# How Can Businesses Secure Agentic Commerce Before AI Agents Can Spend?

Paige Thornton · September 26, 2026

> Direct Answer: Businesses Need Transaction Controls, Not Just AI Security Securing agentic commerce means giving an AI shopping agent limited authority...

## Direct Answer: Businesses Need Transaction Controls, Not Just AI Security

Securing agentic commerce means giving an AI shopping agent limited authority to discover products, negotiate terms, submit orders, and make payments without exposing a company to unauthorized purchases, manipulated product data, payment fraud, or unclear liability. A conventional website security program is necessary but insufficient. Authentication, malware scanning, encryption, and access controls protect systems from outside attackers; agentic commerce also requires a transaction-control layer that understands an agent’s identity, permitted actions, spending limits, merchant, and exact order.

**Also worth reading:** [How Can Businesses Control Agentic AI Costs Without Slowing Down Automation?](https://zdnetinside.com/knowledge/how_can_businesses_control_agentic_ai_costs_without_slowing_down_automation.php) · [How Should Businesses Structure AI Consulting Contracts for Agentic Projects?](https://zdnetinside.com/knowledge/how_should_businesses_structure_ai_consulting_contracts_for_agentic_projects.php) · [What is an AI Software Systems Consultant and how can they help businesses navigate the evolving landscape of agentic AI and data-driven decision-making?](https://zdnetinside.com/knowledge/what_is_an_ai_software_systems_consultant_and_how_can_they_help_businesses_navigate_the_evolving_landscape_of_agentic_ai_and_data-driven_decision-making.php)

The immediate best practice is to treat an AI agent as an untrusted software client with a narrowly scoped wallet. Issue a separate credential for every agent, customer, merchant, and environment; require explicit approval for material actions; and use real-time authorization rules rather than a reusable card number. A useful baseline is a default purchase limit below $50, a daily aggregate limit below $250, and human approval above $250, though businesses should set these thresholds from their own loss tolerance. High-value orders, unusual merchants, changed shipping addresses, and attempts to bypass policy should trigger a step-up check.

By September 27, 2026, secure agentic commerce has moved beyond a purely theoretical concern. Cloudflare has worked with payment and card networks including Visa, Mastercard, and American Express, while Mastercard, Flybits, and Rogers Bank have established a Canadian benchmark for consumer-controlled agentic commerce. These efforts matter because payment tokens and network rules provide useful controls, but they do not by themselves prove that the person who started an AI workflow still wants the final purchase. The answer, therefore, is not to prohibit agents or place one open API key in an AI system. It is to build a permissioned transaction path in which every consequential step is attributable, bounded, reversible where possible, and observable.

## How Secure Agentic Commerce Works Across the Transaction

An agentic transaction normally has five stages: product discovery, retrieval of merchant terms, construction of a cart, authorization, and settlement. Security controls must cover all five because an attacker may manipulate an early stage rather than attack the payment endpoint. For example, hidden instructions embedded in a product page could convince an agent that a wire transfer is required, that a subscription has been canceled, or that a cheaper product is “authorized.” Merchants and platforms should therefore return structured, signed data containing price, currency, stock status, refund policy, shipping terms, and expiration time rather than relying solely on prose that an agent must interpret.

The customer needs a policy engine outside the AI model. That engine should decide whether an agent may browse, add an item to a cart, disclose customer information, or spend funds. A stronger deployment separates read and payment credentials: discovery can happen automatically, but a payment credential remains dormant until the user approves a precise cart. Cryptographically signed receipts and audit logs should connect the originating user, agent version, merchant, item, amount, authorization decision, and final network transaction.

Payment networks and infrastructure providers can add another layer. Cloudflare’s collaboration with Visa, Mastercard, and American Express focuses on helping agents transact more safely, while emerging trust-layer companies are building identity, policy, and transaction systems for the agentic economy. These services may issue scoped tokens, apply risk checks, and provide verifiable records, but buyers should not confuse network tokenization with consent. A token can be secure while still authorizing an unwanted purchase. Payment security verifies a transaction; authorization policy determines whether the transaction should occur.

## Core Controls Every Business Should Implement

The first control is least-privilege access. A shopping agent should receive only the tools required for its task, with separate permissions for searching a catalog, reading a cart, requesting approval, and paying. Production payment credentials should never be available in prompts, application logs, vector databases, browser memory, or model context. The agent should call a payment service that enforces limits outside the model, because a prompt saying “never spend more than $50” is not a dependable financial control.

The second control is strong customer and agent authentication. Use phishing-resistant methods such as passkeys or hardware-backed credentials for account owners, and workload identity for the agent itself. The system should bind an agent token to a specific customer, merchant set, purpose, and time window. A token issued to “an agent for Acme” is too broad if the same token can buy office supplies, cloud services, gift cards, and international travel. A 15-minute token lifetime and a maximum of one transaction provide a reasonable pilot baseline, while higher-risk actions should require a fresh approval.

The third control is transaction policy. Typical rules should cover maximum unit price, cart total, daily cumulative spend, merchant categories, geographic restrictions, and a prohibition on repeated microtransactions. Velocity controls can detect dozens of small purchases that bypass a single-item threshold; for example, 10 orders of $49 could remain under a $50 per-order limit while still causing substantial loss. Rate-based alerts and cumulative budgets address that weakness. Step-up authentication should occur when the agent changes destination, currency, quantity, or merchant during checkout.

The fourth control is complete traceability. Every action should produce an immutable log containing the input instruction, policy version, retrieved offer, model and agent version, approval event, token identifier, amount, currency, merchant, and result. Logs should be retained long enough to investigate disputes, but payment credentials and unnecessary personal data should be tokenized or removed. Organizations should also test whether their systems can stop an agent after an order is submitted, because technical rollback is often harder than preventing authorization in the first place.

## Comparison: Agentic Payments Versus Conventional Payment Security

| Feature | Conventional payment security | Secure agentic commerce control |
| --- | --- | --- |
| Primary goal | Protect credentials and authenticate a transaction | Protect credentials and decide whether an AI-initiated action is allowed |
| Main trust subject | Cardholder, browser, and acquiring merchant | Customer, agent identity, merchant, model, tools, and payment network |
| Authorization model | Cardholder or stored credential authorizes a merchant | Policy engine verifies agent scope, cart details, amount, merchant, and user intent |
| Credential storage | Tokenized card or account credential in a controlled processor | Short-lived, purpose-bound agent token kept outside model context |
| Purchase limits | Merchant and issuer risk controls | Per-order, daily, merchant-category, velocity, and step-up limits |
| Human involvement | Often occurs at checkout or when challenged | Explicit consent is required at defined decision points |
| Audit evidence | Transaction and account record | End-to-end record linking prompt, offer, policy, approval, token, and result |
| Failure risk | Fraud, chargebacks, and stolen credentials | Fraud plus unwanted purchases, prompt injection, goal drift, and excessive delegation |

This comparison shows why adding tokenization to an agent does not solve the entire problem. Tokenization reduces exposure if a credential is stolen, but an attacker who controls the agent can still attempt legitimate-looking purchases within the credential’s permissions. Secure agentic commerce adds intent controls, narrower delegation, and stronger auditability. Conventional payment systems remain essential building blocks, while the new layer governs what the agent is allowed to do before and during payment.

## Practical Implementation Plan for an Ecommerce or Enterprise Team

Begin with a low-risk pilot lasting 60 to 90 days and use a small internal group of agents. Do not begin with autonomous purchasing of gift cards, financial products, travel, healthcare, or high-margin resale goods. Select merchants with stable APIs, clear refund rules, and fraud monitoring. For each transaction, display a short confirmation screen naming the agent, merchant, item, quantity, total, currency, delivery address, and refund policy. Require the user to confirm after the final price is known rather than treating broad permission at the start of a conversation as consent to every later decision.

A production rollout should be staged across discovery, cart creation, and payment. During discovery, merchants expose structured product data through tools such as Model Context Protocol, with schemas that distinguish product facts from untrusted page content. During cart creation, the platform verifies that displayed terms match the submitted order and calculates the total independently. During payment, a separate service checks scope, limits, velocity, sanctions, account status, and approval status before requesting a network token.

Organizations should set measurable exit criteria before expanding autonomy. A reasonable early target is fewer than 5 unauthorized transactions per 10,000 attempts, a median authorization decision below 1 second, and at least 99.9% availability for the policy service. More important is zero tolerance for secret leakage and 100% traceability of approved payment actions. Measure approval conversion, dispute rate, incorrect-cart rate, manual-review time, fraudulent attempts, and customer satisfaction. If agents produce more disputes than ordinary ecommerce checkout, expansion should pause even if transaction volume rises.

Teams should also define who can pause the system. The policy service, token issuer, and monitoring platform need independent kill switches, and one designated operations role should be able to revoke an agent’s access immediately. Alerts should fire when a new agent version appears, a limit changes, or payment volume rises more than 25% above the same weekday’s four-week average. An effective pilot is not judged by whether the AI sounds confident; it is judged by whether the system remains correctly bounded under failure, adversarial input, and unexpected purchasing behavior.

## Alternatives, Costs, and Buying Decisions

There is no single “secure agentic commerce” product category with one standard price. A basic prototype can be built with existing identity providers, API gateways, payment processors, policy-as-code tools, and manual approval, making direct software cost close to zero. Production deployments are more expensive because they require tokenization, fraud assessment, independent authorization, monitoring, incident response, and integrations with merchants and payment networks. A small pilot may cost $10,000 to $50,000 in engineering and integration work, while a regulated, multi-merchant platform can reach $100,000 to $500,000 or more; these are planning ranges rather than published market prices.

A managed payment-infrastructure service can reduce integration time, but it may be appropriate only if the provider supports scoped credentials, transaction history, approval APIs, and control over limits. A model or chatbot vendor is usually not a sufficient substitute for a payment broker because its main responsibility is generating responses, not independently validating financial authority. Building everything internally offers control but creates payment-security and compliance work. Buying several point solutions can also be costly if identity, fraud, and audit records cannot be joined into one trace.

The decision should follow transaction risk, volume, and regulation. A small store allowing read-only product research can start with simple controls. A business expecting agents to place recurring orders needs tokenization, limits, reconciliation, and dispute handling. Banks and payment providers should demand auditable policy decisions, consumer recourse, and network-level cooperation. Merchants should test whether their catalog data can be trusted, because an incorrect price or refund term can cause harm even when the payment layer is well designed. The best option is the one that preserves human authority without making every purchase so cumbersome that the customer abandons the workflow.

## Common Mistakes and When Organizations Should Act

The most common mistake is giving an autonomous agent a reusable payment credential. Another is treating a model’s safety instructions as a security boundary. Instructions can be altered by malicious content in a webpage, email, or product description, so financial decisions must be enforced by code. Other errors include setting only a per-order limit without cumulative controls, hiding the final amount, accepting stale prices, failing to bind tokens to merchants, and assuming tokenization prevents all fraud.

A second mistake is launching before the organization can explain accountability. Customers need to know whether the agent, merchant, bank, or platform handles a refund, and operations staff need a way to identify the policy that approved a purchase. Businesses should also avoid using real funds for initial testing; sandbox credentials and synthetic data are adequate for integration, followed by very small real transactions when network behavior must be verified. Logs should be tested for secrets, since recording an entire prompt can expose personal information and credentials.

Organizations should act now if agents are already being integrated, if an AI system can access a payment API, or if a merchant plans to publish an “Ask the agent to buy” feature. A reasonable 2026 sequence is to inventory agents and tools during the first 30 days, define identity and spending policy during days 31 to 60, and run a sandbox plus limited pilot during days 61 to 120. Businesses do not need to predict the entire agentic economy to protect themselves. They need to ensure that today’s integrations cannot exceed today’s delegated authority.

The date is important: as of September 27, 2026, partnerships among Cloudflare, card networks, banks, and trust-layer vendors indicate that agentic payments are becoming an infrastructure problem. That does not mean every AI shopping feature is ready for unrestricted spending. Consumer trust will depend on visible prices, predictable limits, understandable approvals, and a practical way to reverse mistakes. A company that treats those requirements as product features will be better positioned than one that treats them as compliance work added after launch.

## Quick answers

### What is the safest way for an AI agent to make payments?

Give the agent a short-lived, purpose-bound token instead of a reusable card number, and enforce spending limits outside the model. Require a fresh human approval for the final cart when the purchase exceeds a defined threshold, changes merchant or destination, or triggers a risk rule.

### Does payment tokenization make agentic commerce secure?

No. Tokenization reduces the risk of exposing a primary card credential, but it does not prove that the customer intended a particular purchase. Secure agentic commerce also needs agent identity, scoped permissions, final-cart confirmation, cumulative limits, and auditable policy decisions.

### How much should an AI agent be allowed to spend?

The amount depends on the business and customer, but a small pilot can begin with a $50 per-order ceiling and a $250 daily aggregate limit. These are examples, not universal standards, and should be adjusted for transaction size, risk, refunds, fraud patterns, and customer preferences.

### What is the main security risk in an agentic payment system?

The central risk is unauthorized delegation: a stolen agent credential or manipulated instruction may cause legitimate-looking purchases within broad limits. Prompt injection, product-data manipulation, excessive retries, and loss of customer intent add further risks that ordinary payment authentication alone cannot detect.

### Do banks and payment networks already have standards for AI spending?

They are developing controls and commercial partnerships, including Cloudflare work involving Visa, Mastercard, and American Express. The market is still evolving, so businesses should verify current specifications, legal responsibilities, and dispute rules rather than assume that a network partnership guarantees a complete security standard.

Canonical: https://zdnetinside.com/knowledge/how_can_businesses_secure_agentic_commerce_before_ai_agents_can_spend.php
Markdown: https://zdnetinside.com/knowledge/how_can_businesses_secure_agentic_commerce_before_ai_agents_can_spend.php/index.md