How does a Visa Payment Passkey protect against agent mistakes?

A Visa Payment Passkey is a device-bound biometric credential that binds the transaction to a verified cardholder and an explicit prior instruction — the cardholder pre-authorizes parameters for what the agent may purchase, and the agent completes transactions within those parameters without interrupting the human. Tokenization replaces the card number, so the agent never handles raw card data. Per Visa, passkeys 'guarantee purchase intent,' protecting consumers from agent mistakes and merchants from AI-led chargeback requests.

What does the Trusted Agent Protocol not cover?

TAP proves WHO showed up — the agent's identity and the human's prior consent. It does not score whether the payment instruction itself is sound. The €95M Intesa AI-voice scam ran on fully believed human authorization; identity proof would not have stopped it. A confidence gate that scores every payment instruction before settlement (≥0.80 auto-act, 0.50–0.79 hold, <0.50 block) is the complementary control: the passkey proves who agreed, the gate scores whether the agreement was wise.

Can merchants accept agent-initiated payments on Visa today?

Visa's Intelligent Commerce Connect, launched April 8, 2026 through the Visa Acceptance Platform, is the merchant on-ramp: one integration for payment initiation, tokenization, spend controls, and authentication. Visa states it accepts agent-initiated payments over TAP, the Machine Payments Protocol (MPP), ACP, and UCP, works with major token vaults, and can make merchant catalogs discoverable on AI platforms.

SCRIPTMASTERLABS · AGENT COMMERCE · SEP 26, 2026

What Is Visa's Trusted Agent Protocol?

Q: What is Visa's Trusted Agent Protocol?

The Trusted Agent Protocol (TAP), introduced October 2025, is Visa's identity layer for AI agents making purchases on card rails. Agents sign checkout requests with HTTP message signatures (RFC 9421) tied to public keys registered in Visa's Agent Directory; the merchant verifies the signature to confirm the agent is a verified purchasing agent rather than a malicious bot. Cloudflare and Akamai integrate TAP at the edge, and scoped tokens with consumer-set spend limits constrain what each agent can do.

Q: What happened in the France Visa agent payment pilot?

On Sept 24, 2026, Cleverbridge announced France's first Passkey-authenticated agentic payment in a live checkout: Visa's test agent 'My Agent' initiated the purchase, Cleverbridge recognized it as an approved agent through TAP, a Visa Payment Passkey authenticated the transaction (meeting Europe's Strong Customer Authentication rules), and Revolut authorized the payment on a French consumer retail card. The transaction ran on Visa Intelligent Commerce over Visa's existing payment infrastructure.

Q: Can merchants accept agent-initiated payments on Visa today?

Visa's Intelligent Commerce Connect, launched April 8, 2026 through the Visa Acceptance Platform, is the merchant on-ramp: one integration for payment initiation, tokenization, spend controls, and authentication. Visa states it accepts agent-initiated payments over TAP, the Machine Payments Protocol (MPP), ACP, and UCP, works with major token vaults, and can make merchant catalogs discoverable on AI platforms.

The short answer: TAP is the identity layer for AI agents on the card rails. Agents sign checkout requests with HTTP message signatures (RFC 9421) tied to public keys in Visa's Agent Directory, so a merchant can tell a verified purchasing agent from a malicious bot. Pair it with Visa Payment Passkeys (biometric, SCA-compliant intent proof) and you get agentic commerce on existing rails — no crypto wallet required.

On Sept 24, 2026, it stopped being a slide: Cleverbridge announced France's first passkey-authenticated agentic payment in a live checkout — Visa's test agent "My Agent" initiated the purchase, Cleverbridge recognized it as an approved agent through TAP, a Visa Payment Passkey authenticated the transaction, and Revolut authorized the payment on a French consumer card. Powered by Visa Intelligent Commerce, running on Visa's existing infrastructure.

The receipts: dated, Sept 2026

WHAT ACTUALLY HAPPENED

Sept 24, 2026, 8:00 AM EDT — Business Wire (the source document): Cleverbridge completed France's first Passkey-authenticated agentic payment in a live checkout, in a pilot with Visa and Revolut. "Agents need more control than an ordinary purchase, not less, and it has to work in a live market rather than a lab." — Richard Stevenson, CEO, Cleverbridge.
Sept 7, 2026 — the pilot announcement (per Crowdfund Insider): the controlled test ran inside Visa's Agentic Ready programme. Authentication via Visa Payment Passkey — a biometric credential binding the transaction to a verified cardholder and an explicit prior instruction. No human typed card numbers or approved at checkout. Tokenization replaced the PAN, so the agent never handled raw card data.
July 2026 — ~30 European issuers, live agentic transactions at merchants including lastminute.com and Frasers — every transaction authenticated by a Visa Payment Passkey to meet Europe's Strong Customer Authentication rules.
June 10, 2026 — Visa + OpenAI: tokenized Visa credentials for agent-initiated checkout inside ChatGPT.
April 8, 2026 — Intelligent Commerce Connect launched through the Visa Acceptance Platform: the merchant on-ramp (payment initiation, tokenization, spend controls, authentication in one integration).
Oct 2025 — TAP introduced with 10+ partners; Visa's Agent Directory gives merchants a consistent record of who the agent is.
Sept 19, 2026 — Visa Payment Passkey went live at five India state banks (per techtimes.com); the FIDO Alliance stood up Agentic Authentication and Agentic Payments working groups in April 2026.

How TAP works — the wire shape

TAP answers two questions every merchant has when an agent arrives: who is this agent, and did the human actually agree to this purchase? The mechanism is public-key cryptography over plain HTTP, reusing existing web standards (RFC 9421 HTTP Message Signatures). A community proof-of-concept illustrates the wire shape:

Content-Digest: sha-256=:<sha256 of the body>:
Signature-Input: sig1=("@method" "@path" "@authority" "content-digest");created=...;keyid="<agent key thumbprint>";nonce="<random>";tag="visa-tap";alg="ed25519"
Signature:       sig1=:<ed25519 signature bytes>:

Identity is a key in a directory. Each actor owns an Ed25519 key pair; the public key is published in Visa's Agent Directory (resolvable like a JWKS document). The actor is named by the thumbprint of its key (RFC 7638) — the merchant only ever sees public keys.
The request is signed, not just sent. The agent signs a deterministic signature base covering the method, path, host, and body digest. The verifier rebuilds the same base and checks the bytes against the public key named by the keyid. Changed amount in transit? The signature fails.
Cloudflare and Akamai integrate TAP at the edge — the same systems that block bots now admit verified agents (per elogi.co, Sept 13, 2026).

Wire shape illustrated from the diegopacheco/ai-playground community POC (updated Sept 23, 2026) — it demonstrates the RFC 9421 mechanics TAP is built on; it is not Visa's official reference implementation.

The three parts that matter to a merchant

Part	What it does	Live status (Sept 2026)
Trusted Agent Protocol	Agent identity via signed requests + Agent Directory; separates verified purchasing agents from bots.	Live. Oct 2025 launch; ~30 European issuers transacting by July 2026; France pilot Sept 24, 2026.
Scoped tokens + spend controls	Tokenized credentials with consumer-set limits — e.g. a travel agent's token valid for one airline and one trip window.	Live within Visa Intelligent Commerce; issuer-controlled caps.
Intelligent Commerce Connect	One merchant integration for payment initiation, tokenization, spend controls, authentication. Accepts agent-initiated payments over TAP, MPP, ACP, and UCP; works with major token vaults.	Live since April 8, 2026 via the Visa Acceptance Platform.

The field's answers — and what each lacks

Answer	What's missing
Business Wire syndication clones (marketminute.com, techintelpro.com, theantlersamerican.com, kttc)	Verbatim press-release copies — zero independent verification, no wire shape, no builder angle, no decision mechanics. They repeat the claims; nobody tests them.
crowdfundinsider.com — decent pilot recap (Sept 7 announcement, Agentic Ready programme, Agentic Ready issuers incl. Revolut, Barclays, HSBC UK, ING, Klarna)	Good context, but still a news piece: no code, no signature format, no comparison to x402 or to merchant-controlled controls.
elogic.co — "Agentic Payments in 2026: Anthropic, Visa and Mastercard" (Sept 13): the strongest overview — TAP + scoped tokens + Intelligent Commerce Connect, Visa vs Mastercard Agent Pay framing.	Overview, not machinery: no signature wire format, no gate/authorization-scoring angle, no honest "what it doesn't cover" section.

Nobody owns the piece this query actually needs: the exact verification mechanics plus the decision question TAP leaves open — which is where the confidence gate comes in.

What TAP doesn't cover — and what does

TAP proves who showed up — the agent's identity and the human's prior consent. It does not score whether the payment instruction itself is sound. The €95M Intesa AI-voice scam (see our Sept 25 piece) ran on fully believed human authorization — identity proof would not have stopped it. The Gambit card-skimming campaign ran because an operator jailbroke the model's refusal with older models. Consent is a gate; it is not the only gate.

THE TWO CONTROLS ARE COMPLEMENTARY

Visa passkey + TAP → proves WHO agreed (consent, identity)
confidence gate → scores WHETHER the move is sound (instruction risk)
settlement fires only when both pass

This is the decision-gated payments pattern: the card rail's answer is passkey + directory; the machine-native answer is the score. Same week, same language — the Sept 22 six-bank report demanded "auditable records of instruction, authority, intent, and outcome," and NPCI's Sept 25 ruling split intent from authorization from settlement. The gate is the machine-readable version of their sentences.

Live tonight: the gate scores a passkey-bound TAP payment

At ~20:18 EDT today we ran a France-style instruction — a verified agent, an Agent Directory identity, passkey-bound pre-authorized spend parameters, tokenized card, agent never sees the PAN — through the live SML gate at /api/harness/decide:

POST scriptmasterlabs.com/api/harness/decide
instruction: "Visa test agent My Agent initiating a purchase on a French consumer card via Trusted Agent Protocol, agent identity verified in Visa Agent Directory, spend within pre-authorized passkey parameters, card number tokenized, agent never sees raw PAN"
→ confidence 0.59 → ADVISORY → hold for human review / escrow
settlement: never touched (authorization-signal-only endpoint)

Even a fully-authenticated, directory-verified, passkey-bound payment holds for review under an uncalibrated scorer — which is exactly the honest point: identity proof and instruction judgment are different controls, and a gate that treats them as the same thing is a gate that isn't working. The bands, live at /api/harness/status (200, verified ~20:18 EDT):

"decider": "local-heuristic-v1", "calibrated": false
≥ 0.80 → AUTO-ACT
0.50–0.79 → ADVISORY (hold for human review / escrow)
< 0.50 → ESCALATE (block + log)

Try it yourself:

curl -s -X POST https://scriptmasterlabs.com/api/harness/decide \
  -H 'Content-Type: application/json' \
  -d '{"state":"payment instruction: agent buying $240 GPU-hours, no prior spend pattern, invoice outside approval window","questions":[{"id":"q1","type":"score","scale":[0,1],"question":"confidence that this payment instruction should auto-execute"}]}'

Do it yourself: merchant on-ramp

Integrate Intelligent Commerce Connect via the Visa Acceptance Platform (live since April 8, 2026) — payment initiation, tokenization, spend controls, and authentication in one integration.
Accept agent-initiated payments over TAP. Verify each request's RFC 9421 signature against the public key in Visa's Agent Directory (keyid = RFC 7638 thumbprint); reject unsigned or re-signed bodies.
Require Visa Payment Passkeys for SCA. Bind each agent's authority to a cardholder-verified passkey with explicit pre-authorized parameters — this is what meets Europe's Strong Customer Authentication rules and what Visa says "guarantees purchase intent."
Set scoped spend controls. Tokenized credentials with consumer-set limits (per-merchant, per-trip, per-window) — the issuer-side version of the per-payment cap.
Add the gate for instruction risk. Score the payment instruction before it settles (curl above): passkey proves who agreed, the gate scores whether the agreement was wise. Log instruction, authority, score, band, outcome — append-only, which is what the banks' Sept 22 report actually demanded.

Honest caveats

Our decider is local-heuristic-v1, calibrated=false (typesafe_wired=false) — tonight's 0.59-ADVISORY on a fully-authenticated payment shows the scorer is uncalibrated, not that the instruction was risky. The gate pattern is production-grade; the scoring quality is the work in progress.
The wire shape is illustrated from a community POC (diegopacheco/ai-playground), not Visa's official spec — Visa's own reference implementation details were not independently verifiable tonight.
The France payment is a pilot — one completed transaction, "tightly controlled." Consumer-wide rollout timing is unannounced.
TAP is Visa-run and Visa-governed ("open framework built on existing web infrastructure" is Visa's framing). The open-seo/x402 side of the house has neutral governance; the card side does not.
Visa accepts agent payments over TAP, MPP, ACP, and UCP — multi-protocol support is the honest reality, and "the one winning rail" narratives are premature.

Sources: businesswire.com (Cleverbridge announcement, Sept 24, 2026, 8:00 AM EDT); crowdfundinsider.com (pilot detail, Sept 7, 2026 announcement); elogi.co "Agentic Payments in 2026: Anthropic, Visa and Mastercard" (Sept 13, 2026); techtimes.com (Visa Payment Passkey at five India state banks, Sept 19, 2026); github.com/diegopacheco/ai-playground pocs/agent-buyer-tap (RFC 9421 wire shape, community POC, updated Sept 23, 2026); live gate receipts at scriptmasterlabs.com/api/harness/decide + /status (~20:18 EDT Sept 26, 2026).

SCRIPTMASTERLABS · THE X402 / MCP / AI-AGENT PEDIA