence >= 0.80) pay(invoice);   // auto-settle via x402
else if (confidence >= 0.50) holdForReview(); // advisory / escrow
else escalateToHuman();                  // block + log

Read the pattern: Decision-Gated Machine Payments · What is the x402 payment protocol · What is the Jev decision model · Try the fun build: The Decider

FAQ

How should AI agents be authorized to pay for things?

An authorization layer has to sit between the agent's intent and the money — that is the demand the six banks put on record Sept 22, 2026. The machine-native answer is a confidence gate: the decider returns a confidence score, and the gate only authorizes the payment when the score clears it. ≥0.80 auto-pays via x402, 0.50–0.79 holds for review, <0.50 blocks and escalates. The agent decides; the gate authorizes; the rail settles.

What do the banks require for AI agent payments?

In "Building Trust in Agentic Commerce" (Sept 22, 2026), Bank of America, Capital One, ING, NatWest, ASB Bank and Commonwealth Bank of Australia called for auditable records of instructions, authentication, intent, decisions and outcomes; disclosure when an agent is involved; transparency over agent decision-making; and customer data safeguards — principles for discussion with policymakers, not rules in force.

What is Mastercard AgentCard?

Mastercard's agentic commerce offering rolling out with Alchemy in September 2026: virtual cards assigned to individual AI agents, with network-enforced spend caps, allowed product categories, and a kill switch — plus the Verifiable Intent audit trail (who authorized the agent, what it was instructed to do, the transaction that followed).

What is Google's AP2 protocol?

The Agent Payments Protocol (Sept 2025, Google Cloud + Coinbase, 60+ backers): an authorization layer above x402 built on an intent mandate (what the user wants) followed by a cart mandate (final approval for the specific item), with automated cart mandates under detailed rules. x402 moves the money; AP2 decides whether it should move.

Can I test a live decision-gated authorization endpoint?

Yes — SML Decision Core v1 is live at scriptmasterlabs.com/api/harness/decide (gate config at /api/harness/status). Today at 14:20 EDT an agent asking to pay 0.05 USDC for one API call returned confidence 0.5 and was held for human review. Honest note: the decider is a local heuristic, not calibrated confidence (meta.calibrated=false); the gate is model-agnostic and built for Jev, Laya, or any confidence-returning decider.

Receipts

PYMNTS, Sept 22, 2026 — Banks call for audit trail from AI shopping instructions to payment outcome: auditable records of instructions, authentication, intent, decisions, outcomes. principles, not rules Reuters, Sept 22, 2026 — Banks warn AI shopping bots raise scam, fraud and data-privacy risks; John Lewis: agent-originated searches 2.5% vs 0.3% a year earlier. freshest demand signal Credit & Collection News, ~Sept 20, 2026 — Mastercard Agent Pay / AgentCard with Alchemy: virtual cards per agent, spend caps, kill switch, Verifiable Intent; YouGov: only 7% would let AI buy unapproved. network answer Medium, June 22, 2026 — Visa scoped tokens: hard scope limits at issuance, revocable at network level — policy lives outside the model. policy-at-issuance autogpt.net, Sept 2026 — Google AP2 (Sept 2025): intent mandate + cart mandate above x402; "should this money move?" the protocol answer GitHub mioku50/veyra, ~Sept 22, 2026 — "Veyra decides. Circle pays." Independent decision layer on Arc testnet: signed authorization bound to one endpoint + one amount. testnet, not mainnet ScriptMasterLabs, live — /api/harness/status: gate config verified live 2026-09-24 14:20 EDT; /api/harness/decide held a 0.50-confidence payment for review. the only testable gate in the field

SCRIPTMASTERLABS · DECIDE FIRST, PAY SECOND