Let’s talk about the fact that Europe’s first live AI-agent payment happened in March, and seven months later you still can’t use it.
Madrid and London, the second of March this year. Banco Santander and Mastercard ran a real payment, end to end, executed by an AI agent, inside a regulated banking framework. Kelly Devine, Mastercard’s president for Europe, said it showed that innovation and trust can advance together. Santander’s own words were more careful. They called it a controlled pilot.
It is still a controlled pilot.
And that is the most interesting sentence in this entire space right now, because the tech works. The money moved. What’s missing isn’t capability. It’s the thing that decides whether a machine is allowed to act on your behalf in the first place, and who gets to hold that answer.
Mastercard’s own read, reported last week, is that the industry is now waiting on a governance model that satisfies both the banks and the regulators. Seven months to build a trust layer around a payment that already worked.
So look at what got built in those seven months, because this is the part almost nobody is tracking.
Mastercard switched on Agent Pay for every issuer in Europe at network level, and launched Agent Pay for Machines with more than thirty partners — Stripe, Adyen, Checkout.com, Coinbase among them. On the thirtieth of September it announced a probability score for AI-initiated transactions, in testing in the US, built with signals from Cloudflare and Know Your Agent verification from Skyfire. Back in April, Google donated its Agent Payments Protocol to the FIDO Alliance, and version 0.2 added “Human Not Present” payments — an agent completing a purchase while you are asleep, against instructions you gave earlier. Verifiable Intent, co-developed with Mastercard, went to FIDO too. And x402, the HTTP-native payment rail, now sits under the Linux Foundation with fifty-seven members, including Visa, Mastercard and American Express.
Four standards bodies. Three card networks. Two cloud companies. Every major model lab. All of them converging on the same primitive, and it’s the right primitive: the mandate. A signed, checkable record of what a human authorised, and for how much, and until when.
That is consent infrastructure. I’ve argued for it for two years. An agent needs scoped authority or you get what happened on Thursday, when banks started deleting software they couldn’t tell apart from their own customers. A login proves someone got in. It says nothing about what they were allowed to do. The mandate is the fix for that.
Here’s where it turns.
Read the question the new score actually answers. Mastercard’s probability score estimates how likely it is that a transaction was initiated by an AI agent. Not whether you authorised it. Whether a machine did it.
Those are different questions, and the second one is the only one that matters to you.
And the company has said it will strengthen the score over time with more intelligence — behaviour, merchant risk, transaction patterns, credential risk, and consumer propensity.
Consumer propensity. Your likelihood of buying. Your own predictability becomes an input into whether your own agent’s purchase is allowed to go through.
Amir Sarhangi at Skyfire called this the missing layer between identity and execution. Fair enough. But notice what becomes load-bearing in that layer. Not your instruction. Your pattern.
The spec is open. Apache 2.0. The governance is industry. And those are not the same thing. Every one of these bodies is funded and chaired by companies that take a percentage of the transaction they are validating. That’s not a conspiracy, it’s just arithmetic. The gatekeeper gets paid per car. When the gate is deciding who may pass, expect the gate to be optimised for throughput, not for you.
Picture a shop.
A woman in Krugersdorp sells mountain-bike parts out of a unit behind her house. In February her payment provider emails to say agent traffic is coming and she should opt into the new checkout, because conversion. She does. By winter, a real slice of her orders arrive with nobody on the other side of them. One comes through wrong — a customer’s agent orders the wrong cassette, twice. She goes to dispute it, and what she’s handed is a mandate she can’t open, held by a company she has no contract with, plus a score saying the transaction was very likely initiated by an agent.
That’s not evidence the customer wanted the cassette. It’s evidence that a robot ordered it. The two are not close.
She isn’t stupid. She did the normal thing. She’s just downstream of a layer that was designed to answer the bank’s question, not hers.
So what do you actually do, because I’m not interested in a lament.
Ask your processor one question, in writing. When my customer’s agent buys from me, what evidence of that customer’s authorisation do I receive, and can I read the mandate? If the answer is a score, you don’t have authorisation evidence. You have somebody’s opinion about a robot.
Second. Keep your own record of consent. Who authorised what, with what limits, until when, and how they take it back. In your system, exportable, signed, with a timestamp. That record is your defence in a chargeback, and it’s the asset you own when the network’s record is the only other copy. Right now almost no small business keeps this, and it costs an afternoon to start.
Third, build the decline path. Agents reroute in milliseconds. If your checkout can’t accept a mandate, or can’t say in machine-readable language why it refused one, you are invisible to the entire channel — and you’ll find out from a graph in September.
And if you’re building in this space, the gap is obvious: a mandate wallet that belongs to the person. Read it, set the limits, revoke it, carry it to the next merchant. The standards now exist. Nobody has made the human’s copy.
This pattern has run four times in three years. The store, the app store, the ad auction, and now permission itself. Each time, the layer that decides whether you may act becomes the layer that takes a cut. The difference this round is what the layer is deciding. It isn’t deciding what you see. It’s deciding whether what you said was really what you meant.
I don’t want to live in a world where a machine asks another machine whether I meant it, and the answer comes back as a number.
I want to be able to point at a thing and say: I said this, here, at this time, up to this amount, and I can take it back. Not because I’m nostalgic for cash. Because that’s the floor.
A mandate you can’t read, can’t revoke at the source, and can’t carry to another provider isn’t consent. It’s a permission slip someone else printed on your behalf.
You’ve got this.