Who carries the loss

In the space of a month the rails for software that buys on our behalf went from pilot to product. On 8 September Stripe said Meta's Muse agent could check out with Link, Stripe's wallet, at the more than one million businesses that accept it, and that elsewhere Link issues the agent a single-use virtual card scoped to the purchase the consumer approved. On 30 September Mastercard expanded Agent Pay with a score, now in testing in the US, estimating how likely it is that a transaction was started by an AI agent. On 5 October TikTok announced a conversational Shopping Assistant and Buy Direct, a one-click checkout inside the app, built with Salesforce, Shopify, Shoplazza and Stripe. TikTok called them the starting point of its agentic commerce experiences and gave no markets or dates.

The rail is built. What is missing is the contract that says who pays when the agent gets it wrong, and whoever can carry that risk will be paid for it.

Between those launches came two signs that the plumbing is ahead of the contract. Around 21 September Amazon began blocking Muse from completing purchases on its store; Adweek reported Amazon's position that it was neither told nor asked, and that the agent captured customer credentials without identifying itself as an agent. On 22 September six banks, ING, ASB, Bank of America, Capital One, Commonwealth Bank of Australia and NatWest, published shared principles for trusted agentic commerce, organised around transparency, safety, privacy, customer choice and interoperability. The principles are voluntary.

Then the question was asked out loud by someone whose job is the payment system. Speaking at Sibos on 29 September, Federal Reserve Governor Christopher Waller separated agent-assisted commerce, where the buyer remains in control, from agent-delegated commerce, where the buyer grants an agent authority to shop and pay. He named trust as the biggest barrier to scaling it and put the problem plainly: who is on the hook if an agent makes the wrong purchase? He added that fraud systems calibrated to human behavior may not translate to agents, and that the task becomes proving an agent has the authority to pay on the buyer's behalf. He did not prescribe an answer.

The dispute system was built around one question: did the cardholder authorise this? Delegation is precisely what makes that question hard. The buyer authorised the agent. Did they authorise this flight, this size, this merchant, this total? Until someone can answer that from evidence, every party has a reason to push the loss onto someone else.

Read the launches with that in mind and each one is a perimeter. Stripe keeps the consumer's approval in the chat and the card number out of the agent's hands. TikTok keeps the checkout inside its own app. Amazon keeps the agent out. Each platform is limiting what it can be blamed for, because nothing yet allocates the blame.

Mastercard's release shows what the answer will be built from. The score is for issuers, and its stated purpose is to let them approve legitimate agent-led purchases. Mastercard says it will add signals on behavior, merchant risk, transaction patterns, credential risk and consumer propensity over time, and it names two partners: Cloudflare, for what agents do on the web, and Skyfire, for Know Your Agent identity and verification. That is an underwriting stack. Someone is pricing the probability that an agent was who it claimed to be and did what it was told.