AI payment controls decide whether an agent can spend a customer’s money. The payment is only the last step. Before that, an AI agent may search, compare, choose a seller, and start the purchase.
A bank can check the card, account, or phone used to pay. Yet that check cannot prove that the agent followed the customer’s request. As a result, the bank also needs to know which agent acted, what the customer asked, and how much power the agent held.
Four linked layers can provide that proof: identity, intent, permissions, and liability. Together, they form the agentic commerce control stack.
AI agents are entering the payment flow
Six banks set out shared principles for trusted agentic commerce on September 22, 2026. They were ASB Bank, Bank of America, Capital One, Commonwealth Bank of Australia, ING, and NatWest.
The principles cover safety, clear information, privacy and data, customer choice, and systems that work together. The banks also raised hard issues such as agent identity, fraud, customer care, and liability. Next, they plan to publish a paper on how firms can apply the ideas. For now, the principles are voluntary.
One day earlier, Mastercard, Flybits, and Rogers Bank announced a test in Canada. A Flybits assistant followed a cardholder’s request. It found an eligible product within a set budget and paid through Mastercard Agent Pay. The test used checked instructions and preset spending limits.
These examples place the AI agent inside the payment flow. Banks still need their usual AI payment controls and payment checks. In addition, they need a record of why the agent bought an item and whether the purchase matched the customer’s request.
Why normal payment checks fall short
Payment systems tend to check a payer, a payment tool, and a request. Agentic commerce adds choices between the customer and the payment rail.
For example, an agent may misread a preference or use old facts. It may cross a budget to get faster delivery. A seller’s website could even contain content that tricks the agent. In all these cases, the payment tool may be valid while the purchase breaks the customer’s rules.
Authentication asks whether the right payment tool was used. Agent controls ask whether the action stayed within a clear and current mandate. A safe system must answer both questions.
Four layers of AI payment controls
1. Identity: check the customer and the agent
The first layer builds a clear identity chain. It covers the customer, AI agent, agent owner, seller, and payment tool. At checkout, the agent should say that it is acting for someone. The site can then tell it apart from a normal browser visit.
Banks and payment networks also need to check who runs the agent and what it may do. They must know if its access is still valid. In practice, a registry can help with these checks, though a name on a list does not prove that every act is safe.
A sound identity system should support digital proof, version records, clear ownership, and fast shutoff. It should also show whether an agent can only search or can complete a sale.
2. Intent: record the customer’s request
The second layer turns the customer’s request into rules a system can enforce. “Buy me a phone” leaves too much room for guesswork.
A useful mandate can set the purpose, top price, seller or product type, date, and repeat limit. It should say if the agent may suggest, reserve, bargain, or pay. The customer must also be able to change or cancel it.
After a purchase, the system should give the customer a plain receipt. It should show what the agent understood and which rules it used. A new payee, costly purchase, or repeat charge may need a fresh approval. Meanwhile, low-cost and routine buys can use lighter checks when the request is clear.
3. Permissions: limit what the agent can do
Wide access can turn a small mistake into a large loss. Narrow access keeps the risk in check.
A one-use token can limit the price, seller type, place, number of uses, and end date. Data access needs the same care. An agent that buys a rail ticket does not need a customer’s full bank history or investment records.
Banks also need tools to cut, pause, or end access at once. Customers should see a clear stop control and know when a fresh approval is needed. Viewing an account, starting a payment, and changing a regular payment should remain separate rights.
4. Liability: decide who bears the loss
Clear liability will shape public trust. A deal can fail because the agent misread the request, a criminal posed as the customer, a seller gave false facts, or a bank cleared a payment outside the stated limits. Each failure points to a different party and a different control.
The rules should link each failure to the party best able to prevent it. Current rights for an unauthorized payment should still apply when software sits between the customer and seller.
Each provider must keep enough evidence to rebuild the event. The record should include the mandate, agent identity, service version, facts shown to the agent, active limits, approval events, and payment messages. Without this trail, the strongest party may decide who pays.
One control plane must link the four layers
AI payment controls need one shared control plane across the four layers. A bank should watch the agent’s actions, flag a break from the mandate, and mark each AI-led payment in its records.
Customers need clear receipts and an easy way to challenge a result. Service teams need tools to stop an agent, seek a refund, and review an event across several firms. However, human review does not mean that a person must clear each small purchase. It means that customers and staff can understand, stop, and reverse the process when the risk rises.
A bank also keeps its duty when another firm supplies the AI model or service. Because the duty stays with the bank, the Reserve Bank of India has said that outsourcing does not free a bank from its duties. RBI rules also call for oversight of outside service firms and tech risks.
AI payment controls for UPI
Reuters reported on September 10, 2026, that the National Payments Corporation of India was building a registry for AI agents. The report said it would form part of a planned Unified Agentic Protocol. It cited three unnamed sources involved in the talks.
NPCI had not released a public tech plan when this article was prepared. Meanwhile, key questions about loss and liability were open. The registry should therefore be seen as a reported plan, with its final design still unknown.
A registry could give UPI an identity layer for agents. Beyond that, the full system would need a standard mandate, an agent mark on each payment, firm spending and data limits, consent receipts, easy shutoff, dispute rules, and a shared audit trail.
These AI payment controls should work across apps, banks, sellers, and agent firms. If they do not, two people using the same payment rail may get different levels of safety.
UPI must also protect free choice. An agent should reveal any business tie that affects how it ranks a seller, lender, or product. In credit and wealth services, firms must keep payment work apart from advice that falls under financial rules.
FinTech Central’s earlier article on agentic payments and UPI costs asks who may fund these new checks. The India Stack AI framework explains how identity, payments, consent, and open networks can support safe finance.
The next financial interface
The firm that holds the agent’s identity, rights, and customer mandate may gain a strong place in finance. Tech platforms may seek to own the agent while banks supply payment access. Card and payment networks may sell trust, token, and identity services.
Banks can make AI payment controls a trusted service by offering portable rights, strong help during disputes, and a trusted view of agent activity. At the same time, Indian fintech firms can build identity checks, mandate tools, policy engines, alerts, audit tools, and dispute systems. Every agent that can pay will need some of these services.
This market could also become too closed. One agent platform may sit above an open payment rail and steer what customers see. Portable mandates, clear disclosures, and records that move between firms can curb that risk.
What banks and fintech firms can build now
Firms can start work before common standards arrive:
- Map each task where AI can suggest, start, or complete a financial act. Give a named leader charge of each task.
- Write a clear mandate that covers purpose, value, time, seller or product scope, approval rules, and shutoff.
- Keep agent identity apart from customer identity in the payment record and audit trail.
- Use narrow payment tokens and data access, backed by live limits and a customer stop control.
- Design complaint, dispute, and refund steps before launch. State which facts the agent firm, seller, bank, and network must keep.
- Test prompt attacks, old intent, fake agents, clashing requests, and seller tricks along with successful purchases.
These AI payment controls fit the need for ongoing financial AI implementation controls. A team must be able to stop an AI-led task when its behavior changes.
Build the control stack before scale
Agentic commerce can make routine purchases faster and easier. Its growth will depend on the safeguards behind the assistant. Identity shows which agent acted. Intent records the customer’s request.
Permissions set the agent’s limits. Liability decides who bears a loss and which evidence supports that choice. India can use UPI to set common rules at national scale, with a clear path for customers when something goes wrong.