AI agents are moving beyond answering questions and recommending products. They can already search for items, compare options, interact with merchants and, in some cases, complete purchases on a user's behalf.
That creates a problem payment systems were not originally designed for: how does a merchant know that an AI agent is actually authorized to make a particular payment?
This is becoming an infrastructure problem, not just an AI problem.
In September 2026, Ant International, Mastercard and Visa announced that they had started working on a shared Know Your Agent (KYA) interoperability framework. The goal is to help payment networks, wallets, agent platforms and marketplaces identify and verify AI agents while allowing each participant to maintain its own risk and approval processes.
The interesting part is not the name KYA. It is the trust layer that has to sit between an AI agent and a financial transaction.
The payment flow is changing
A conventional online purchase is relatively straightforward:
User → Merchant → Payment Provider → Bank/Card Network
An agentic transaction adds another layer:
User → AI Agent → Merchant → Payment Infrastructure
The agent may be acting on the user's behalf, but the merchant still needs to understand what that authority actually means.
Suppose a user tells an agent:
Find a laptop under $1,500 with at least 16GB of RAM and buy it if you find a suitable one.
The agent has to search, compare products, choose an option and potentially complete the purchase without asking the user to approve every step.
The payment system needs more than an answer to “Is this a real agent?”
It needs to know who authorized it, what it was authorized to do and whether the final transaction stays within those limits.
Identity is only the first layer
Visa, Mastercard and Ant International already have technologies aimed at different parts of this problem.
Visa's Trusted Agent Protocol is designed to help merchants verify AI agents and establish the context of their requests.
Mastercard has been developing Verifiable Intent, which focuses on verifying that an agent's action corresponds to an instruction authorized by the user.
Ant International has developed its own Agentic Mobile Protocol for transactions involving digital wallets.
The new KYA initiative is therefore not simply about creating another payment method. It is about making different agent ecosystems work together.
That interoperability could become important for developers. If every payment network, wallet and marketplace uses a different system for agent identity and authorization, developers could end up maintaining another fragmented set of integrations.
A common set of trust signals could reduce that complexity while allowing individual networks to keep their own risk controls.
Authentication does not mean authorization
This is where the architecture gets more interesting.
Imagine an agent is successfully authenticated. The payment system knows which agent it is and who operates it.
That still does not answer the most important question:
What is the agent actually allowed to do?
A useful way to think about the problem is to separate four layers:
Agent Identity
↓
User Authorization
↓
Transaction Intent
↓
Execution + Monitoring
Each layer answers a different question.
Identity: Who is this agent?
Authorization: Which user or organization delegated authority to it?
Intent: What action was the agent authorized to perform?
Execution: Did the final transaction stay within those limits?
This separation matters because a legitimate agent can still make an unauthorized transaction.
For example, an agent might have permission to spend up to $1,500 but attempt to complete a $1,900 purchase after the final price changes.
The identity check would pass. The authorization check should not.
Spending permissions may become part of the API
For developers, this could eventually mean that an AI agent's payment credentials look less like a traditional card number and more like a set of constrained permissions.
Conceptually:
Agent: shopping-agent-42
User: verified-user
Maximum transaction: $1,500
Allowed category: Electronics
Allowed merchants: Approved merchants
Expiration: 24 hours
Additional approval: Required above limit
The exact implementation will vary by payment network, and the KYA framework is still being developed. There is no universal schema that developers can simply implement today.
But the underlying design problem is already clear.
Agents need enough authority to be useful without receiving unrestricted access to a user's money.
The same problem is appearing elsewhere
This is not limited to Visa and Mastercard.
India's National Payments Corporation is reportedly developing a registry for AI agents that will make transactions through UPI. The initial focus is on frequent, relatively small payments, with more complex use cases potentially coming later.
The direction is becoming clear: once an AI system can initiate financial transactions without a user manually approving every step, agent identity and delegated authority become part of payment infrastructure.
That also changes the security model.
A compromised card is one problem. A compromised agent with permission to make hundreds of transactions could be a very different one.
What happens when the agent gets it wrong?
This may be the hardest part of the problem.
Authentication and authorization can be implemented as technical mechanisms. Liability is harder.
Imagine an agent follows a user's instruction but misunderstands the product. Or a merchant's page contains content designed to manipulate the agent. Or the agent makes a purchase after its authorization should have expired.
Who is responsible?
The user?
The agent provider?
The merchant?
The payment network?
The answer will influence how these systems are designed.
There are other open questions too: how quickly permissions can be revoked, how transactions are audited, what information merchants actually need to see and how privacy is maintained when several systems exchange identity and authorization data.
These issues become more serious when agents operate at machine speed.
A human might notice a suspicious purchase after one transaction. An automated system could repeat the same mistake many times before anyone intervenes.
The next payment layer may be a trust layer
Payment infrastructure is starting to account for an actor that is neither a traditional customer nor simply a machine.
An AI agent represents a person or business, interprets their instructions and takes actions on their behalf.
Payment systems therefore need to establish more than whether a transaction is technically valid.
They need to establish whether the agent had the right to make it.
That is why KYA is worth watching. The framework is still being developed, and there is no universal standard yet. But the direction is clear: agent identity, authorization, intent, permissions and auditability are becoming part of the conversation as AI moves from recommending actions to executing them.
The difficult part of agentic payments may not be teaching AI how to transact.
It may be building systems that can prove when it should.
