The Rails Shipped Before the Riders

Since September 2025 the payments industry has built the machinery an AI agent needs to prove it may spend money. There are signed mandates, scoped single-use tokens, HTTP signatures that tell a merchant which agent is knocking, and a revived HTTP status code, 402 Payment Required. Google gave its protocol to the FIDO Alliance. Coinbase's went to the Linux Foundation, with Visa, Mastercard, American Express, Stripe and Google as members.

Then the flagship consumer launch went backwards. OpenAI pulled native checkout out of ChatGPT in March. x402, the open rail built for agents paying per request, settled about $274,000 in October. Visa, which says agents are already buying across Europe, hasn't published a volume figure for it.

That is agentic finance in November 2026: the rails shipped before the riders. This is a map of what exists, what is actually moving, what goes wrong, and how to wire an agent to money without regretting it.

Two meanings, one word

"Agentic finance" is used for two different things.

Agents that pay. An agent buys, books, subscribes or pays per API call on someone's behalf. The vendors call this agentic commerce or agentic payments. Stripe's docs put it simply: "Agentic commerce lets AI agents transact for the people they serve."

Agents inside financial firms. Agents reconcile ledgers, screen customers and draft research for banks and asset managers, with people signing off.

Regulators use the phrase for both. The UK Financial Conduct Authority's Mills Review (July 2026) has a recommendation titled "Enable the foundations for agentic finance." Singapore's MAS and an industry group published a white paper called "Safeguards for Agentic Finance at Runtime" the same month.

The cleanest frame I found for the first meaning comes from an IMF note from April 2026. It splits an agent payment into three layers:

• Intent: the agent "interprets user objectives and translates goals into payment-related tasks".
• Authorization: where it gets hard, "creating a tension between probabilistic AI behavior and deterministic authorization rules".
• Settlement: where "control and finality are critical".

Almost everything shipped since September 2025 lives in the middle layer. It is machinery for proving that a probabilistic system was allowed to do a deterministic thing.

The rails

Here are the main protocols and products, with their status as of mid-November 2026.

Google also has the Universal Commerce Protocol, which Shopify calls "the open standard we co-developed with Google." Ant International has its own Agentic Mobile Protocol.

Two things stand out in that table. First, everyone agrees on the shape of the answer: a credential that is narrow, signed and short-lived, never the card itself. AP2's overview says "Transactions must be anchored to deterministic, non-repudiable proof of intent from all parties." The x402 README says payment schemes "must not allow for the facilitator or resource server to move funds, other than in accordance with client intentions." Both describe signed, scoped permission the agent can't widen. Second, there are at least nine overlapping ways to express it. Adyen, which supports UCP, AP2, ACP and Meta's checkout, states the problem plainly: "Every new agentic surface asks merchants to rebuild from scratch."

The x402 Foundation may become the place where this consolidates. Its premier members, per the Linux Foundation's July release, include Adyen, AWS, American Express, Circle, Cloudflare, Coinbase, Fiserv, Google, Mastercard, Shopify, Stripe and Visa. That is my inference about where things are heading, not anything those companies have announced.

Most builders will meet these rails through Stripe, so note how much of its stack is preview. Issuing for agents, agent identities and Radar's agent detection are all in preview. Link Agent Wallet serves agent payments for US and Canadian customers. Stripe's own Sessions 2026 post calls its roadmap "not a commitment."

What is actually moving

The flagship retreat. ChatGPT's Instant Checkout let people buy from Shopify merchants without leaving the chat. In March 2026 OpenAI scaled it back. Its own post said the first version "did not offer the level of flexibility" (quoted by Modern Retail, 27 March). Modern Retail also reported that Walmart's Daniel Danker said conversion was three times lower inside the chatbot than when shoppers clicked out to Walmart's site. Forrester, writing on 7 March, cited a report of about a dozen Shopify merchants live, while Shopify told Forrester it was closer to 30. Shopify's current setup sends ChatGPT shoppers through an in-app browser, with the merchant staying merchant of record.

The crypto rail's real numbers. Fireblocks, cited by Decrypt on 4 November, counts more than 196 million x402 transactions across 12 chains, settling more than $42 million, as of 1 November. Decrypt puts October at about 5.1 million transactions worth about $274,000. And "more than half of x402's lifetime transactions came from a two-month frenzy in late 2025," when traders ran scripts to mint and sell a token issued through x402. My arithmetic: October averaged about five cents a payment. That fits pay-per-call APIs, which is what x402 was built for. It is not shopping.

Coinbase says more than 97% of onchain agent transactions in Q2 2026 used x402. That is a vendor claim about a small market.

The networks' silence. In December 2025 Visa said it had completed "hundreds" of agent-initiated transactions with partners. Its July 2026 European release says "AI agents now transacting based on cardholder instructions directly with independent merchants" and gives no volume. Payments Dive's report on its October earnings call gives no agent volume; it quotes CEO Ryan McInerney on disputes: "We want to make sure that there's a clear path to resolution in the event of a problem." In the July release, the CEO of lastminute.com, one of the launch merchants, called it "Early days - but exactly the right thing to be testing."

The buyers. Gartner surveyed 322 US consumers in January 2026. Willingness to let AI make the purchase decision "peaked at 11%," in lower-stakes categories. Gartner's Kate Muhl: "Consumers are not looking to outsource shopping decisions to AI." Forrester's survey found in-engine purchasing ranked as people's least-used activity, even though 35% of Gen Z and 32% of Millennial US online adults had used ChatGPT to search for products in the past month. The FCA review notes 20% of consumers would likely use AI "capable of acting autonomously within pre-set goals." People use AI to search, then finish the purchase themselves.

The big forecasts measure something else. The most-quoted one, McKinsey's trillion-dollar US figure for 2030, counts revenue agents "orchestrate", not purchases they complete, according to trade-press coverage of it. I couldn't open the original.

Inside the banks, agents have logins

The other meaning of agentic finance is further along, and it looks different. These agents work in the back office, and a person signs off.

• Goldman Sachs and Anthropic. CNBC reported in February, and Goldman confirmed, that Anthropic engineers spent about six months embedded at the bank. They built agents for trade and transaction accounting, client due diligence and onboarding. The work is "still in the early stages," and no results were given.
• BNY. Its "digital employees" have their own system logins and human managers. CEO Robin Vince, via Reuters in July: "The digital employee has a login, it can actually operate in the systems."
• UBS. Agents generate thousands of alerts a day for financial advisors and can execute trades and transfers once an advisor approves.
• Morgan Stanley. It is opening its ShareWorks and Equity Edge platforms to outside agents and says humans keep oversight.
• FIS. It says an agent "compresses AML investigations from days to minutes." That is a company claim, published by Anthropic.
• JPMorgan. Its researchers tested eight AI agents, but only in backtests over about two decades. The best added 0.7 percentage points a year over a 60/40 portfolio.

Per the same Reuters report, KPMG puts the share of banks piloting agents at 51%. Bain's Bhavi Mehta says banks are "being extremely cautious when it touches the customer." I found no independent measurement of results for any of these deployments.

The tooling is now packaged. Anthropic's May release ships ten finance agent templates, including a general-ledger reconciler, a month-end closer and a KYC screener. They run as plugins in Claude Code and Claude Cowork, and Anthropic says users "stay firmly in the loop." I build with Claude Code every day, so weigh my reading of Anthropic's material with that in mind. Central banks are rehearsing too: the BIS Innovation Hub's Project Agenti, with the Bank of Canada and the Swiss National Bank, is a simulator where agents operate inside a mock settlement system.

The common pattern is the one the Euro Banking Association wrote into its June report: "'human in command' checkpoints for critical decisions" and "explicitly bounded decision rights for agents."

What goes wrong

Prompt injection with a wallet attached. In May 2026 an X user drained between $150,000 and $174,000 from an AI-controlled wallet tied to Grok and the Bankr bot. Per Giskard's write-up, an NFT gave the wallet "Executive" permissions, and a message in Morse code decoded into a token transfer. "Bankrbot received the decoded output and treated it as a valid, authenticated command." About 80% was returned. Researchers at the University of Georgia published a red-team study of AP2 in January with two attacks: one manipulates product rankings, one extracts sensitive data. I saw only summaries of its abstract.

Nobody owns the mistake yet. AP2's own overview asks the question directly: "In the event of a fraudulent or erroneous transaction, who is accountable? The user who delegated the task? The developer of the shopping agent? The merchant ...?" American Express is the only issuer I found that has committed to cover "registered agent error," and only when the agent is registered and the intent authenticated. I found no card-network dispute rule written for agent purchases. In the US, the think tank ITIF argued in March that "As written, Regulation E would leave consumers without the dispute rights they rely upon." I found no formal 2026 statement from the CFPB or the SEC.

Merchants may not want your agent. Amazon sued Perplexity over its Comet browser agent and won a preliminary injunction in March. The Ninth Circuit vacated it, as reported in August, saying "Perplexity's AI Assistant operates as a tool acting on the user's instructions," a ruling it limited to the record before it. The case went back to the lower court.

Who is this agent? Visa, Mastercard and Ant International started work in September on an interoperable "know your agent" framework that links their three protocols, run through MAS's BuildFin.ai. It has no published spec yet.

Rules are coming, slowly. The FCA review is advice to its board, not rules. MAS's white paper asks for "policy bound execution" and "real time validation". In the US, the GENIUS Act for stablecoins takes effect on 18 January 2027, and the OCC finalized its implementing rule on 21 October 2026.

How to wire an agent to money

Every serious vendor document converges on the same handful of controls. This is the checklist I would hold any agent to before it touches a real payment method.

1. Give it a scoped credential, never the card. A Stripe Shared Payment Token carries usage_limits with a max_amount and expires_at, is scoped to one seller, and can be revoked. Link Agent Wallet returns a one-time virtual card or token. Issuing for agents (preview) issues single-use virtual cards.
2. Put the limits in the credential, not the prompt. Link exposes per-transaction, daily and 30-day spend limits. A model can be talked out of an instruction. It can't be talked out of a token that is worth at most $35.
3. Approve on a surface the agent can't reach. Link sends the spend request to the customer's Link app, where it must be approved within 30 minutes. The request's context text, at least 100 characters, is what the customer reads, so make it specific. AP2 calls this the "Trusted Surface". Stripe MCP marks money-moving tools, such as Treasury transfers, as needing human confirmation in the Dashboard. That is separate from your MCP client's approval prompt, so use both.
4. Use one idempotency key per purchase attempt. Link's docs: "Use a key that's unique to the logical purchase attempt ... Don't reuse the same key for a different purchase." Agents retry, and a retry must not become a second purchase.
5. Keep card numbers out of the transcript. Link's CLI warns that printing card details to stdout puts "the full PAN, CVC, and billing address" where "it can be captured in model context, agent transcripts, and log aggregation." Write them to a file, or better, never handle them.
6. Use agent-tagged, least-privilege keys. Stripe MCP stops accepting full-access secret keys and untagged restricted keys in December: "Migrate by November 30, 2026." Stripe's old @stripe/agent-toolkit package is deprecated in favour of the hosted MCP server.
7. Treat every other tool's output as hostile. Stripe's own MCP docs warn you to "exercise caution when using the Stripe MCP with other servers to avoid prompt injection attacks." An agent that reads untrusted text and holds a payment tool is the Bankr setup.
8. Log from the payment side, not the agent side. Subscribe to the webhooks (shared_payment.issued_token.used, .deactivated, .requires_action). Your audit trail should not depend on the agent remembering what it did.
9. Start in test mode and stay there longer than feels necessary. Most of this stack is beta or preview: ACP, the SPT API, Issuing for agents, Anthropic's Managed Agents.

Where I land

The obvious fallback is that the real value sits in machine-to-machine pay-per-call and in back-office agents. The shape of that argument is right. A five-cent API call fits HTTP 402 far better than a card rail: Stripe's card minimum through Shared Payment Tokens is 0.50 USD, while its stablecoin minimum is 0.01 USDC. Back-office work keeps a human in command by design. But the evidence is thin on both sides. x402's October volume was tiny, and no bank deployment I found has published an independently measured result. Call it well-shaped and unproven.

The deeper point is that these protocols solve authorization, the middle layer of the IMF frame. Signed mandates, scoped tokens and RFC 9421 signatures are good engineering. They prove what you allowed. They don't decide who pays when what you allowed turns out to be a mistake. Until a network writes that rule, or more issuers follow Amex, autonomous consumer shopping stays marginal, whatever AP2's "Human Not Present" mandate can express.

So, as an engineer, I would do four things. Learn the authorization layer now, because it is open and testable today. Build pay-per-call where your users are other programs. Build the approval surface everywhere else, because that is the part consumers will have to trust. And watch the dispute rules.