Permission Tokens

A permission token is a spending authorization an AI agent carries instead of your payment credentials: it lets the agent pay for things within limits you set, like a budget, an expiry date, or an approved list of merchants, and those limits are checked again at the moment the money moves. Because the agent never holds your card or account details, off-limits spending can be blocked at the source and the grant can be revoked in one step.

Think of it like handing an intern a prepaid company card with the rules printed on it instead of handing over your whole wallet. The card holds a fixed amount, works only at approved shops, stops working on Friday, and you can cut it off at any time. A permission token does the same job for an AI agent, except the rules are enforced by software at the moment of payment. Nevermined’s budget grants put it plainly: its grant is ‘capped in money, bounded in time, scoped to one thing, visible line by line, and revocable in a click’.

The protocols built for agent payments share one diagnosis. As the Agent Payments Protocol documentation puts it, ‘Today’s payment systems assume a human is directly clicking buy on a trusted website. When an autonomous agent initiates a payment, this core assumption is broken.’ The permission-token answer has three moves. First the user sets the policy: how much, for how long, and what for. Then the policy is sealed into the token, often as a signed document. Finally, when the agent pays, the payment network or server checks the token’s rules before approving anything.

Three lookalikes cause most of the confusion. First, agent identity: identity answers ‘who is this agent?’ through registration and authentication, while a permission token answers ‘what may it spend?’. The two pair up but do different jobs, which is why Mastercard’s Agent Pay program treats ‘registering and authenticating trusted agents’ and ‘clear rules for consumer control’ as separate steps. Second, settlement rails like stablecoins, the x402 protocol, and the Machine Payments Protocol: those move and settle the money, while the permission token decides whether the payment is allowed to happen at all. Third, ordinary payment tokenization, which swaps the card number for a stand-in credential to reduce theft but leaves the card’s spending power intact; a permission token attaches the rules to the spending itself.

The same idea ships under several names. Google’s Agent Payments Protocol encodes the user’s rules as signed payment mandates, where an open payment mandate ‘captures the user’s constraints on payment (e.g., budget, allowed instruments) for autonomous execution’ before any specific purchase exists. Mastercard calls its variant agentic tokens, built on card tokenization but adding that ‘consumers will have complete control over what the agent is allowed to purchase on their behalf’. Visa’s Trusted Agent Protocol has agents pass a hashed payment credential along with signatures that are ‘time bound, cannot be replayed or relayed’. Nevermined calls its version a budget grant. No single umbrella name has won yet.

Why the shift matters: an agent holding delegated card access can spend until someone notices, while an agent holding a permission token cannot spend past its grant at all. In one recorded example, Nevermined gave three assistants (Claude, ChatGPT, and a LangSmith Fleet agent) one small budget each; between them they paid five different vendors, spent under four cents in total, and every payment appeared on the record line by line. Those results are company-reported, but the shape is the point: budget first, credentials never, every call visible. That shape is what permission tokens bring to agentic commerce.