Incurring Expenses with AI Agents

Agentic Commerce Readiness Assessment - Disbursements

QUESTIONS FOR TEAMS PREPARING TO LET AGENTS SPEND. THESE ARE QUESTIONS, NOT ANSWERS, AND EACH HAS A DIFFERENT ANSWER AT MACHINE SCALE THAN IT DOES TODAY.

The current agentic payment infrastructure ecosystem is developing

The rails of agentic commerce already exist. The x402 protocol, created by Coinbase and now stewarded by the x402 Foundation under the Linux Foundation, counts Visa, Mastercard, American Express, Stripe, Adyen, Google, and Shopify among its 40 member organizations. Visa Intelligent Commerce and Mastercard Agent Pay are live programs; Google's AP2 defines the mandate an agent carries.

The spend side is not waiting for policy, either. This July, a payments-industry veteran handed a coding agent a live card number and told it to buy things. It bought real things at real merchants with real checkout processes on real rails until the balance ran out. Nothing on the rails distinguished the agent from a person. Whatever a company's official position on agents that spend, the first agent-initiated payment has probably already happened inside it.

The platforms are documenting the gap themselves. Apify, whose marketplace of agent-payable tools grew from 2,000 to more than 20,000 in a single June announcement, describes its x402 payment mechanics plainly: the user prepays a minimum balance, usage is tracked off-chain against it, the remainder is refunded later, and when an agent burns through the balance, the wallet automatically signs a new authorization to top it up. The accompanying security guidance is to fund the wallet only with an amount you are comfortable losing, and to assume a compromised or hallucinating agent runtime can drain the entire balance. A limit set by deciding what you can afford to lose is a gambler's mandate, not a spending control.

The rails are here. You can give an agent a credit card, bank account, or wallet, and it can and will transact. Your employees will do this, regardless of your company’s official position and policy on transacting agents. But now, the payment, which has always been the last step of a control mechanism, becomes the first and only step.

In April, American Express became the first network to write terms for the risk: its announced Agent Purchase Protection will cover agent error only where the agent is registered and authenticated purchase intent was transmitted. The network will absorb the loss only when the control artifact exists.

B2B businesses require controls that work, even at machine speed

The assumption baked into this structure is that settlement happens at transaction time. An agent requests a resource, pays the posted price, and receives the content: payment and delivery in a single request-response cycle.

In accounting terms, that is cash accounting. In procurement terms, it is something stranger: the payment, which has always been the last step of a controlled sequence (request, approval, purchase order, receipt, invoice, match, then pay) becomes the first and only step. Corporate spend does not run on pay-at-the-moment. It runs on commitment first and settlement later: the PO is the control, the invoice is the claim, the match is the verification, and the payment terms are the working capital. On agent rails, every artifact in that chain is deleted and with it goes every control that hangs on those artifacts.

Consider two ordinary arrangements:

1. The contract the agent never saw
   Your company holds an MSA with a vendor, which includes negotiated rates, volume tiers, and net-30 payment terms. The vendor also monetizes its API per-request at a posted price. Your agent, assigned the work, hits the endpoint and pays list price, instantly, from a prepaid wallet.
2. • Month-end arrives with three problems: you paid the wrong price (list, not contract); you paid at the wrong time (prepaid cash instead of the net-30 you negotiated); and when the vendor's monthly invoice arrives under the MSA, nothing obvious prevents paying twice, because behind the wallet draws there is no PO, no receipt, and no invoice for the match to match.
2. The vendor nobody onboarded
   Across a quarter, your agents pay $10,000 to a counterparty that never entered the vendor master.
3. • There is no W-9, so you cannot file the information return you now owe, and can’t send an unknown entity a 1099.
   • No sanctions screen, so you may have paid a party you are strictly liable for paying.
   • No banking verification, no contract, and no record of who inside the company authorized the relationship, because no one did.

In this world, the entire procure-to-pay control chain (request, approval, commitment, receipt, match, payment) must execute in an instant, at the moment of transaction. Whatever cannot run in that instant does not run at all.

Readiness Assessment Questions

Below are the questions a team needs to answer before its agents spend.

Who did you pay?

1. A wallet or an endpoint is not a vendor record. Can you resolve the payee to a legal entity at the moment of payment, before settlement is final?
2. Vendor onboarding (W-9, banking verification, sanctions screening) is a pre-payment gate. Which of those gates can run inside a request-response cycle, and which are simply skipped?
3. How would you know if the counterparty your agent paid is your own company, or an endpoint manipulated into redirecting the payment?

Who authorized it?

1. Which person, under which mandate, authorized this agent: for what scope, what time window, what budget? Where is that recorded, and does the record survive the agent?
2. A per-transaction limit is a static gate. What tracks cumulative consumption, for this agent and for this entity's entire fleet, across every card, wallet, and rail, right now?
3. Approval workflows assume a queue and a person. What is the approval artifact for a decision made in forty milliseconds?

What price did you owe?

1. The endpoint charged list; the contract says otherwise. What corrects an overpayment on a rail with no chargebacks, to a counterparty that may no longer exist?
2. Net-30 is working capital. Agents paying at the moment of consumption convert negotiated terms into prepaid cash: who is measuring that cost?
3. When the invoice arrives for spend that an agent already settled, what prevents the duplicate payment?

What did you record?

1. Money left with no PO, no receipt, and no invoice. What generates the accounting entry, and what does the three-way match match?
2. Budgets are controlled at commitment, not at month-end discovery. Where does agent spend hit the budget in real time?
3. Is a denied attempt recorded anywhere? At audit, the blocked transactions are the evidence that the control existed.

What do you owe the government?

1. Cross the information-return threshold with one payee and you owe a 1099, which requires a TIN you never collected. The fallback is backup withholding, and you cannot withhold on an instant, final settlement.
2. Use tax turns on jurisdiction. What jurisdiction did your agent buy in?
3. Sanctions compliance is strict liability and pre-payment by definition. You cannot unscreen a settled payment.

What proves the controls worked?

1. Of today's fraud losses, what share is recovered rather than merely detected, and which recovery mechanism survives an irreversible rail and a vanished counterparty?
2. Of the controls that will gate agent spend, how many stop the transaction, and how many flag it afterward? What is the preventive-to-detective ratio, honestly counted?
3. Someone signs the attestation over spend no human reviewed. What evidence does that person need in hand at the moment of signing, rather than assembled at quarter-end? For a company approaching public-filer obligations, when does this stop being a long-range question?

The fundamental question: who owns the control?

Fraud detection sits with risk. Payments sit with treasury. The ledger sits with the controller. An agent-initiated payment crosses all three, in a single event, in milliseconds.

None of these are fraud-detection questions. Fraud detection runs after the money moves and tells you what you lost. These are accounting and control questions, and the control now has to run before the payment, because afterward there is no one to call and nothing to reverse.