The authorization problem at the center of AI-agent commerce is structural. When a software agent transacts on a user's behalf, the existing card network architecture has no native mechanism to confirm that the agent was authorized to act, or to flag when its transaction behavior departs from the user's original intent. Visa, Mastercard, and Ant International are now working together to close that gap, developing common standards for AI-agent payments that span both verification and ongoing transaction monitoring.
The constraint the payment stack was not built to handle
Card payment infrastructure was designed around a cardholder-present or cardholder-not-present binary. An autonomous agent presenting credentials on a principal's behalf fits neither category cleanly. The verification problem runs in two directions: confirming at initiation that the agent holds genuine delegated authority, and sustaining surveillance afterward, because agents can execute transactions at a speed and volume no human cardholder would.
A standard limited to entry-point checks leaves a wide window for compromised or runaway agent behavior. The common-standards effort needs to address the full transaction lifecycle, from initial authorization through ongoing behavioral monitoring, and to do so in terms consistent enough that merchants and issuing banks can implement them without each building its own interpretation of what agent authority means.
The three companies are building shared frameworks to cover both layers. The collaboration explicitly targets verification and monitoring of agent transactions.
Where the work sits in the stack
Visa and Mastercard supply the network rails any practical agent-payment standard must run across. Ant International is a participant in the initiative, though the announcement does not detail the division of technical work or a target timeline for a finalized specification.
The initiative covers authentication (whether an agent is permitted to transact at all) and behavioral surveillance (whether it remains within the parameters the human principal set). Getting those two functions into a shared specification is the precondition for consistent implementation across card networks, issuers, and merchants. The monitoring component, given the transaction velocity agents can achieve, carries the larger operational stakes.