By the time an agent pays, every decision that mattered has already been made. The payment is the most visible agentic binding — and the most misread. The industry consolidated the rail and called it solved. But the rail was the part that could be handed to you. What an agent may commit you to is the part that can’t.
The two essays before this one were about arrival — the buyer sending software ahead of themselves, and what it takes to know that software when it shows up and rebuild the journey around it. This one is about the moment the arrival starts to cost you something: the moment money moves.
It is the most concrete thing an agent will ever do to your business, and it stopped being hypothetical a while ago. An agent can hold a scoped credential and complete a purchase with no human anywhere near the checkout. Stripe, with OpenAI and Meta, shipped the Agentic Commerce Protocol and a payment token built for it: scoped to one merchant, capped, revocable, carrying the buyer’s permission without ever exposing the card. Visa issues a verified identity for the agent itself. Mastercard binds a token to a specific agent under a specific consent policy. Google’s AP2 records the purchase as three signed mandates — intent, cart, charge, each one a credential the user’s key signs. All of it clears under cryptographic authority, which is the part everyone notices.
shipping / converging / solvedopen — no shipped protocol
A human hands over a card; an agent hands over a scoped, revocable credential — and by settlement, the person isn’t in the loop either way. Three of the four Know Your Agent questions are converging under a standards body. The fourth — how far authority travels once it’s delegated again — has no shipped answer.
So it is tempting to file agentic payments under solved — the networks have this one — and move on. That reading is accurate as far as it goes, and it is the same trap the identity story set: the rail is real, and it is also the part of all this that was always going to be handed to you rather than built by you.
The rail consolidated faster than anyone expected
Through 2025 the payment layer looked like a standards war — Stripe’s protocol, Google’s, Visa’s, Mastercard’s, each staking a claim to how an agent pays. By the middle of 2026 it had done the opposite of fragmenting. Google donated AP2 to the FIDO Alliance — the body that standardized the passkey — to keep it neutral and community-governed. Mastercard contributed its Verifiable Intent framework alongside it. Visa and Mastercard now co-chair FIDO’s payments working group; OpenAI took a seat on the board. The grammar for who authorized this charge, for how much, at which merchant is converging into one place.
That consolidation is good news, and it is easy to misread as good news for you in particular. It is not. When a capability converges into a standards body and ships through every processor, it stops being a differentiator and becomes plumbing — the kind of thing you buy one integration deep, the way you buy TLS, and then stop thinking about. The single-hop payment binding — this agent, this buyer, this cap, this merchant — is being solved for you and commoditized in the same motion, which is simply what infrastructure does as it matures: it settles into the wall, and stops being anything you can build a position on.
The volume, to be clear, is not here yet. Agent-initiated purchases are still a low-single-digit share of commerce, and any pitch that inflates that number gets caught the moment a skeptical reader checks it — the honest sell is the slope, not the level. The discipline is the one that governs the rest of this work: build for where the curve is heading, and commit to a vendor only once the standard lands. For the payment rail, it largely has — which is the whole reason it is the wrong place to go looking for an edge.
The slope, not the level
low single digitsShare of commerce initiated by AI agents today. The exposure is not the current volume — it is the rate of change, and the fact that the controls built to keep automation out now sit in front of the customer.
~$8TAgent-mediated commerce projected by 2030 (ARK Invest), against global ecommerce projected at $73.5T with AI named the dominant growth driver (PwC & Stripe). The direction is the point, not the decimal.
The consolidation does not reach the part that matters most. A payment is only one kind of binding, and it is the one carrying the most infrastructure precisely because it is the easiest to standardize — a bounded amount, a named merchant, a moment of settlement where a network can stand in the middle and make it safe. An agent does more than pay. It accepts terms, it places orders that commit you to fulfil, it agrees to renewals and SLAs and return policies, and it takes on financing that can outlast the purchase by years. Those are bindings too, and most of them move something heavier than money. Obligation has no settlement moment: nothing clears, nothing gets revoked with a webhook, and no processor is standing in the middle of it when it goes wrong.
The charge — handed to you
Who authorized it, for how much, at which merchant — scoped, tokenized, revocable, settled. This is what the networks solved and the standards bodies now govern. Procure it through a FIDO-compliant processor and stop building it; it is a utility now, and priced like one.
The commitment — yours
An agent accepting terms, placing a binding order, agreeing to a renewal. No token caps an obligation. The consent policy that governs a charge says nothing about what your business just promised to deliver — and no processor stands behind that promise.
The financing — yours, and it outlives the sale
Credit extended to, or through, an agent is a binding that persists long after the agent is gone. The rail settles the transaction in a moment; it does not carry the years of obligation that follow. This is the binding with the longest tail and the least standardization — which is to say, the most exposure.
The delegation — open
When the agent that bound you hands its authority to another agent downstream, the token’s anchor stretches and no shipped standard proves who, four hops deep, actually stood behind the commitment. The same seam the identity essay ended on — now with money and obligation riding across it.
The map, then, runs opposite to the headline. The payment — the thing that looks like the hard part because it moves money — is the solved part, while the commitment and the financing, which look like mere paperwork, are where the exposure actually lives, because nothing standardizes them and no token bounds them. The layer with the most infrastructure is the one you can most afford to stop worrying about; the layer with the least is the one that eventually surfaces in a deposition.
the rail settlesyours, and it lasts
The binding spectrum. Teal is the part that clears and is handed to you; gold is the part that persists and stays your obligation. The consolidation solved the left end. It left you the right.
The binding was decided before the money moved
Which is why the money moves last. By the time a dollar settles, the agent has already been admitted, trusted, and permitted to bind you — or it has not, and the charge is only the visible end of a decision made far upstream, or never made at all. Wait until the payment to ask what an agent may commit you to, and you are asking at the one moment the answer can no longer change.
Bolt agent-payment acceptance onto a journey built for a human and you get what detection-without-redesign gets you everywhere else — a credentialed mistake no one can refuse, executed at speed. The token clears, the obligation lands, and the first time anyone asks whether your business meant to take it on, the answer sits in a log rather than a design. That is the failure The Back of the Watch is about: a system that can finally see the agent, and does the old human thing to it anyway, only faster.
Own the binding, rent the rail
The posture is the one this whole surface has been driving toward, now at the point where it turns concrete. Rent the rail: the payment layer is plumbing, so buy it a single integration deep and stop mistaking it for strategy. Own the binding — the harder, less legible thing — the decision of what an agent may commit your business to, where a human has to re-enter to re-anchor an authority that has stretched too far downstream, and what your systems can actually stop in flight rather than reconcile after the fact. None of that is a payments integration; it is a question of authority, and it is the one part of this that no processor can sell you.
It falls across the three dimensions the way everything here does. Human: who is accountable when an agent commits the business to something it should not have. Organization: whether there is any point, between discovery and settlement, where someone checks what an agent is binding you to — and often there is not one. Technology: whether your systems can refuse a commitment in flight, or can only report it once it has cleared. A payment rail answers none of these, and was never built to.
The networks solved the payment because the payment was solvable — bounded, nameable, and settleable. What they left you is the part that is none of those things, and it was always yours anyway: deciding what your business will let an agent become on its behalf, and building the journey so that decision gets made deliberately, upstream, before any money moves. Own your source, and own the terms it lets an agent bind you to. The charge is the smallest thing an agent does to you; it only looks like the largest because it is the one you were already watching for.
The money moves last. The binding moves first — and by the time you can see the charge, the only question left is whether you decided the commitment or inherited it.
A payment rail is a utility you can buy one integration deep. What an agent may commit your business to — the order it places, the terms it accepts, the financing it takes on and leaves behind — was never a technical integration, and no processor will ever sell it to you. It is the older, harder question of what your business will put its name behind, and an agent holding a scoped token is only the newest thing to ask it.
This is Part III of The agent surface. Part I — The Primary Consumer Is Now an Agent — named the shift; Part II — Do You Know Who Is Using Your Product? — built the identity and the journey around it, and named the four questions the shipped standards converge on. On what happens when acceptance is bolted onto a system that never decided what an agent may be: The Back of the Watch. On where what an agent may propose meets what the organization will permit: the seam.
Stripe, “Introducing our agentic commerce solutions,” Oct 2025 — the Agentic Commerce Protocol (with OpenAI, later Meta) and Shared Payment Tokens: a payment primitive scoped to a business, capped, revocable, and monitored, that passes a buyer’s permission without exposing credentials. stripe.com
Google, “Announcing the Agent Payments Protocol (AP2),” Sept 2025 — every agent purchase recorded as three signed mandates (intent, cart, payment) carried as verifiable credentials; v0.2 (2026) adds “Human Not Present” autonomous payments. cloud.google.com
FIDO Alliance, agentic authentication and commerce standards, Apr 2026 — Google donates AP2; Mastercard contributes its Verifiable Intent framework; the Payments Technical Working Group is co-chaired by Mastercard and Visa; OpenAI joins the board. The authorization grammar consolidates into a neutral standards body. fidoalliance.org
The four Know Your Agent questions — who the agent is, who authorized it, what it may do, and how far the authority travels — and the delegation hop where the shipped standards stop, are worked out in Do You Know Who Is Using Your Product?
ARK Invest, projection that AI-agent-mediated commerce could reach roughly $8T by 2030, reported 2026. Cited for direction, not precision.
PwC & Stripe, agentic commerce collaboration, 2026 — global ecommerce projected to reach $73.5T by 2030 with AI as the dominant growth driver. pwc.com