Your AI Agent Can Now Pay for Things. Nobody's Agreed on Who's Liable When It's Wrong.

Visa, Mastercard, Google, and OpenAI have each shipped competing specs for letting AI agents shop and pay on your behalf. The trade group representing the banks and merchants who live with the fallout says, as of its own May 2026 meeting, that liability is still unresolved. If your organization is anywhere near integrating one of these, you need to know what each protocol actually does — and what none of them do.

The Protocols, Fast

Visa's Trusted Agent Protocol, built with Cloudflare, solves a narrower problem than you'd think: letting merchants tell a legitimate AI shopping agent apart from a bot, using agent-specific cryptographic signatures. Visa cites a 4,700% year-over-year rise in AI-driven traffic to U.S. retail sites, and frames the protocol as complementary to OpenAI's Agentic Commerce Protocol (ACP).

Mastercard Agent Pay centers on tokenized Agentic Tokens tying each agent to a specific user. Mastercard's own materials are candid about what's unsolved: agents misreading intent, legitimate purchases getting flagged as fraud because agents shop at odd hours or in bursts, and liability itself — the article poses the question (retailer, developer, or user?) without answering it.

Google's AP2 (Agent Payments Protocol) is the most structurally interesting: an authorization framework built on cryptographically signed Mandates. An Intent Mandate pre-authorizes shopping within bounds the user sets — category, price cap, expiration — with a "prompt playback" of what the agent believed it was told. Google cites the case of a shopping agent paying $31 for a dozen eggs as exactly what price caps are meant to stop.

OpenAI's ACP is the fourth leg — the one Visa's protocol explicitly complements.

The Part Nobody's Solved

The U.S. Payments Forum's May 2026 summary states plainly: there are no industrywide standards yet for intent, consent, or disputes, and consumers will "inevitably" dispute agent-initiated charges, requiring AI-specific chargeback rules that don't exist today. The standards bodies built to coordinate this are telling you, in their own words, that risk management is outrunning governance.

Here's the distinction vendor pitch decks skip: a cryptographic signature proves what was authorized. It doesn't decide who's responsible when the authorization was based on a bad read of intent — or obtained through a compromised agent. AP2's Mandates protect against an agent exceeding its bounds. They don't protect against an agent hijacked within its bounds — exactly the scenario behind agent goal hijack, OWASP's top agentic AI risk. A compromised agent with a valid $500 Intent Mandate can still spend the full $500 — correctly authorized, completely wrong. Visa's protocol solves "is this agent legitimate," not "was this legitimate agent hijacked" — the same mechanism behind AI browser agent attacks demonstrated at Black Hat this year.

What a Design Review Needs to Cover

Before you wire any of these into checkout: what's the blast radius if a Mandate is honored but the agent that generated it was manipulated? How do you flag anomalous agent behavior given Mastercard's own admission that fraud systems misfire on legitimate agents? Where does your liability start and the vendor's end — in writing, before the first transaction, not worked out retroactively? Does your PCI compliance posture account for agent-initiated transactions, or does it assume a human is always on the other end? That's threat modeling a flow four vendors are each partially securing and none are fully securing — exactly the gap continuous threat modeling exists to close.

Don't let a signed Mandate substitute for your own answer to "who's on the hook." Right now, nobody outside your organization has that answer for you.