Let’s talk about who gets to decide what your agent just bought.
Picture a woman running a small logistics firm on the East Rand. Forty trucks to fuel, a supplier list that changes every quarter, a courier who’s late often enough to be a running joke. So she does what everyone is being told to do — she hands the boring part to an assistant. Restock the consumables. Pay the software invoices. Rebook the courier when it slips. She sets a monthly ceiling, approves a vendor list, and goes back to running the business.
For the first time in her life, money leaves her account and she never touched it. That isn’t a bug. That was the sales pitch.
What nobody at the demo told her is what happens between “the agent decided to buy” and “the money actually moved.”
Because a payment doesn’t travel on its own. It runs down a rail. And over the last year, the biggest payment companies on earth have been laying those rails at speed. Turns out they don’t join up.
Here’s the actual state of it, and this is all public.
Mastercard built Verifiable Intent — a trust layer developed with Google, announced around March 2026 — meant to prove a human really authorised whatever the agent is about to do. Visa and Cloudflare built the Trusted Agent Protocol, which signs an agent’s identity into the HTTP headers of every request, so a merchant can check it against a Visa-run directory of keys. Cloudflare shipped Wallets in August, giving agents a funded account with a spending cap, an allowlist and a maximum transaction size, settling over x402. Coinbase and Stripe are pushing x402 and a Machine Payments Protocol. Google is running UCP and AP2. OpenAI and Stripe have their own checkout protocol.
Half a dozen rails. Half a dozen directories. And they don’t talk to each other.
Look at the stack table doing the rounds and you’ll see it. Discovery owned by one consortium. Authorisation owned by another. Settlement by a third. Visa sits in one column, Mastercard in another, Cloudflare appears in about four of them. Everybody calls their piece an “open standard,” and everybody means open as long as the checkpoint is mine.
Morgan Stanley reckons agentic commerce could be worth about 385 billion dollars of US e-commerce by 2030. Today roughly one percent of shoppers use the agentic route. That gap is why the rails are being laid now, before the traffic arrives.
So why should the woman on the East Rand care?
Because the rail is not a pipe. The rail is where consent gets turned into a credential. And whoever runs the checkpoint on that rail decides three things that matter more than any feature on the box.
One — whether your agent is allowed to transact at all.
Two — what the merchant is permitted to know about you when it does.
And three, the one that should make you sit up — whether your “yes” is a right you hold, or a permission somebody grants you and can take back.
Here’s the detail that gives the whole game away. When Cloudflare launched Wallets, it said something very specific and very quiet: it will be completely optional for an agent to declare its identity, and up to businesses to decide whether they want to prioritise transacting with known agents.
Read that again.
Identity isn’t a standard on that rail. It’s a setting. A premium. If your agent wants to be trusted by the shop, then the shop — or the directory — decides whether that trust is worth paying for. Which means the thing that proves you gave permission is no longer yours. It’s a credential you rent from the network that profits the moment you grant it.
And this isn’t theoretical. Visa’s own research arm found dark-web chatter about “AI agents” up more than 450 percent in six months, and malicious bot-initiated transactions up about a quarter — forty percent in the US. The fraudsters already found the rail. Which is exactly how the networks will justify tightening it: every scam is a reason to make the checkpoint mandatory, centralised, and theirs.
So what’s the operator lesson here?
If you’re building anything that spends money on a customer’s behalf — or spending on your own — treat the rail like a dependency, not a detail. Own your agent’s keys, because whoever holds them can switch your agent off. Keep a second path to the money, because the day one directory goes down or gets expensive, your business stops moving. Keep your authorisation receipts in a format you can read and carry, not one the network stores in a vault you’ll never see. And before you sign anything, ask the question out loud: whose directory is my agent being checked against, and who can revoke my standing?
The old model was simple. You had a card. The card was yours. When you paid, the network carried the money — but it never owned the reason.
What’s being built right now is the opposite. The reason — your intent — gets packaged into a token, signed by the network, and only then does the money move. It might be the most elegant lock-in ever designed, because it doesn’t capture your data or your memory. It captures the last honest thing you have: the moment you decided to act.
The principle worth keeping is this. Consent should be something you carry and can prove, not something you rent from the company that gets paid when you say yes.
Your agent can have a wallet. Just make sure the sign-off inside it is still yours.
You’ve got this.