Agentic Commerce & Payments — Deep Dive

Executive summary

Agentic payments have converged on one architecture: the agent never holds a real credential, a human signs intent once, and something downstream enforces that intent before money moves. The fight is over who holds the intent and who enforces it — the network, the wallet, the issuer, or a new buyer-side layer.

• Networks own the credential and the dispute record. Visa Intelligent Commerce binds a passkey-signed purchase instruction (up to 10 mandates, amount ceilings, merchant name, expiry) to an agentic network token, and only releases a one-time cryptogram that fits it. Mastercard Agent Pay pairs Agentic Tokens with Verifiable Intent, an SD-JWT delegation chain co-developed with Google.
• Wallets own the approval surface. Stripe’s Link Agent Wallet turns each purchase into a spend request the user approves in the Link app (30-minute window), then mints a one-time virtual card, a Shared Payment Token or a Link Pay Token. Link balance adds a stablecoin-backed, per-purchase-limited card for unattended spend.
• Issuers own enforcement at authorization. Rain’s Agent Control Layer and scoped cards encode intent as card controls (amount, merchant/MCC allowlists, interval, expiry) enforced before any money moves; Agentcard and Sponge issue on Rain, settled in USDC.
• Startups own coverage and semantics. Agentcard Vault, AgentVault (Self) and Crossmint swap real credentials in at checkout so the agent only sees placeholders; OpenCommerce sells a single buy endpoint across 5,026 monitored stores; delta checks the proposed action against the signed mandate and returns allow/block/escalate with a receipt.
• Identity is splitting in two. Network registries (Visa VARS, Mastercard agent registration) verify the agent; KYA layers like Baselayer and Self Agent ID verify the human or business behind it, scoped per site.

The core gap: every enforcement point that sits on card rails sees amount, merchant and MCC — none sees the SKU, the terms or whether the cart matches the request. Visa’s own benchmark (Nov 5, 2026) found 54% of failed shopping runs still ended in a purchase. That gap is where the next moats form: semantic mandate enforcement, signed cart evidence for disputes, and approval UX that scales from per-purchase to standing budgets.

Updated Nov 9 with Vignesh’s “Agentic commerce is at an impasse” and your posts on VCNs vs. tokenized cards and agent authority. The framing they add: whoever wins the intent and approval layer owns the customer — and today no participant has a reason to build it alone.

The stack at a glance

[embedded content: agentic commerce stack · 7 layers, 30 players]

Read top to bottom: the agent decides, a protocol carries the cart, a wallet or vault holds the credential and collects approval, an issuer and network authorize, and funds settle on cards, bank or stablecoins. The highlighted layer — who the principal is and what they allowed — is the one no single company owns yet.

Part A — Who builds what

Twelve categories, ranked from the rails up. The pattern: the closer a player sits to the authorization message, the stronger its moat and the slower it ships; the closer to the agent, the faster it ships and the more it depends on someone else’s rails.

Agentic Payments Alliance members worth a closer look. Rain launched the APA on Aug 18, 2026 with 26 founding members. Beyond Visa, Mastercard and Rain, five map onto gaps in this report:

• delta Network — the only member building buyer-side semantic enforcement (covered below).
• Basis Theory — PCI vault that also leads its own 20+ member Agentic Commerce Consortium and backs Crossmint’s agentic cards.
• PayOS — ran the first live Mastercard Agentic Token transaction (Sept 2025); an enabler for issuers.
• Sardine — fraud/KYA layer; its 2026 whitepaper frames Know Your Agent as a new risk layer between KYC and decisioning.
• Turnkey / Fireblocks / Crossmint — key custody for agent wallets, the stablecoin-side equivalent of a token vault.

The rest — Avalanche, Solana, Monad, Rialo, Uniswap Labs, Circle, Chainalysis, Coinflow, Episode Six, Evertec, Fiserv, Kala, Lithic, Remitly, Shift4, Yuno — are rails, chains or processors rather than agent-specific products.

PSP agent toolkits: Stripe and PayPal

Both toolkits are merchant-side: they let an agent operate a business’s own payments account (orders, refunds, invoices, disputes), not spend a consumer’s money. That makes them a distinct category — agent as operator — sitting beside the buyer-side wallets above. Their consumer-spend products are separate: Stripe’s Link Agent Wallet, and PayPal’s Agent Ready.

Moat. Merchant distribution and processing data. Each toolkit makes the PSP the default system an agent operates, so switching PSPs also means rewiring the agent.

PMF. Clearest in SMB back office — invoicing, reconciliation, refunds, subscription changes, dispute triage. These are repetitive, bounded tasks where the merchant is both principal and beneficiary.

Risk to watch. Several tools move money out of the merchant: create_refund, accept_dispute_claim, cancel_subscription. Today the only intent control is which actions are switched on. There is no per-action amount limit or approval step, so this is where the mandate-enforcement ideas from the deep dive below apply to the sell side.

Part B — The five stages, solution by solution

Every solution makes the same five decisions; they differ mainly in where intent lives (column 3) and what proves the human said yes (column 4).

What the matrix shows

1. Enrollment splits into tokenize-the-existing-card (Visa, Mastercard, Crossmint), vault-the-real-card (Agentcard Vault, AgentVault) and issue-a-new-card (Rain, Agentcard Issuing, Link balance). Agentcard says network tokenization worked for only about 8% of the cards it tried; that is a competitor’s figure, but it explains why vaults exist.
2. Identity is two different questions. Networks verify the agent software; KYA vendors verify the principal. Nobody yet binds both into one object that an issuer reads at authorization.
3. Intent ranges from implicit (the cart at the moment of checkout) to an explicit, signed, constrained object (Visa instruction, AP2 Intent Mandate, Verifiable Intent).
4. Authentication has converged on passkeys for the human. The real difference is cadence: per purchase (Link default, Agentcard) versus once per budget (Rain, Crossmint, Link balance).
5. Checkout is where reliability lives. The protocol path (UCP, ACP, Link Pay Token) is clean but merchant-limited; the browser-interception path (Agentcard, AgentVault) covers more merchants but fights bot detection and merchant blocking.

Deep dive: how intent is captured and agent purchases are approved

Intent is handled in one of five ways, and each trades autonomy against how much the check before payment actually understands. Card rails can enforce amount, merchant and category with certainty; only a human, a signed cart or a semantic checker can confirm what was bought.

1. Implicit intent — the human approves the cart. Link’s spend request carries amount, merchant, line items and a ≥100-character context the user reads before approving in the Link app; approval expires after 30 minutes and any amount increase needs re-approval. Agentcard intercepts the processor call and sends a push or iMessage approval with Face ID. Shopify’s WebMCP waits for buyer authorization before complete_checkout. Safe, auditable — and no more autonomous than a human tap.

2. Intent as card controls — the budget is the credential. Rain’s Agent Control Layer sets amount, merchant/category allowlists, spend interval and expiry at issuance; outside them the card does not transact, and changing terms needs a human admin. Agentcard Issuing, AgentVault caps and Link balance’s per-purchase limit work the same way. Fully autonomous within bounds, but blind to the SKU.

3. Intent held by the network — Visa’s purchase instruction.

[embedded content: Visa Intelligent Commerce · 6 steps, 1 decision]

The instruction is the agreed intent between consumer and agent; mandates inside it set the decline threshold and expiry. Visa sums every transaction on the instruction against the threshold, checks the merchant name against any preferred merchant, and enforces recurring frequency (yearly capped at 5 years). There is no edit endpoint: a new product or budget means cancel and re-sign. Visa distinguishes three purchase types — human-in-the-loop, autonomous one-time and autonomous recurring — and requires instructions and signals for all three as dispute evidence.

4. Intent as a portable signed chain — AP2 and Verifiable Intent. AP2 splits intent into an Intent Mandate (rules for human-not-present tasks), a Cart Mandate (the exact basket, merchant-signed first) and a Payment Mandate (tells the network an agent was involved, with a present/not-present flag). Mastercard’s Verifiable Intent binds identity, instructions and outcome into an SD-JWT chain; merchants see enough to confirm authorization but not the consumer’s other constraints or remaining budget. The intent travels with the transaction instead of living in one company’s database.

5. Intent enforced semantically — delta. The platform sends the mandate, the proposed action and evidence (page, invoice, itinerary); delta returns allow, block, escalate or insufficient evidence plus a signed receipt, before funds are released on any rail. Its Mandate Guarantee offers bounded recourse when an allowed payment should have been blocked. delta has moved a long way from Variant’s 2024 seed thesis of a ZK “network of networks”, though that thesis already required domains to prove transactions complied with an account’s spending permissions.

[embedded content: intent models · autonomy vs. depth of check]

As products move right — from per-purchase taps to standing mandates — the check slides down to what card rails can see. Visa’s benchmark makes the cost concrete: 54% of failed runs still ended in a purchase. Whoever fills the top-right box with something issuers accept as dispute evidence owns the trust layer.

Why the top-right box matters: a payment can succeed and still be wrong. Vignesh’s example: the agent books a $580 hotel against a $600, two-night, refundable-until-the-day-before request — and picks the nonrefundable rate. Card valid, merchant real, amount in budget, purchase wrong. It fails in one of two ways:

1. Intent captured wrongly or incompletely — the natural-language request loses a material condition (refundability, delivery date, acceptable substitutes) when it becomes explicit requirements. Intent has no standard shape; each network defines its own.
2. The agent deviates from captured intent — hallucination, stale data, lost context, misread checkout options, prompt injection or a checkout bug.

Even a perfect agent doesn’t fix the ecosystem problem: if nobody else can see the intent, merchants can’t tell a legitimate agent from a bad actor and issuers can’t verify a dispute claim either way. The cost of getting it wrong is steep — Vignesh cites a YouGov survey where 60% of UK adults would stop using a shopping agent after one mistake, and an NMI survey where 70% of US adults want to review or override AI purchase decisions and only 10% would give AI full control.

What agent authority should look like (from your post): approvals and limits can’t live inside the harness or the model. They should be

• deterministic — the same request and mandate always produce the same allow or block;
• enforced automatically and programmatically — by rails (the agent’s own card), wallets (a balance with limits) or smart-contract policy (hard onchain limits), not by the agent’s judgment;
• sufficient to go from verifiable intent to paid — no gap where a signed intent still needs a human to bridge it to payment.

The missing piece is a standard that tracks state — what has been spent against a mandate, which conditions have been met, what is still open — across rails and participants. Visa’s instruction does this for amounts inside its own network; delta does it per decision; nothing does it portably. Limits and approvals are necessary, but the human taste and trust part (three rooms instead of an apartment, a layover in Riyadh instead of Dubai) is the hard part. That’s why your post argues it starts in corporate spend: predefined budgets, time limits, verified merchants, objective brand rules, restocks at MSRP — or in a truly personalized finance app.

How approval is actually collected today

• Passkeys / FIDO2 — Visa Payment Passkey, Mastercard Payment Passkeys, Link (passkey, Face ID, Touch ID), Agentcard (Face ID).
• In-chat approval — Agentcard via Linq iMessage bubbles; Crossmint links on iMessage, WhatsApp and Instagram to a page the platform hosts.
• Voice — Agentcard Voice (early access) reads back the merchant, amount and a one-time word.
• Threshold auto-approve — Agentcard lets users auto-approve under a chosen amount (e.g. $50); Link balance spends without a prompt inside its per-purchase cap.
• Issuer step-up — 3DS still fires when the bank requires it (Link surfaces it as three_d_secure, auto-resuming); Visa uses Payment Passkeys for SCA in Europe.

Funding: Visa’s wallet rules versus Link’s virtual cards

How an agent wallet is funded decides who the merchant of record is, whose name is on the statement, who handles disputes and whether points survive. Visa’s digital wallet guide (Oct 2024) sorts every wallet into three types, and each agent product maps onto one.

Page 14 is the constraint that matters. Visa prohibits card fronting: linking two credentials so a front card with insufficient funds is funded live by another card in the same transaction. A prefunded front card is a permitted “good funds” model. That single rule explains the product shapes:

• Pass-through products avoid the issue by never issuing a second card; the user’s own card (or its network token) is what the merchant charges. This is why Agentcard pitches Vault on retained points and issuer disputes.
• Stablecoin issuers sit squarely on the good-funds side. Agentcard states funds must already be in the card wallet and it does not do just-in-time authorization from a stablecoin balance. Rain enforces controls at issuance and before money moves.
• Link’s per-purchase virtual card is the case to watch. A one-time card paid from a separate saved card is the fronted pattern Visa restricts. Mastercard’s CEO has since said VCN fronting is a bridge it won’t support long term, so treat it as tolerated, not endorsed (see the two-teams section below).

Link balance is Stripe’s good-funds answer. Per Stripe’s own description, as reported on Oct 27, 2026, a debit card top-up is converted by Stripe Crypto Onramp into a dollar stablecoin on Tempo, held in a Privy-powered non-custodial wallet, capped per purchase by Link Agent Wallet, and spent through a Stripe Issuing virtual debit card. Reporting names Lead Bank as issuer, USDC as the held asset and a US$150 cap per top-up link. The merchant sees an ordinary debit card; the user sees dollars.

That makes Link the only player running both models: pass-through-like per-purchase cards for supervised checkout, and a stored-value stablecoin balance for unattended spend. Link’s API also exposes the enforcement state directly — agent_wallet_spend_limits returns per-transaction, daily and 30-day limits with used and remaining amounts — so an agent can check headroom before asking the user.

Agentcard’s critique of Link (one-time cards lose points, disputes route through Stripe, recurring breaks) is partly dated: Link’s docs now support recurring virtual cards with a per-period limit.

Cards for agents vs. agents for cards: the two teams

Wallets are choosing one-time virtual cards (VCNs) because they work today. Networks are pushing tokenized versions of the card you already hold because that keeps the issuer in the loop. On the Q3 2026 earnings call, Mastercard’s CEO said VCN fronting is a bridge, not a long-term solution Mastercard will support.

Figures and the Link terms reading are from Vignesh’s Agentic commerce is at an impasse.

What this changes in the report

• The card-fronting question is mostly answered. Visa’s rule and Mastercard’s public stance both say per-purchase VCNs funded from another card are tolerated, not endorsed. Link balance (prefunded, KYC’d, prepaid card from Lead Bank) is Stripe’s compliant hedge — but it moves agent risk onto the consumer, and Vignesh notes the balance is not FDIC-insured.
• Tokens are losing on reliability, not design. Per Vignesh, every major agent platform has a passkey waiver, which removes the one step where the cardholder proves they authorized the instruction — exactly the signal issuers need. Crossmint reports Mastercard provisioning and authorization rates as much better than Visa’s, especially for Chase and commercial cards, and improving over the last two to three months.
• The broken UX is real. In your post: Scott Wessman’s Muse checkout charged his Amex through Link, Best Buy received a one-time card and then asked for a CVV he never saw, while Muse reported the order done.
• A third path is raw-card autofill. Instinct and Hark vault the real PAN and CVV and inject them; Grok Bot accepts a photo of your card. PCI DSS prohibits retaining CVV for future purchases, so this sits in a gray area. Agentcard’s passkey-encrypted vault is the compliant version of the same idea.
• Crossmint’s hybrid checks token eligibility (VIC, Agent Pay, ACE) at enrollment and otherwise falls back to PAN passthrough, encrypted to a key held by the agent’s browser and decrypted locally at checkout. It chose not to issue VCNs after the networks told it they won’t be allowed long term.
• Stripe’s endgame is a closed loop. With 350M+ Link users on one side and Stripe merchants on the other, a Link balance on Tempo can pay a Stripe merchant over MPP with no card network in the path. (Vignesh’s figure; earlier Stripe coverage cited 250M+ Link users.)
• Neobanks want to be the approval surface. OnePay, Tuyo and Oobit issue the agent its own card to keep users spending inside their programs and earn the interchange.

Your take: whoever wins the intent and approval layer owns the customer.

Moats, product–market fit and open questions

The durable moats sit at the two ends of the stack — the credential (networks, issuers) and the approval surface (wallets with users) — while the middle layers are being standardised away.

Where PMF is clearest now

• B2B and team spend — procurement, SaaS, ads, travel. Budgets already exist, policies are explicit, and Mercury, Ramp and Pool can attach an agent to an existing account.
• Supervised consumer checkout — per-purchase approval in an assistant (Link, Agentcard). It works today but caps autonomy at the speed of a human tap.
• Machine-to-machine micropayments — x402 and MPP for APIs and compute, where cards don’t fit the unit economics.

Where PMF is still unproven: fully unattended consumer purchases. Visa’s Trust Index (Sept 2026) found 72% of US consumers had used an AI assistant but only 23% trusted AI to handle payments; Visa’s benchmark found models passed 57.2% of shopping runs and that all three attempts passed only 34.2% of the time.

The impasse. Vignesh’s core argument: commerce is a multi-party risk network where merchants and issuers hold a veto, and today every participant’s incentive points somewhere different.

Vignesh’s proposed tiebreaker is the issuer. Citing Nikil Konduru, he argues issuers alone hold the full bundle to own an agent’s mistakes: interchange to fund the premium, underwriting, the funding credential and a disputes operation. They could make purchase protection conditional on the agent submitting intent before authorization. The catch: issuers move slowly and would need the top five to act together before the standards set without them.

Where your view and Vignesh’s converge: scale needs every participant paid, and the intent-and-approval layer is the one place all six rows meet. Where they differ: he looks to issuers to own it; your post points to corporate spend and personal finance apps (neobanks) as the first place it works.

Open questions to track

1. Liability for a correctly authorised wrong purchase. A transaction can satisfy the mandate’s amount and merchant yet buy the wrong item (the nonrefundable hotel). Today Link’s terms put it on the consumer. Will it move to issuers (Vignesh’s bet), wallets, agent platforms, or a guarantor like delta?
2. Dispute evidence. Visa requires instructions and signals “to evidence” agentic transactions; Verifiable Intent and AP2 carry signed carts. Which record will issuers and new reason codes accept first?
3. Stablecoin settlement vs card front. Stablecoins are winning the funding leg (Link balance, Rain, Agentcard) while the card stays the acceptance leg. Does that hold, or do x402 merchants pull settlement onchain?
4. One object for agent + principal + intent. Today these live in three systems (VARS or Agent Pay registry, a KYA credential, a mandate). The first standard to bind them at authorization becomes the trust layer.

Sources

Primary pages opened:

• Visa Intelligent Commerce — Getting Started and Concepts
• Visa — Digital Wallets in Visa’s Ecosystem (Oct 2024)
• Rain — Introducing the Agent Control Layer
• Rain — Agentic Payments Alliance launch (Aug 18, 2026)
• Agentcard and OpenCommerce
• AgentVault and Self
• Baselayer — Meet Baselayer and KYA Basics
• Crossmint — Agentic Payments
• delta and Variant — Investing in delta (Oct 2024)
• Pool
• Link — Agents, Stripe — Link Agent Wallet, Stripe — Enable agents to spend
• TechCrunch — Shopify opens checkout to browser-based AI agents (Sept 28, 2026)
• Digital Commerce 360 — Shopify and Google’s Universal Commerce Protocol (Jan 12, 2026)

Added Nov 7, 2026: Stripe — Agents and AI on Stripe, Stripe — How agents work with Stripe, PayPal — Agent Toolkit; PayPal Agent Ready and Store Sync via the launch release (Oct 28, 2025).

Secondary reporting (search results, not opened in full):

• Visa Agentic Commerce Benchmark coverage — The Paypers, Shop! Association
• Mastercard Verifiable Intent — PYMNTS; Agent Pay review — Nevermined
• Link balance — FourWeekMBA, RuntimeWire
• AP2 mandates — Stellagent; Stripe × OpenAI ACP
• PayOS × Mastercard first agentic token transaction; Basis Theory Agentic Commerce Consortium; Bernstein view via Stellagent digest

Added Nov 9 (text supplied by you): Vignesh (@vigstar1), “Agentic commerce is at an impasse” — source for the VCN economics, Mastercard Q3 2026 earnings remarks, Chase and passkey-waiver claims, Crossmint and YouGov/NMI figures; your posts on agent authority and on one-time vs. tokenized cards (@Macr0Mark). Jas Shah, “Agentic Commerce: 17 Months Later” (Nov 6, 2026), was reviewed but not used. The Visa Payments Frontier page renders client-side; benchmark figures come from press coverage.