Agent Payment Risk Platforms: Who Screens AI Payments
Quick answer. AP2 verifies mandates, Visa and Mastercard verify agents, Stripe Radar flags agent payments for your rules, Skyfire and Sardine verify identity, Natural, Meow and Payman add limits and approvals on bank rails, and Coinbase CDP enforces signing policy. Each screens one step; your policy decides.
Video transcript
An AI agent that pays acts for a customer, but its instructions can come from anything it reads. Who screens it?
Agent payments add three questions: which agent, on what instruction, within what limit. No single platform answers all three yet.
A P two verifies mandates, Visa and Mastercard verify agents, Stripe Radar flags agent payments. Skyfire and Sardine verify identity. Agent banking APIs hold over-limit ACH and wire payments for a human. Coinbase and x four oh two guard signing and settlement.
Most programs need more than one. A mandate proves consent, a fraud score judges risk, and a signing policy caps the damage.
Mastercard's AI-initiation score is rolling out for US testing. Visa's token assurance signal has no dates or regions. Know Your Agent interoperability has no implementation date.
Require these controls and test each one: agent identity, consent outside the agent, scoped credentials, hard limits in code, fail closed, and stored evidence.
Amount checks break in real code. In Guardian's FastLane Protocol review, a capped agent withdrawal could burn the full requested shares. The resolved finding sat in a smart contract, but the test carries over.
Then ask vendors where the check runs, what the score measures, what happens on failure or timeout, and whether it has been pentested.
Read the full comparison, or talk to Guardian about pentesting the signing and value-moving flows behind agent payments.
Why Agent Payments Need Their Own Checks
An AI agent that pays is a new kind of payer. It acts for a customer, but its instructions can come from anything it reads.
Card fraud models were built to ask whether the cardholder is genuine. Agent payments add three questions: which agent, acting on what instruction, within what limit.
Mastercard framed the same problem on September 30, 2026: banks and merchants need to know when an agent is involved, what it was asked to do and whether the activity is legitimate. Mastercard Investor Relations via Business Wire
No single platform answers all three yet. This guide maps who checks what, and where each check sits before authorization.
For the control framework behind these vendors, read agentic payments security for banks and fintechs.
Platform Categories
Most programs need more than one. A mandate proves consent, a fraud score judges risk, and a signing policy caps the damage.
Onchain monitoring and pre-signing guards, compared in Hypernative vs Hexagate vs Blockaid, are a neighboring category. They screen transactions, not agent identity or consent.
- Mandate verifiers check a payment against what the user signed, before credentials are released. Example: Google's AP2. Google Cloud, Google Agentic Commerce (GitHub)
- Network agent programs register agents, bind them to tokens and run network risk at authorization. Examples: Visa and Mastercard. Visa Developer Center, Mastercard Investor Relations via Business Wire
- Agent identity providers tie an agent to a verified operator or human before checkout. Examples: Skyfire, Sardine and Forter. Skyfire, Sardine, Forter
- PSP fraud and token controls score the transaction and scope the credential the agent carries. Example: Stripe. Stripe
- Agent wallets and issuing hold approvals, budgets and per-purchase cards. Examples: Link (US only for now) and Stripe Issuing. Link (Stripe)
- Agent banking APIs let agents send ACH, wire or realtime payments under caps and human approvals the agent cannot clear. Examples: Natural, Meow, Payman. Natural, Natural Docs, Meow (Help Center), Payman AI
- Bank-side A2A risk scores and control layers. Examples: Visa A2A Protect (not agent-specific) and Backbase (described in a blog, no availability date). Visa, Backbase
- Onchain controls enforce policy at the signing key or verify a machine payment before settlement. Examples: Coinbase CDP and x402. Coinbase Developer Platform, x402 Foundation (GitHub)
Platforms Compared
Google announced AP2 on September 16, 2025, and its mandates also cover real-time bank transfers. Signed Intent and Cart Mandates bind a purchase to the user's instructions, price limits and timing. Google Cloud
Its verifier returns a signed receipt for each decision. Unknown constraints must fail. Google Agentic Commerce (GitHub)
Visa Intelligent Commerce registers agents with the Visa Agent Registry Service and validates each purchase against the consumer's instruction before returning a token. VisaNet then runs network risk and fraud checks at authorization. Visa Developer Center
On June 10, 2026, Visa announced a token assurance signal giving issuers a per-transaction trust signal, including for agent payments, with no dates or regions. Visa
Mastercard Agent Pay builds Agentic Tokens on its existing tokenization. Mastercard Investor Relations via Business Wire
Mastercard's AI-initiation score estimates whether an agent started the payment, not whether the payment is fraud. Its production accuracy is not yet public.
Mastercard is also working with Skyfire, a Know Your Agent provider, and with Cloudflare on privacy-preserving environments to understand AI-driven payment activity.
On September 10, 2026, Ant International, Mastercard and Visa began Know Your Agent interoperability work, with no implementation date. The Asian Banker (press release reprint of Ant International, Mastercard and Visa joint release)
| Platform | What it checks | Where it sits | Status |
|---|---|---|---|
| Google AP2 | Signed mandates, claim consistency and constraints | Before payment credentials are linked | Open protocol; contributed to FIDO Alliance Apr 28, 2026 |
| Visa TAP and Intelligent Commerce | Signed agent requests, purchase instructions, passkeys, agent tokens | Merchant edge, then VisaNet authorization | Onboarding, certification, approval per stage |
| Mastercard Agent Pay and intelligence | Registered agents, Agentic Tokens, AI-initiation score | Tokenization through authorization; review flags | Nearly all cards enabled (Apr 2026); AI score in US testing |
| Stripe Radar and Shared Payment Tokens | Dispute, card-testing, stolen-card, issuer-decline signals; seller, amount, time scoping | PSP, before the charge | Confirm coverage per market |
| Visa A2A Protect | Unified fraud score; scams before authorization | Bank, before money leaves | Announced Sep 1, 2026; agents not mentioned |
| Natural | Per-transaction, daily, monthly caps; breaches held for human approval | Bank API, before ACH, wire or RTP/FedNow | Direct launched Oct 29, 2026 |
| Meow | Approval workflows; initiator cannot self-approve; daily spend bands | Bank account, before ACH, wire or USDC | No availability terms published |
| Payman | Staff approvals, limits outside the model, fraud screening | Bank or credit union, before ACH or wire | Citizens State Bank customer transactions pending |
| Skyfire KYA | Verified operator identity, signed tokens, per-agent spending limits | Seller, before access or payment | Documented; KYA is optional |
| Sardine Know Your Human | Human's device and behavior signals bound to the agent | Merchant, before order approval | No availability date stated |
| Coinbase CDP Server Wallets | Value caps, allowlists, networks, calldata; OFAC sanctions screening | Signing layer, before broadcast | Docs list no rate or KYT criteria |
| x402 facilitator | Payment payload against server requirements | Before serving, then onchain settlement | Open protocol; server keeps policy |
Beyond the Card Networks
Stripe's Shared Payment Tokens let an agent pay without exposing card details. Stripe
Stripe Radar's is_agent_initiated attribute lets merchants with custom rules block, review or request 3D Secure for agent payments. Stripe Docs
Skyfire KYA attaches a verified person or organization to an agent. If the buyer lacks the verification a service requires, token creation fails and the payment stops. Skyfire
Sardine's Know Your Human protocol has the merchant send a short-lived SMS or email link that captures device and behavior signals, linked at checkout by a code. Sardine
Forter Agentic Orchestration also sits at merchant checkout, using identity intelligence to know the human behind the agent. Forter
Natural sets per-transaction, daily and monthly caps; the tightest wins. A breaching payment is held for approval, which an agent can never clear. Natural Docs
Meow lets agents start ACH and wire payments, but they cannot bypass configured approval workflows. Initiators cannot approve their own requests. Meow (Help Center)
On Payman, the institution decides which actions and amounts need staff approval, and transfers are fraud screened. Payman AI
Coinbase CDP checks each signing request against a project policy, then an account policy. Within a policy, a matching reject rule beats any accept rule. Coinbase Developer Platform
Coinbase screens every CDP wallet transfer against the OFAC sanctions list before it goes onchain. Our AI trading agent security guide covers the wider agent wallet threat model. Coinbase Developer Platform Docs
An x402 facilitator verifies and settles, but holds no funds. The resource server still decides whether to serve; our x402 facilitator security checklist covers the gap between those steps. x402 Foundation (GitHub)
AI Agent Payment Authorization Controls
Require these controls in your own stack, and test each one. Coinbase CDP policies, Skyfire verification levels and Stripe Radar custom rules for agent-initiated payments, where your plan allows, are all yours to set. Coinbase Developer Platform, Skyfire, Stripe Docs, Stripe
Amount consistency breaks in real code. In Guardian's FastLane Protocol review, an authorized agent address withdrawing from a user's committed balance could burn the full requested shares after a liquidity cap cut the payout. Guardian
The Medium finding was resolved. It sat in a smart contract, not a payment platform, but the test carries over: compare what was approved with what was debited.
Prompt injection can steer an agent before any of these checks run. Test that path with our LLM pentesting checklist.
- Agent identity: verify a registered agent's signature on every request, linked to an accountable operator.
- Consent outside the agent: customers approve on a surface the agent cannot write to, such as a passkey prompt.
- Scoped credentials: tokens bound to merchant, amount and expiry, never a reusable card number.
- Hard limits in code: per-payment caps, budgets, payee allowlists and velocity limits at signing or authorization.
- Fail closed: reject unknown constraints, missing receipts and unverified agents instead of falling back to a weaker path.
- Evidence: mandates, receipts, scores and decisions stored against each payment for disputes.
Questions to Ask Vendors
Visa requires onboarding, certification and approval at each environment stage before production; confirm issuer participation and commercial terms before you set a launch date. Visa Developer Center
| Question | Evidence to ask for | Red flag |
|---|---|---|
| Where does your check run in the flow? | Sequence diagram up to authorization or signing | Checks only after settlement |
| What does the score measure? | Signal list, model scope, measured accuracy | One score sold as both identity and fraud risk |
| Can we apply our own risk policy? | Configurable rules, thresholds and review queue | Opaque vendor decision you cannot override |
| What happens on failure or timeout? | Documented fail-closed behavior and error codes | Silent fallback to unscoped credentials |
| Which markets and card types are live? | Coverage list with production dates | Tests or pilots described as general availability |
| Has the integration been pentested? | Recent report covering APIs, signing and policy bypass | No independent test of enforcement |
Frequently Asked Questions
What does an AP2 Mandate Receipt prove?
It records the verifier's identifier, the result and a hash of the mandate it checked, with error details on failure. Keep it with the payment, so you can later show which authorization the payment relied on. Google Agentic Commerce (GitHub)
Can banks build on Mastercard's AI-initiation score now?
It is rolling out for testing in the US. Mastercard plans to add behavior, merchant risk, transaction patterns, credential risk and consumer propensity signals over time. Ask Mastercard about access, terms and measured accuracy before you plan around it. Mastercard Investor Relations via Business Wire
Which platforms cover stablecoin agent payments?
Coinbase CDP and x402 work onchain, and Stripe supports stablecoins as well as cards through the Machine Payments Protocol (MPP). Meow lets agents send USDC, and its configured approval workflows still apply. Coinbase Developer Platform, Stripe, x402 Foundation (GitHub), Meow (Help Center)
Is Visa's Agent Score a transaction risk score?
No. Visa describes Agent Score as a way for merchants to check whether their websites are ready for agentic commerce. Its Large Transaction Model targets fraud and authorization broadly, and Visa does not limit it to agent payments. Visa
Related reading
- agentic payments security
- x402 facilitator security checklist
- ai trading agent security
- llm pentesting checklist
- mcp pentesting checklist
Sources
- Google Cloud: Powering AI commerce with the new Agent Payments Protocol (AP2)
- Google Agentic Commerce (GitHub): AP2 Agent Authorization
- Visa Developer Center: Visa Intelligent Commerce developer documentation
- Visa Developer Center: Trusted Agent Protocol
- Mastercard Investor Relations via Business Wire: Mastercard unveils Agent Pay
- Mastercard Investor Relations via Business Wire: Mastercard advances agentic commerce with new trust and intelligence services
- Stripe: Stripe Agentic Commerce
- Stripe: Agentic Commerce: A Getting Started Guide
- Link (Stripe): Give your agent a wallet you control
- Coinbase Developer Platform: CDP Server Wallets
- Coinbase Developer Platform: CDP Wallet Policies
- x402 Foundation (GitHub): x402 Facilitator
- Guardian: FastLane Protocol review: Agent Withdraw Burn Mismatch
- Guardian: FastLane ShMonad Updates review
- Guardian: LayerZero Canton VER review
- Guardian: LayerZero Canton DAML review
- Guardian: Bounce USDC Updates review
- Guardian: Bounce Automation Layer and Contract Updates review
- Guardian: Abracadabra GMX V2 Cauldron review
- Visa: Visa Announces New AI, Stablecoin and Token Innovations to Power Intelligent, Programmable Commerce at Visa Payments Forum
- The Asian Banker (press release reprint of Ant International, Mastercard and Visa joint release): Ant International, Mastercard and Visa Initiate Collaboration on Know-Your-Agent Interoperability to Scale Agentic Commerce
- Skyfire: Know Your Agent (KYA)
- Skyfire: Verify and Extract Data from Tokens
- Skyfire: KYA & Payments for Agents
- Sardine: Know Your Human (KYH) for Agentic Commerce
- Forter: Forter Agentic Commerce
- Coinbase Developer Platform: Policy Engine API reference
- Backbase: Agentic payments: why banks need a bank-side control layer
- Visa: Visa Launches Enhanced A2A Protect Innovations to Help Financial Institutions Stop Fraud Before Money Leaves Accounts
- Fiserv (press release hosted by AWS Press Center): Fiserv Launches agentOS: The Operating System for Agentic AI in Banking
- Stripe Docs: Radar rules: Supported attributes
- Stripe: Agentic Commerce: A Getting Started Guide (retailers and ecommerce businesses)
- Sardine: Know Your Human (KYH): Fraud prevention for agentic commerce
- The Paypers: Sardine launches Know Your Human protocol for AI agents
- Coinbase Developer Platform Docs: Security overview: CDP Wallets
- Meow (Help Center): What can an AI agent do on my Meow account?
- Meow (Help Center): How do I set up approval workflows for transfers and payments?
- Meow (Help Center): How to setup Spend Controls for your Business Checking account
- Meow: Meow blog: 2026, agents move money
- Payman AI: Agentic Banking
- Natural: Introducing Natural Direct
- Natural Docs: Limits overview
- Natural Docs: Approvals overview
- FIDO Alliance: FIDO Alliance to Develop Standards for Trusted AI Agent Interactions
- PYMNTS: Mastercard Sees Agentic Commerce Growth Despite Travel Headwinds
Test the controls before agents spend
Guardian pentests the APIs, automated signing and value-moving flows behind agent payments, checking that approvals, limits and signing policies hold against hostile inputs.