In a single year, every payments power picked a lane for letting AI agents pay on your behalf. The rails are almost decided. The part that protects you, who authorized the spend, is still being written.
Rail-agnostic; signed Mandates; folds in x402 for stablecoins
Intelligent Commerce / Trusted Agent Protocol
Visa
2025 to 2026
Cards, tokenized
Agent Pay for Machines (AP4M)
Mastercard, 30+ partners
June 10, 2026
Cards, bank accounts, and stablecoins
x402 (HTTP 402 + USDC)
Coinbase, now Linux Foundation-governed
Governance moved Apr 2026
Stablecoin micropayments
The receipt
Three things the headlines get wrong, that the dated record shows:
It is not cards versus crypto. It is converging to multi-rail. By June 2026 even Mastercard's agent system settles across cards, bank accounts, and stablecoins in one protocol. The "who wins" framing is already stale.
The battleground is authorization, not settlement. The load-bearing idea across these is the Mandate: a cryptographically signed permission that says this specific agent may spend up to this limit, for this purpose, on your behalf. Who issues it, how it is scoped, and how you revoke it is the real fight, and it is being decided now.
Volume signals mislead. The stablecoin micropayment rail x402 passed over 100 million transactions by early 2026, which sounds explosive, but its trailing 30-day dollar volume was only about $24 million. Huge count, tiny tickets. The infrastructure is being built before the money, and before any consumer-safety norms exist.
Why this is the front-run. When an agent-payment goes wrong, an overcharge, a subscription an agent signed you up for, a purchase you did not mean to authorize, it will be a story. The dated explainer of Mandates and spend limits belongs on the record before that day, not after, so that the person who warned about spend limits first is the one people trust when it breaks.
Consumer self-defense, in plain words
Before you let any assistant or agent pay for things, the three questions that matter:
What is it authorized to spend? Look for a hard per-purchase and total spending limit you set, not a blank check.
Who signed the authorization? The permission (the Mandate) should be something you granted explicitly and can show, not something the agent assumed.
How do you revoke it? There must be a one-step way to pull the agent's spending permission, and you should test it before you rely on it.
Educational record only, not financial, legal, or tax advice. Dates, partner counts, and volume figures are sourced to the public record as of July 12, 2026 and will change fast in this area; confirm against the linked primary sources before repeating them as current. The Receipts Index takes no compensation from any party named here.