Four questions have to be answered before a selection becomes an instruction, and no existing payment component answers all four:

The first three are increasingly implemented. The fourth is where the arrangement is least settled, and it is the subject of records and evidence and responsibility and disputes below.

Agentic payments extend what happens before an instruction exists. Everything after remains under existing ownership.

Inside the boundary. Delegation and its limits, agent identity and credentials, and the binding between an agent’s action and a principal’s authority. The conversion point at which delegated authority becomes an instruction, and the records that point must produce. The failure modes that arise specifically because software is acting on standing authority.

Outside the boundary. Once an instruction is submitted, its states through posting and closure belong to the payment lifecycle, while message construction, routing and status continuity belong to payment messaging. Posting models and the source of truth sit with ledger architecture, and break identification and resolution with reconciliation architecture. The control catalogue itself — authorisation thresholds, segregation, release, exception handling — belongs to payment controls.

This page reaches into those pages only where delegated authority changes something in them. It says what changes and sends the reader to the owner for the rest.

A distinction worth holding. When an agent assembles a basket and hands a person a checkout to approve, no delegated authority has been exercised: the person authorised at the moment of payment, and the arrangement is ordinary commerce with software assistance. The structure described here applies once authority is exercised without contemporaneous confirmation. Much of what is currently described as agentic falls on the assisted side of that line, which matters for reading adoption claims — see state of adoption.

A grant that cannot be enforced mechanically is not a control. The dimensions below are the ones that can be checked before an instruction is submitted:

Purpose is the outlier. A principal delegates in natural language — replace this when it runs out, book something suitable under this budget — and no credential carries that. The enforceable scope is always narrower and blunter than the authority the principal believes they gave. That gap is not a defect of any one implementation; it is the structural distance between an objective and a limit, and it is where disputes originate.

The last row belongs in the table precisely because it is not a payment credential. Verifying that a request came from a named agent answers who is asking. It says nothing about what that agent may spend, on whose account, or within what limit. A merchant that has deployed perimeter verification has solved admission, not authorisation, and the two are easy to conflate because they are sold into the same problem.

An issuer enforces the limits it can express, and those limits are wider than the instruction the principal gave. A standing credential valid to a monthly ceiling remains valid for the whole ceiling even where the principal’s actual instruction covered a single purchase. Scope exceeds authority by construction.

Revocation exposes a second gap, and this one is measured in time. Withdrawal is immediate at the issuer and slower everywhere else: open sessions continue drawing down, mandates already accepted remain accepted, and any downstream party holding a cached token holds it until expiry. Revoking authority and revoking every credential expressing it are two operations, and the interval between them is exposure.

The merchant sees the credential. The signed grant, where one exists, sits with the principal, the agent operator or the credential provider — the same asymmetry described in participants, arriving at the merchant precisely when it most needs evidence it does not hold. The grant and the credential travel to different parties, and only one of them reaches the party defending a dispute.

Sub-delegation has no settled treatment at all. An agent that engages another agent to complete part of a task extends the chain, and each further step weakens the connection to the original grant. The models above bind one agent to one principal; what a second-order agent may do, and how a principal revokes authority it never knowingly issued, remains open.

Scoped agent credentials are a real advance in one respect: an agent credential can be revoked without reissuing the underlying instrument, which contains the blast radius of a compromised agent to the agent itself. That is a genuine structural improvement over sharing an instrument with software.

It does not change who the customer is. The principal remains the identified party under the arrangements described in KYC and KYB; an agent is not onboarded, verified or risk-rated as a customer, and treating credential issuance as a substitute for customer identification misplaces the obligation. Where an agent operator goes further — holding funds, issuing credentials against them, or standing between a licensed institution and an end customer — it takes on functions that carry their own regulatory treatment, and the allocation of those functions follows the sponsor-bank and programme structures set out under banking-as-a-service.

What has to be reconstructible after the fact is a chain, not a document: the grant, the selection it produced, the scope check that admitted it, and the instruction that resulted. Signed records make each link verifiable — a signature over a grant, and over the specific checkout it authorised, allows a later party to confirm that the principal committed to those terms and that nothing changed in transit.

Three properties determine whether that chain is worth anything.

It must bind to specifics, not to permission. A record showing that an agent was allowed to spend proves less than a record showing what it was allowed to spend on, at what price, at what moment. Generic authorisation evidence does not resolve a dispute about a particular purchase.

It must be retained by someone who will produce it. The chain is only useful if the party who needs it can obtain it. The merchant defending a dispute does not hold the grant; the principal contesting the payment has no incentive to produce it. Retention obligations, retention periods and the mechanics of producing evidence to an adjudicator are not settled, and this is the practical constraint on every signed-mandate scheme currently deployed.

It must survive the parties. Agents are deprecated, operators change, keys rotate. Evidence that can only be validated while the signing agent still exists and its keys are still published has a shorter life than the dispute window it is meant to serve. Key rotation and revocation semantics are unresolved in the identity standards this depends on.

The posting problem is narrower and more tractable, and it is the one most likely to be neglected because it looks like an ordinary integration.

Attribution. A payment made by an agent is a payment made by its principal. The posting has to carry the principal, not the agent, as the party whose balance moves — while retaining the agent as an attribute, so that spend can be traced to the delegation that produced it. Systems that model the agent as the account holder produce ledgers that cannot answer either question correctly. The ledger models and source-of-truth relationships this depends on are set out under ledger architecture.

Idempotency. Retry is native to agent behaviour, as the initiation model shows: a refusal returns to the agent, which revises and resubmits. Without a durable idempotency key carried from the selection through to the posting, a retried instruction and a second purchase are indistinguishable at the ledger. Every attempt against one objective needs to resolve to one posting, or to postings the system can positively identify as distinct.

Replay after interruption. An authorisation that succeeded but whose response was lost has to be recoverable. The agent will retry; the ledger has to recognise the earlier attempt rather than post twice.

Per-agent segmentation. Spend under a single grant should be aggregable — to enforce a cumulative ceiling, to show a principal what was committed on their behalf, and to isolate a compromised agent’s activity without unwinding unrelated postings. A sub-ledger dimension per grant, or per agent, makes all three queries answerable. Its absence makes them a data-recovery exercise.

The mandate and the posting have to stay linked. This is the single requirement most often lost in implementation, because the evidentiary chain is built by a payments or identity team and the posting is built by a ledger team, and nothing in either system fails when the link is absent.

A ledger that attributes agent spend to the wrong principal cannot answer who owes what. A ledger that cannot replay an authorisation after a retry cannot say whether a duplicate is a duplicate. In both cases the failure surfaces not at payment but at reconciliation, days later, as a break with no obvious cause — and the exception flows, break categories and resolution ownership that follow are the subject of reconciliation architecture.

The requirement is straightforward to state and easy to omit: every posting arising from delegated authority should carry a durable reference to the grant that authorised it and to the attempt that produced it. Records built that way answer a dispute and a break with the same query. Records built without it answer neither.

Where these records serve regulatory reporting, examination or evidentiary continuity obligations, the retention and production requirements described under regulatory operations apply to them as they do to any other payment record.

Most of these produce authorised payments. Duplicate execution, intent drift, scope exceeding authority and agent compromise all pass every check the arrangement performs. Fraud controls built to answer was this authorised return the correct answer and admit the transaction. This is why the dispute question in responsibility and disputes has no clean answer: the failures that matter most are not unauthorised.

They surface downstream, not at payment. Duplicates, broken links and drift are invisible at authorisation and appear at reconciliation, where the investigating team has the transaction record and none of the upstream context that would explain it. Break identification and resolution follow the exception flows under reconciliation architecture, but the causes originate here — which is why break categories that do not distinguish agent-initiated activity will misclassify them.

Speed removes the natural check. Human purchasing has latency, and latency has historically caught errors: someone notices before the second order ships. An agent operating on standing authority can execute a mistake repeatedly before any person observes the first instance. The blast radius is set by the limits in the credential and the propagation delay on revocation, not by anyone noticing.

Agent-initiated payments remain subject to the second Payment Services Directive and its regulatory technical standards on strong customer authentication, with no separate treatment. The operative questions are functional: who is providing a payment service in a given arrangement, who holds or controls the customer’s funds, and what constitutes valid authorisation when execution is delegated.

Authentication timing is the sharpest constraint, because strong customer authentication was designed around a payer present at the moment of payment. The industry accommodates delegation through two established constructions. On card rails, a merchant-initiated transaction framework authenticates the first transaction and carries later ones against the agreed mandate. On account rails, a bounded standing permission established once under authentication supports subsequent payments within its limits — amount, frequency, beneficiary — without fresh authentication. Both work by making the delegation itself the authenticated event, and both were designed for a mandate whose counterparty is known when it is granted.

The revised framework under negotiation leaves this open. Its drafting contains no provisions addressed to payments initiated by AI agents, so the interpretive position persists through the implementation period instead of resolving at the end of it. A secure remote commerce specification, where one is used, provides a compatibility layer that keeps merchants reachable by early agents; it says nothing about delegated authority.

Two further frameworks bear on the same arrangements from different directions. The AI Act imposes obligations on providers and deployers of AI systems, including transparency, risk management, documentation and human oversight, with general-purpose model obligations now in force and penalties scaled to global turnover. The digital identity framework, as identity wallets and verifiable credentials become available, supplies infrastructure the identity problem in this arrangement plainly needs: a way to bind an agent’s action to a verified person without exposing that person to every merchant.

Equivalent authentication requirements apply under the domestic regime, administered separately since divergence, with the same category of exemptions and the same structural difficulty. The distinguishing feature of the UK position is supervisory posture rather than rule text: the regulator has admitted agent-led commerce into a supervised sandbox, allowing firms to run these arrangements under observation before rules are settled. That produces something scarce elsewhere — regulatory visibility into how the arrangements actually behave, gathered before the rules that will govern them are written.

There is no federal framework addressed to agent-initiated payments. The applicable law is the existing patchwork: consumer protection rules governing electronic transfers and unauthorised transactions, state money transmission regimes that attach to parties holding or moving funds, and general prohibitions on unfair or deceptive practices. Two questions are unresolved and consequential. Whether a payment made by an agent a consumer authorised is an authorised transaction for the purposes of consumer protection — which determines what remedy exists. And whether an agent operator that holds funds, issues credentials against them, or stands between a customer and a licensed institution is performing a regulated activity, which determines whether it is inside the perimeter at all.

The supervisory literature has arrived faster than the rules. Three positions are worth holding.

The International Monetary Fund’s analysis frames the central problem as the interaction between probabilistic decision-making and infrastructures whose value depends on determinism, and separates intent formation, authorisation and settlement so that the deterministic properties of the last are preserved regardless of what happens upstream. This is the same separation the system boundary describes, arrived at independently.

Something institutions have found in practice now appears in the supervisory record: the Financial Stability Board’s consultation on responsible AI adoption accepts that continuous human review of individual agent decisions is unachievable at scale, and that oversight has to be supplemented by automated monitoring of automated activity. Human-in-the-loop remains a valid control design. Claiming it as a control now requires evidence that the review regime functions, and evidence that a review step exists no longer suffices.

Standards work on agent identity and authorisation is proceeding through adaptation of established authorisation and identity protocols and workload identity approaches. For institutions this is consequential in a practical way: the eventual requirements are likely to be recognisable extensions of controls they already operate.

Three things follow for an institution.

The obligations already apply. Delegation suspends nothing — authentication requirements, customer identification, monitoring, record-keeping and reporting all continue to bind; the compliance architecture governing those programmes governs these payments, and the reporting, records and examination obligations under regulatory operations attach to them unchanged.

Where rules are silent, the exposure is evidentiary. The activity is permitted; what an institution risks is being unable to demonstrate how it satisfied an obligation the rules do not yet describe in these terms. What was authorised, by whom, within what limits, and how that was verified — the questions in records and evidence — are the questions an examiner will ask, whatever the framework eventually says.

Rules written later will be applied to transactions made now. This is the ordinary sequence for payments regulation, and it sets the practical standard: build the evidence trail against the requirements an institution expects to be held to.