When an AI agent buys something on your behalf, who is actually authorizing the transaction? For a long time, the industry has treated this as a problem for specific corners of the financial world. Issuers have looked at it through Amex Proof of Intent, networks have explored Credential Convergence, and agent developers have focused on Muse identity. Now, the conversation has moved to the middle of the stack.
The processor steps in
FIS Global has become the first major payments processor to publicly frame the agent authorization question. This positioning is notable because the processor layer sits between merchants and issuers, meaning it sees the transaction from both sides. While the volume of agent-driven payments is currently small, Troy Mann, SVP of Product Management at FIS Global, noted in a recent PYMNTS interview that consumers with stored payment credentials are already entering an ecosystem rebuilt for agentic transactions.
The core issue is that the financial system lacks a universal way to authenticate machine authority. When a human swipes a card, the intent is usually clear. When an agent acts, that intent is often buried in code or hidden behind layers of automation. As Mann put it, “Intent has to be expressed and captured.” Banks are now tasked with evaluating which agent is using a credential, what it was authorized to do, and whether the transaction matches the original mandate.
The friction debate
The industry has spent years chasing frictionless payments, but FIS is suggesting that we reconsider the push for total speed. Mann argues that “a little bit of friction isn’t a bad thing” when it comes to machine-led spending. Instead of allowing agents to use standard credentials, FIS is proposing virtual cards specifically designated for agentic commerce. These cards would come with built-in restrictions, such as limits on transaction amounts, specific merchants, or defined time windows.
This approach highlights a major hurdle: data is currently fragmented. Signals about intent, authorization, and the transactions themselves are scattered across merchants, agent platforms, networks, and issuers. While tokenization is a “major layer” of security architecture, Mann points out that it solves only part of the problem. Without a unified way to pass intent data through the payment lifecycle, processors are essentially flying blind.
A cautious path forward
FIS is currently working with financial institutions to identify agentic transactions, apply differentiated fraud scoring, and incorporate new signals across the payment lifecycle. Their strategy relies on a “crawl, walk, run” approach where humans remain involved in establishing intent and authorization. The goal is to ensure that agentic commerce changes lives “for the better, if it’s done smartly and if it’s done with transparency and trust.”
There is a practical caveat to this vision, however. Even if processors like FIS successfully implement these new authorization frameworks, the system remains highly dependent on the quality of the data provided by the agent platforms themselves. If the agent cannot clearly communicate its mandate to the processor, or if the merchant’s system fails to pass that intent signal forward, the most sophisticated virtual card controls in the world will struggle to prevent unauthorized or erroneous spending. We are essentially trying to build a new layer of trust on top of a legacy infrastructure that was never designed to verify the intent of a machine.