American Express Introduces Framework to Keep AI Agents From Spending Money Without Permission

On October 13, 2026, American Express unveiled a framework meant to guarantee that an AI agent makes only those purchases the user has actually authorized. The company is targeting two problems at once: costly agent errors, and charge disputes that will multiply as AI shopping grows. Few technical details have been made public so far. Below is what is known, what is missing, and what to watch next.

What problem is Amex solving?

For decades, payment infrastructure has rested on a simple assumption: behind every card is a person who pressed "pay" themselves. An agent breaks that assumption. It searches for a product, compares prices, fills a cart and pays. If it buys the wrong item, the wrong quantity, or something other than what was requested, the question of liability arises immediately. Who is at fault: the user, the merchant, the issuing bank or the agent's developer?

For Amex, the question is not abstract. The company is both a card issuer and a payment network, so it handles a significant share of disputes itself and is responsible for customer trust. If what the user authorized is recorded up front, a dispute stops being "he said, she said" and becomes a check of an authorization record.

What is known about the framework

The core thesis is stated clearly: the agent acts strictly within the bounds of the user's permission. The original announcement does not say how this works technically. It could be tokens with limits, signed instructions or confirmation in the bank's app. For now these are only possibilities, not facts about the product.

• Stated goal: purchases only within the user's explicit permission.
• Risks it addresses: erroneous purchases and the payment disputes that follow.
• Context: rapid growth in purchases made by AI agents.
• Not disclosed: launch timeline, partners among agent developers and merchants, technical standard.
• Not disclosed: rules for allocating liability if the agent makes a mistake anyway.

The last point matters more than the rest. How losses are allocated will determine whether the framework becomes a working tool or stays a declaration.

The market around it

Amex is not alone here. In 2025, Visa and Mastercard announced their own initiatives for agent-based payments (Visa Intelligent Commerce and Mastercard Agent Pay), and Google proposed an open protocol, AP2. The underlying logic is similar across all of them. An agent needs separate credentials, limited by amount, merchant and time. It also needs a verifiable trail showing that the user authorized the purchase. The Amex framework follows the same trajectory, but the company's closed model, in which it controls both card issuance and the network, gives it the ability to enforce rules across the entire chain.

The main challenge lies elsewhere. As long as each network builds its own rules, agent developers will have to support multiple authorization schemes. Interoperability, or at least mutual recognition of mandates, will determine how quickly agent purchases move beyond demos.

Practical takeaways

Agent developers should already be designing purchases with explicit limits: amount, category, merchant list and permission expiry. These constraints will be useful under any standard. Merchants will need to understand how an agent transaction will be flagged and who bears the loss in a dispute. Users should look not at security claims but at settings: whether the agent can be limited by amount and category, whether a notification arrives before the charge, and how to dispute a purchase the agent made by mistake.

The full launch, partner terms and liability rules will show how much the Amex framework changes practice. For now it records the key point: payment companies acknowledge that agents need a separate circuit of trust.