An Agent with the Right to Pay: Authority, Consent and Liability

A purchase has five useful steps: find offers, compare them, agree terms, accept the seller’s offer and pay. Agreeing to buy and allowing money to leave an account are separate actions. An agent can perform them for a person or company. We therefore need a record of what it was allowed to buy, from whom and for how much.

For example, the US law E-SIGN §7001(h) allows contracts formed through electronic agents. The agent’s actions must legally count as those of the person or company bound by the contract. This does not make an owner responsible for every model error: permissions, contract terms and applicable law still matter. A digital signature helps check who signed a document and whether it changed afterwards. It does not prove that the person understood every consequence.

The 4 August 2026 Amazon v. Perplexity ruling concerns website access under the CFAA — the Computer Fraud and Abuse Act, a US law covering computer misuse, including access without permission. On page 17, the court limits its conclusion to that access dispute. It does not decide who pays for a wrong product or when a buyer gets a refund. This article asks a simpler question: how do we check that the agent did what the person actually allowed?

Changes in status matter more than the number of announcements. A specification establishes a message format. A programme announcement signals an intention to launch. A completed purchase demonstrates a particular integration. None of these events alone measures market size.

In September 2025, AP2 was described in terms of Intent, Cart and Payment. Version 0.2 uses two types: Checkout and Payment. Historical terminology must not be inserted into a current schema comparison. Amex announced Agent Purchase Protection in April 2026; at the 27 September recheck, its page still described future protection and promised further terms.

On 2 June, Worldline, ING and Mastercard reported a concert-ticket purchase in the Netherlands, approved by the customer before completion. It is a useful production example of an approved purchase. It does not demonstrate delegation of an open budget for an unspecified sequence of purchases.

In September, EMVCo put a technical framework out for comment. KYA and agentic transaction indicators appear as possible further work. UK Treasury and Bank of Russia consultations address different parts of the problem. Their deadlines are listed separately below: closing comments is not the same as bringing rules into force.

A mandate records delegated authority. In AP2 v0.2, Checkout authorises checkout and Payment authorises payment. Each type has an open form constraining a future action and a closed form for a specific action. They are not three mandatory documents in a chain. Relating Checkout and Payment connects commercial content with payment authority without determining the outcome of a legal dispute.

Checkout answers “what are we buying?” Its open form lists permitted items and merchants; its closed form binds a specific merchant-signed order. Payment answers “how are we paying?” Limits on amounts and recipients become permission for a particular payment. A closed Payment includes the amount, currency, recipient, payment instrument and a link to the order. Ordering the right shoes does not permit any charge, and permission to spend €120 does not permit buying any item.

Open does not mean “anything can change before approval”: the agent must stay within agreed limits. Closed records the chosen action. For an autonomous purchase, the agent can prepare it within existing authority without another human click. The AP2 autonomous flow describes this transition.

One-off and recurring use are a separate question. Payment’s Agent Recurrence constraint sets frequency and an optional maximum number of uses; a budget caps total spending. For example, “pay for this service up to €20 monthly, at most 12 times” can permit different amounts. Each payment still gets a specific amount and recipient. Recurring therefore need not mean an identical charge every time, and closed is not a name for a fixed schedule. Checkout continues to govern the items and order separately.

Signing roles cannot be reduced to “the human signs the open mandate and the agent signs everything else”. The agent prepares content; a trusted surface presents it to the user; the merchant signs the checkout object included in a closed Checkout. Authorisation can use a user credential or a trusted agent provider. The verifier must validate the relevant trust chain and constraints. A TAP request signature authenticates the agent and request context; it does not substitute for cardholder consent.

The six fields are my design framework: amount, merchants and items, time window, mode, acceptable trade-offs and revocation. Protocols cover them unevenly. Expiry and revocation are particularly different: a short lifetime narrows the risk window but does not immediately stop an already issued permission. Revoking a token also does not reverse a completed payment.

Before enabling autonomy, the interface should expose exceptions as well as the budget: whether a substitute model is allowed, whether shipping counts toward the cap, and whether an instruction can be extended without fresh consent. Where the specification has no suitable field, the application must either enforce a separate verifiable constraint or omit that guarantee from its promise.

Confirmation frequency and delegated authority are different dimensions. A low-price search may run for weeks, but the purchase still requires approval if fresh permission precedes payment. That is how Google describes Buy for me. Amazon Auto Buy instead uses a price condition to trigger purchase without fresh approval, with a stated 24-hour cancellation window and an instruction lasting up to six months.

The inverted U illustrates Turan’s theoretical model. Under its assumptions, additional checks initially help and fatigue can later impair oversight. It is not a measured shopper response or an established optimum number of clicks. A product needs its own measurements of constraint comprehension, detected deviations, mistaken approvals and completion time.

My design recommendation is to show the verifiable action: item, merchant, total amount, delivery and return terms. The agent’s summary should not be the sole source of these details. A material change after approval requires rechecking the permission and, if its bounds are exceeded, obtaining new consent. A cancellation window can help after an error but cannot replace validation before charging.

“Who pays?” can mean an issuer’s obligation to an acquirer, a merchant’s obligation to a buyer, a payment provider’s duty to its customer or a developer’s duty to its client. One reimbursement arrow cannot represent them all. Visa rules, §1.7.6.1 requires payment to an acquirer for a valid transaction. It is an interparticipant settlement rule, not a promise to compensate a buyer for an agent’s selection error. Section 4.1.24.10 of Visa’s network rules allocates cardholder responsibility; private rules do not displace applicable mandatory rights.

EU PSD2 distinguishes consent, unauthorised transactions and specified refunds of authorised transactions. Articles 76–77 provide conditional refunds for transactions initiated by or through the payee, not a general right to reverse any disappointing purchase. US Reg E covers qualifying electronic transfers and error resolution under §1005.11. Regulation E, §1005.2(m) defines unauthorised transfers. Credit cards require separate consideration of Regulation Z, §1026.13. “No approval means a refund; approval means no remedy” is not an accurate summary of these regimes.

Selecting the wrong item within permitted parameters does not automatically turn a transfer into an unauthorised one. Exceeding authority cannot automatically be classified as an ordinary authorised purchase either: evidence of consent and each participant’s failed obligation matter. Remedies depend on jurisdiction, instrument and facts. The new EU Product Liability Directive is no universal refund route for a mistaken purchase: recital 24 excludes pure economic loss as a standalone damage category, while Article 6 lists covered harm. Its temporal scope matters too.

Amex describes future voluntary protection, not currently available universal reimbursement. Published eligibility includes qualifying US cards, a registered agent, authenticated intent received by Amex and a deviation from it. A merchant return should be attempted where possible; subjective expectations are not equivalent to a verifiable instruction. Full terms and the effective launch still require verification.

The selected sources do not provide a representative body of disputes about buying-agent errors. That does not establish the absence of lawsuits, trivial claim values or rules uniformly hostile to claimants. Other explanations include missing statistical categories, merchant returns resolving complaints, private records or incomplete search. These are observational limits, not an established causal model of the market.

Constraints must be checked outside the model. The agent proposes an operation; a separate executor validates authority, recipient, amount, expiry and remaining budget. A signature without these checks can simply authenticate the wrong action. AP2 treats agents as potentially adversarial, supporting a separation between proposal and execution.

Consider a hypothetical purchase. A person delegates buying one pair of green shoes in size 38 from merchant A or B, for no more than €120 including shipping, before Friday at 18:00. Only listed models are acceptable; a colour substitution is prohibited. This is an architectural example, not a shipped integration or a promised legal outcome.

1. The interface presents constraints and binds approval to their exact version. An AP2 implementation creates the relevant open Checkout and Payment mandates through its chosen authorisation model. The merchant signs a specific checkout; the delegated party closes mandates within the permitted chain. Hashes bind documents to the action, not merely to the model’s explanation.

2. Before charging, the executor validates signatures, expiry, item and recipient identifiers, total including shipping and whether the order has already executed. Budget reservation and duplicate prevention must withstand concurrent requests: two €100 purchases cannot both consume the same €120 balance. An unavailable validator should stop execution rather than turn the constraint into advice.

3. In one outcome, permitted green shoes cost €110 but feel uncomfortable. Authority checks passed; subjective dissatisfaction does not prove a mandate breach. Merchant return terms and other applicable rights remain relevant. In another outcome, €130 is charged or red shoes are ordered. If the verified order data reveals this, execution should have been rejected. If the order specified green but red shoes arrived, the discrepancy concerns merchant fulfilment. Similar visible outcomes can require different evidence.

4. A dispute needs original approval, constraint version, signature chain, checkout snapshot, validation result, payment receipt and fulfilment or return history. Revoking authority and tokens can stop future operations; completed payments need a separate remedy. Logs should reconstruct the decision without retaining unnecessary personal data. Visa rules, §4.1.24.8 requires the order confirmation to remain available to the cardholder for at least 120 days; this is not a universal retention period for every record.

The example exposes the architecture’s boundary: cryptography can establish which document was approved, and deterministic validation can establish compliance with encoded constraints. Neither proves product quality nor automatically identifies a liable defendant. Those questions depend on substantive obligations and the applicable dispute process.

An agent can be steered without compromising a payment token. Ranking bias, a compelling badge or merchant text acts earlier, while the cart is being formed. Experiments help locate these weaknesses; they do not measure the share of deceived real-world buyers.

Results from visual-storefront experiments in the ACES study must not be combined with results from its direct API setting. Our table uses only the results for models that read text and images (VLMs). The authors describe those results in Table 2 and its accompanying explanation in version v3 of the paper. Overall Pick increases selection while Sponsored reduces it against the baseline in this setup. Transfer to new models, real inventories or a different choice-set size needs another experiment.

Magentic Marketplace’s first-responder effect varies by model, and task failure must not be interpreted as immunity to bias. A practical evaluation should vary offer order, badges and response delays. Such tests complement authority checks: an agent can make a poor choice while remaining within budget.

OpenAI’s Sponsored Agents announcement describes a different observed format: a person enters a conversation with a brand agent. It does not demonstrate advertising sold to autonomous buyer agents. Paid promotion in machine channels remains a separate forecast. Testing it requires a placement interface, commercial terms and observable effects on agent selection, not merely “agent” in an advertising product’s name.

Buying an API call and ordering shoes differ in subject matter, fulfilment and potential disputes. A machine payment can buy data or compute, but M2M alone says nothing about delegated authority: software may spend a fixed amount or choose purchases within a budget. Machine settlement is therefore a separate context, not the next autonomy level.

An average transaction value needs a consistent numerator and denominator. A historical x402 record contains $24.24 million and 75.41 million operations: for the same period and population, that would yield about $0.3214 per operation. The dynamic dashboard snapshot could not be independently reproduced. The division therefore checks a conditional calculation, not an established market average. A usable estimate needs an archive, window dates, an operation definition and treatment of duplicates or self-payments.

These are source-authored scenarios, not measured sales. Bain excludes journeys using AI only for search, while including agent influence further along the journey. McKinsey estimates broader agent orchestration. A shared forecast year does not imply a shared methodology. An overall spread is not meaningful without aligning years, geography and definitions.

Missing comparable public volumes mean this source selection cannot reliably establish scale. They do not establish an absent market. A follow-up should separately count AI-assisted recommendations, approved agent checkout, debits without fresh consent and machine resource payments. Otherwise, growing referrals from chat can be mistaken for growth in autonomous payments.

For Russia, distinguish a regulator’s document, proposed infrastructure and a consumer-accessible product. The commercial smart-contract platform concept discusses programmable execution within digital-ruble infrastructure. Sender limits and conditional settlement resemble agent controls conceptually, but are not a complete consent or liability regime for every AI buyer.

There is no basis to claim that standing instructions can appear only after a particular digital-ruble feature: other payment instruments can support them. Nor can willingness surveys or small scenario tests substitute for transaction measurements. Stated intentions do not establish market share, and successful test purchases do not establish volume.

These are four different processes, not four equivalent reforms. At the 27 September check, all listed deadlines were still ahead. They close comments without guaranteeing publication of results that day. Final texts and effective dates require separate analysis; drafts must not be read as adopted requirements.

My ladder measures the scope of permitted decisions, from reading to allocating a budget. It is a design tool, not a legal classification or a vendor maturity ranking. One product can operate at different levels for different actions: choosing when to buy autonomously while requiring approval for an address change.

Moving up means making a new delegated decision explicit, rather than merely removing another click. A budget permits choosing multiple transactions and consuming an aggregate balance. That requires cumulative spend checks, not just a per-payment cap. Protocol fields demonstrate that a constraint can be represented; general product availability requires separate evidence.

Product forecasts will be checked against the public pages and terms covered here, plus new launches found in a repeat search. A positive example establishes existence; failure to find one remains a bounded search result. “Unresolved” is therefore necessary alongside confirmation and refutation. Dispute statistics can inform risk assessment but cannot by themselves establish that a product has left its pilot.

The practical result is a verifiable chain: the person understands the boundaries, the system records authority, an independent executor validates the action and the log preserves evidence. Contractual and statutory remedies must be considered separately. The chain makes autonomy inspectable; keeping remedies separate prevents a valid signature from being mistaken for a reimbursement promise.