Ask who decides whether your agent can pay and you no longer get an answer about the moment money moves. The decision has moved upstream, out of the checkout and into an authorization artifact: a contract clause, a directory registration, a published scope, a minted token, a network enrollment. Whoever owns that artifact can meter it, gate it, price it, or pull it back. That is the ground this piece covers, and it sits beside three we published this week: the pilot wall, which asks who eats the loss when an agent buys wrong; the retailer readiness gap, which asks who holds the data agents need; and Walmart’s rulebook, which asks who writes the terms. None of the three asks who owns the authorization decision itself. Seven answers to that question are now on the record.
The bank says no. Between October 13 and 16, 2026, JPMorgan Chase, Bank of America, Citi, Schwab and Wells Fargo moved to restrict agents: four hard blocks and one contract rewrite. Jamie Dimon, on JPMorgan’s third-quarter call: “You don’t want rogue agents, and it could be thousands of them.” Bank of America’s Brian Moynihan: “We strongly believe there should be a human in the loop to authorise money moving out of your account.” Schwab’s Rick Wurster counts the agents his firm blocks “in the tens and twenties” each week and asks “who’s liable?” The decision in this answer is a veto.
Wells Fargo says you did. Its Online Access Agreement, version effective November 24, 2026, answers the question in Section 15: instructions and transactions initiated by an agent “are deemed to have been initiated and authorized directly by you, without further verification,” and “Your use of any AI Agent is AT YOUR OWN RISK.” The same section disclaims any duty to monitor or screen agent activity, and reserves the bank’s right to require that agents be registered with it. Authorization is granted in advance by contract, and the switch stays in the bank’s hand.
The buyer already did. Visa, BILL and Billtrust launched their pilot from Las Vegas on October 20, 2026, at 8:00 a.m. EDT. The release FAQ is blunt: “The agent only executes eligible payments that have already been approved by the buyer.” The registered BILL Payment Agent authenticates through Visa’s Trusted Agent Protocol and Agentic Directory using tokenized credentials. Approval exists before the agent appears, and registration in a directory is the gate. One sourcing note on the record: our fetch of the release’s canonical Business Wire page was refused, so the wording above comes from the syndicated copy of that same release.
Poppy says the company does. The Personal Agent Protocol, announced by Sierra and Meta on October 6, replaces the binary with a spectrum – blocked, search, view, act with approval, full access – published as scopes a company chooses to expose. Its own framing: “Today it is all or nothing: the company blocks the agent, or the agent signs in as the person and can do anything they can.” It is a draft working toward 1.0, and payments sit deliberately outside the core spec, left to extensions. The permission tier is a configuration file now, which is exactly where a meter would go.
The credential decides. Evervault’s Browser Tokens, launched October 20 at Money20/20, lock the host allowlist and a 15-minute lifetime at the moment of mint and cannot be expanded afterward – and the company prices the result at $0.25 per card session. The authorization object is not a policy discussion. It is a line item.
The human still keys it. Sierra and Stripe’s phone flow, live October 20, hands the keypad to the customer: digits route straight to Stripe, and the agent sees only payment status and the last four digits. Sierra reports 71.3% of started payments complete, a vendor figure with no published methodology. Here the deciding act is a person typing.
The network scores it. Mastercard’s early access for Agent Pay for Machines, opened at Cloudflare Connect and reported in our October 21 coverage, ships the first buyer- and seller-side API specifications, a developer toolkit and a sandbox under the Verifiable Intent framework. Enrollment is by request only, no criteria for general access are published, and the program is not commercially available.
Set side by side, the seven converge: in agentic commerce, the chargeable surface is the authorization, not the transaction. Wells Fargo meters through a clause signed in advance; the Agentic Directory meters by registration; Poppy meters at the scope; Evervault meters per mint. Each deciding object sits upstream of the money and belongs to someone who can gate it, price it, or take it away. Agent identity is starting to look like a property record: whoever holds the artifact that says yes, decides.