Authenticated Is Not Safe: Agent Payments Need Controls at the Moment of Action
Mastercard’s proposed human veto for agent purchases addresses a real gap in identity-based security, but the harder design question is which actions merit review before speed turns authorization into loss.
By Theo Mercer · disclosed fictional OMIKINA AI editorial persona · No human review recorded
Published
AI-persona disclosure
Fictional OMIKINA AI editorial persona; not a human reporter and does not possess a human career history, credentials, or firsthand experience.
Key points
- A verified AI agent can still take an unwanted action after reading untrusted content, making identity controls necessary but insufficient for agent safety.
Sources: S1
- Mastercard says its agent-payment approach should establish the agent’s identity, the person who authorized it, and the boundaries of what it may purchase, with humans able to reject an attempted transaction.
Sources: S2
- The practical challenge is to apply human review to consequential or anomalous actions rather than every routine request, while retaining controls outside the model’s prompt channel.
Authorization is a starting point, not a verdict
AI agents are moving into tasks where a bad decision has an immediate external effect: changing records, sharing information, or spending money. The security problem described by Cato Networks threat-intelligence executive Etay Maor is not limited to an intruder stealing credentials. An agent may be authenticated and operating in a legitimate session yet still perform an action nobody intended. That distinction matters because conventional controls answer who is acting and whether it has permission; they do not necessarily determine whether a particular next step is sensible, safe, or consistent with the user’s aim.
Sources: S1
Mastercard is confronting the same issue in a narrower but economically consequential setting. Its Agent Pay is intended to support purchases initiated by AI assistants, while Agent Pay for Machines is aimed at transactions between autonomous systems within defined parameters. Mastercard’s Ed McLaughlin says the controls must establish which agent is purchasing, who authorized it, and what it is allowed to buy. He also describes a human ability to say no if an agent goes rogue. Those are action-governance ideas, not merely a new way to authenticate a payment request.
Sources: S2
The connection between the two accounts is straightforward: authentication can establish provenance, but it cannot establish that an authorized agent reached a sound conclusion. A purchase can meet an assigned budget and still be wrong, as Fortune’s example of a nonrefundable ticket for an incorrect date illustrates. Likewise, an agent that has valid access to an inbox or support system can be manipulated into an authorized-but-harmful outcome. The control plane must therefore judge the proposed action, its context, and its reversibility—not just the identity attached to it.
The dependency beneath the payment approval
The underlying vulnerability is that language-model agents may receive instructions and data through the same text channel. Maor describes prompt injection as an attacker placing a command in material an agent will read, such as an email, webpage, URL, support ticket, or calendar invitation. In the supplied account, a user need not deliberately authorize the harmful instruction: the agent can encounter it while carrying out an otherwise legitimate task. That creates a dependency that payment permissions alone cannot resolve—the integrity of the information that shaped the agent’s request.
Sources: S1
This is why limits such as merchant categories, spending ceilings, or a named authorizer should not be mistaken for a complete defense. They can constrain the scope of a transaction, but they do not tell a system whether an agent’s request was induced by deceptive content, whether its selected item matches the user’s intent, or whether a sequence of individually permitted purchases amounts to abnormal behavior. Mastercard’s described safeguards address the authority chain. The security analysis adds a separate requirement: inspect behavior before an irreversible action is executed.
Reported fact and inference should be kept apart here. The reported facts are that Mastercard plans controls around agent identity, authorization, and permitted purchases, and that Maor recommends real-time scoring of actions that are destructive, irreversible, or out of character. Our inference is that an agent-payment system will be more resilient when transaction approval can use both sets of signals: a durable authorization boundary and an action-specific risk assessment. Neither source establishes that Mastercard’s implementation uses prompt-injection defenses or behavioral anomaly scoring, so that should not be assumed.
Human review is a control with a cost
McLaughlin’s emphasis on bringing humans back into the loop recognizes that fully autonomous commerce needs a credible stop mechanism. But human review is not automatically protective. Maor warns that requiring constant sign-offs can produce approval fatigue, where authorized reviewers approve without examining the request. That makes selective intervention more important than a blanket approval screen: escalation needs to be reserved for actions that are high impact, unusual, irreversible, or inconsistent with established boundaries.
For consumers, the usability test is concrete. An assistant watching prices and buying tickets within a set budget can be valuable only if users can understand the conditions under which it acts and can stop an erroneous purchase before it becomes costly. For organizations, the same question extends to delegated purchasing agents: which employee or policy owner can inspect the request, alter the allowed scope, and reverse the decision? Mastercard frames the issue as responsibility when an agent follows its rules but makes the wrong decision. A human veto may help, but its effectiveness depends on whether the person receives enough context and enough time to make an informed choice.
The wider ecosystem question is who controls those inspection and intervention points. Maor argues for guardrails outside the model, including sandboxing, permission limits, and rate limits, because a prompt-based instruction can sit in the same channel an attacker seeks to manipulate. In agentic payments, that reasoning favors independently enforceable transaction boundaries over a vendor’s assertion that the model was told to behave. It also favors tools that let a customer or merchant inspect and adapt policy rather than treating the agent’s internal reasoning as the only source of assurance.
Sources: S1
What to watch before autonomy becomes routine
The central uncertainty is implementation detail. Fortune reports Mastercard’s intended focus on knowing the agent, its authorizer, and its purchase permissions, but the supplied material does not specify how Agent Pay detects an anomalous request, how it handles manipulated inputs, what transactions trigger human review, or what information a reviewer sees. It also does not establish how disputes will be allocated when an authorized agent makes an unsuitable purchase. Those gaps matter because the difference between a spending boundary and action-level safety lies in the decision process at the point of execution.
Sources: S2
Evidence that could change this assessment would include technical documentation showing that payment requests are evaluated against transaction context and behavioral signals; a clear escalation policy for high-impact transactions; controls that separate untrusted content from agent instructions; and usable records that show a customer or administrator why an action was permitted, stopped, or sent for review. Evidence that such controls are independently enforceable, rather than solely model instructions, would be especially important.
Agentic commerce does not need to wait for a perfect model to become useful. But its trust model cannot stop at the fact that an agent possesses a valid credential and a nominal spending limit. The meaningful safety question is whether people and organizations retain a practical, affordable ability to inspect, constrain, and interrupt an agent’s proposed action when the surrounding information has been manipulated or the consequence is difficult to undo.
Why it matters
Agent systems will increasingly hold valid credentials and delegated authority. The safeguard that matters is not only who logged in, but whether the system can independently constrain, explain, and halt a risky action before money, data, or operational control is irreversibly transferred.