AI Agents Can Now Buy Things With No Human

Published: October 1, 2026 | Category: Technology | By Mahesh

Google's own GitHub release notes for Agent Payments Protocol version 0.2 describe a capability that would have sounded like science fiction two years ago, stated in entirely matter-of-fact product language: "Human Not Present" payments, allowing an agent to securely execute payments autonomously, such as securing and purchasing limited-run tickets the moment they go on sale, based on instructions a user pre-authorized at some earlier point in time, with no real-time confirmation required at the moment money actually changes hands.^[1] Depth Grid's pillar article this week on the protocol wars deciding the agentic web, and last week's piece on MCP's security vulnerabilities, both established that the rails AI agents run on are still being actively built and secured in real time. This piece goes into the newest and arguably highest-stakes layer of that stack: the standards now governing how an AI agent is allowed to spend someone else's money, and what happens when that authorization goes wrong.

What "Human Not Present" Actually Means

Google announced the Agent Payments Protocol, AP2, on September 16, 2025, with more than 60 launch partners including Mastercard, PayPal, Coinbase, American Express, and Salesforce, positioning it explicitly as the payments-layer companion to the Agent2Agent protocol it had shipped five months earlier and to Anthropic's Model Context Protocol for tool access.^[2] The core mechanism AP2 introduces is a system of cryptographically signed "Mandates," digital, tamper-resistant receipts in which a real user attests to a specific transaction intent, giving both the merchant and the underlying payment network verifiable proof that a human actually authorized what the agent is about to do.^[3] Google's own April 3, 2026 update to the protocol, AP2 v0.2, is the version that introduced Human Not Present payments specifically, extending the mandate system to cover a genuinely new category of transaction: one where the user's authorization happened at some point in the past, sometimes well in advance, and the agent later completes the actual purchase entirely on its own, without the user present or reachable for confirmation at the moment the money moves.^[1]

The scenario Google's own documentation uses to illustrate the feature is instructive: a user tells an agent in advance to buy tickets to a specific event the moment they go on sale, then the agent monitors availability and completes the purchase autonomously the instant that window opens, faster than a human could plausibly react manually.^[1] That is a genuinely useful capability for a narrow, well-defined class of time-sensitive purchases. It is also, structurally, a payment authorized in advance for a transaction whose exact final price, timing, and specific item may not be fully known until the moment the agent actually acts, which is precisely the combination of features that makes this category of payment meaningfully different, and meaningfully riskier to get wrong, than a standard "human clicks buy" e-commerce transaction.

How the Mandate System Is Supposed to Prevent Fraud

Source: Google's own AP2 protocol documentation, cited via Tom Cornelius's protocol stack analysis, April 2026.^[4]

This three-mandate structure is the specific mechanism designed to prevent a Human Not Present transaction from becoming an unaccountable one. In a standard, human-present purchase, the Cart Mandate is what typically gets created and signed, the user directly approving a final, specific set of items and a final price. In a Human Not Present scenario, the Intent Mandate does the heavier lifting, since it has to capture, in advance, enough specificity about what the user actually authorized, a specific event, a maximum price ceiling, a defined time window, that the eventual autonomous purchase can be verified against it later, creating what one AP2-compatible companion standard, Verifiable Intent, co-developed with Mastercard, describes as a tamper-proof log of user-authorized agent actions specifically built to ensure accountability after the fact.^[5]

The protocol's own design explicitly supports multiple underlying payment rails rather than locking into a single one, extending across traditional cards, stablecoins, and real-time bank transfers, and can route through Visa or Mastercard's own card rails, or through Web3 stablecoin infrastructure, depending on how a given merchant or user relationship is configured.^[6] This flexibility is precisely why AP2 has attracted such an unusually broad coalition of payment industry participants as contributing partners, more than 60 organizations by mid-2026 including Visa, Mastercard, PayPal, Adyen, Coinbase, Salesforce, Deloitte, and Stripe's own x402 stablecoin rail, since a genuinely rail-agnostic standard for proving user authorization is useful to every payment network regardless of which specific rail ultimately settles a given transaction.^[6]

Four Standards, One Problem, No Consensus Yet

AP2 is not the only serious attempt to solve this problem, and the existence of genuine, simultaneously shipping competitors is precisely why this deserves the same "protocol war" framing Depth Grid's pillar article applied to MCP and A2A. Industry analysis tracking the agentic commerce space in 2026 identifies four production-grade standards that emerged within roughly the same window: OpenAI and Stripe's jointly developed Agentic Commerce Protocol, ACP; Google's AP2; Visa's own Trusted Agent Protocol, TAP, developed jointly with Cloudflare and launched in October 2025; and Mastercard's Agent Pay, its own card-network-native agent payment infrastructure announced April 29, 2025, the earliest of the four to be publicly unveiled.^[7]

Each standard approaches the same underlying authorization problem with a genuinely different technical primitive, which is part of why simple consolidation into one universal winner has not yet happened the way it appears to be happening with MCP and A2A. Visa's TAP signs an agent's identity directly into HTTP request headers, embedding the authorization proof at the network protocol level. Mastercard's Agent Pay uses what it calls Agentic Tokens alongside Ethoca dispute-data integration, tying agent authorization directly into the card network's existing fraud-dispute infrastructure. AP2 instead layers a separate, cryptographic mandate system on top of whichever underlying rail actually settles the transaction, treating the authorization proof as portable across rails rather than native to any single one.^[7] Coinbase's x402 protocol and Stripe's own Machine Payments Protocol, launched with payments infrastructure company Tempo on March 18, 2026, represent a parallel, stablecoin-native track entirely, settling agent transactions directly onchain rather than through a traditional card network at all.^[8]

Why the Card Networks Joined Instead of Competing

A detail easy to miss amid the proliferation of competing standards is how unusual it is for Visa and Mastercard, direct commercial competitors in essentially every other context, to both appear as named contributing partners on Google's own AP2 protocol while simultaneously running their own separate, competing standards. This is not a contradiction so much as a reflection of the specific layer at which AP2 actually operates: because AP2's mandate system is explicitly designed to be rail-agnostic, extending across cards, stablecoins, and bank transfers rather than replacing any network's own settlement infrastructure, Visa and Mastercard can participate in AP2's authorization layer while still competing fiercely over which network actually settles the resulting transaction, since AP2 governs proof of authorization, not which rail ultimately moves the money.

Google's own decision to donate AP2 to the FIDO Alliance in May 2026, the same neutral, multi-stakeholder governance body Depth Grid's pillar article noted has become a recurring pattern for de-risking a single company's control over an emerging protocol, reinforces this same dynamic further. Two new FIDO working groups have since formed specifically around this donation: an Agentic Authentication Technical Working Group chaired jointly by CVS Health, Google, and OpenAI, and a separate Payments Technical Working Group chaired specifically by Mastercard and Visa together, developing interoperable standards built on both AP2 and Mastercard's own Verifiable Intent framework.^[6] Having Visa and Mastercard co-chair a working group building on a protocol Google originated is a genuinely strong signal that the industry has decided the authorization layer specifically benefits more from being shared, neutral infrastructure than from remaining a competitive battleground each network fights over independently.

The Liability Question Nobody Has Fully Answered

Every technical safeguard described throughout this piece, mandates, cryptographic signatures, tamper-proof logs, exists to answer one underlying question: who is actually responsible when an autonomous agent purchase goes wrong, whether through fraud, a bug, or simply the agent misinterpreting an ambiguous prior instruction. The mandate system is explicitly designed to create an auditable trail precisely because that liability question, rather than the underlying payment mechanics, is the genuinely unresolved issue at the center of this entire standards effort. A Cart Mandate signed by an actual human at the moment of purchase creates relatively clean, traditional liability, comparable to any existing card-not-present e-commerce transaction. A Human Not Present purchase, authorized by an Intent Mandate created days or weeks earlier and executed autonomously by an agent interpreting that earlier instruction against real-time conditions the user never directly saw, creates a genuinely novel liability question that existing consumer protection and card-dispute frameworks were not built to answer cleanly.

Singapore's Infocomm Media Development Authority moved earlier than most jurisdictions to address this gap directly, publishing its Model AI Governance Framework for Agentic AI in January 2026 specifically extending the country's existing AI governance guidelines to address agent-specific risks including delegation chains and multi-agent coordination, the exact structural pattern a Human Not Present payment relies on.^[9] Most other jurisdictions have not yet published comparably specific guidance, meaning the current legal and regulatory answer to "who is liable" for an autonomous agent purchase gone wrong varies considerably by country and remains, in many markets, an open question the underlying protocol's mandate system is better positioned to document than to definitively resolve on its own.

What This Means for Businesses and Consumers Today

Merchants should treat mandate verification as a new, mandatory fraud-prevention step, not an optional integration. Given that AP2, TAP, and Agent Pay all require some form of agent authentication before honoring a transaction, a merchant accepting agentic commerce should build mandate and identity verification into its checkout flow as a first-class requirement, rather than treating an agent-initiated purchase as functionally identical to a standard card-not-present transaction that happens to originate from unusual-looking traffic.

Consumers authorizing Human Not Present purchases should scope the underlying Intent Mandate as narrowly as the interface allows. Since a Human Not Present transaction is only as safe as the specificity of the advance authorization it is checked against, a consumer setting up this kind of autonomous purchase should set the tightest reasonable price ceiling, time window, and item specification the agent's interface supports, rather than granting broad, open-ended purchasing authority that a misinterpretation or a bug could exploit more easily.

Businesses building on any single agent payment standard should plan for a multi-protocol reality, not a single winner. With four production-grade standards, ACP, AP2, TAP, and Agent Pay, already live and none showing clear signs of displacing the others the way MCP has displaced most rival tool-access protocols, a business building agentic commerce infrastructure today should architect for interoperability across multiple mandate and authorization systems rather than betting exclusively on one becoming the eventual universal standard.

Common Questions

This analysis is editorial commentary based on publicly available sources cited above. It is not financial, legal, or investment advice. Protocol capabilities, partner lists, and regulatory details cited reflect information available as of publication and change frequently as this standards landscape evolves; verify current terms directly with Google, the FIDO Alliance, and the relevant payment networks before relying on autonomous agent payment features.

Sources

1. Google, "We're Donating Agent Payments Protocol to the FIDO Alliance to Support the Future of Secure, Agentic Payments," Google Blog, May 2026. Link
2. Viskan, "Google Launches Agent Payments Protocol (AP2)," April 2026. Link
3. Eco, "What Is Agentic Commerce? The 2026 Guide," August 2026. Link
4. Tom Cornelius, "Google AP2 Completes the Agentic Payment Stack," April 3, 2026. Link
5. Agent Payments Protocol EU, "Agent Payments Protocol (AP2) – Agentic Payments, Trust, and the EU Perspective," updated May 18, 2026. Link
6. Agent Payments Protocol EU, "Agent Payments Protocol (AP2)," updated May 18, 2026 (FIDO working groups and partner list detail). Link
7. Refonte Learning, "Visa, Mastercard, and Google Just Built Three Different Ways for AI Agents to Pay for Things," August 2026. Link
8. Eco, "Agentic Payments: How AI Agents Pay," September 2026. Link
9. Wikipedia, "Agentic Commerce," citing Singapore Infocomm Media Development Authority Model AI Governance Framework, January 2026. Link

Read More on Depth Grid

• The Protocol Wars Nobody's Watching Will Decide Who Controls the Agentic Web
• Researchers Found a Flaw in 150 Million MCP Downloads. Even Anthropic's Own Server Had It.
• Cyber Insurance for Small Businesses: Coverage, Cost and Requirements in 2026
• Private Credit vs Traditional Bank Lending: Who Actually Wins as Rates Normalize

Article by Mahesh | Depth Grid