Your AI Agent Is About to Get a Corporate Card. Your Governance Program Is Not Ready.

Imagine arriving at work to discover that one of your employees spent $48,000 overnight. It purchased cloud capacity, renewed three software contracts, hired an outside service, and paid several usage fees.

Nobody stole the company card. Nobody compromised the account. The employee was an AI agent — and it did exactly what it believed you had asked it to do.

This is the uncomfortable next phase of artificial intelligence. AI systems are moving from recommending purchases to initiating them. From analyzing invoices to paying them. From finding vendors to negotiating with them. From consuming digital services to buying those services automatically, continuously, and at machine speed.

The question is no longer whether AI can spend money. The question is who gave it permission — and what, exactly, that permission meant.

The moment AI becomes an economic actor

A chatbot produces words. An agent produces consequences.

Give an agent access to email and it can communicate. Give it access to infrastructure and it can deploy. Give it access to a payment credential and it becomes an economic actor.

That transition is already taking shape. Visa Intelligent Commerce is being built to provide credentials, authentication, controls, and protections for AI-initiated transactions. Mastercard's Agent Pay for Machines is designed for permissioned payments executed continuously between systems. Stripe now documents agent-based checkout, machine payments, agent wallets, and payment tokens that can be scoped to a buyer's intent.

A consumer agent might reorder groceries. A business agent could purchase compute by the second, subscribe to data feeds, reserve logistics capacity, renew software, acquire advertising inventory, or pay another agent for completing part of a task — programmatic, always-on transactions happening in high volumes and at values too small for individual human approval.

The machine-speed spending era is arriving. Most companies' governance programs are not.

The most dangerous transaction may be perfectly authorized

Traditional payment security concentrates heavily on unauthorized transactions. Was the card stolen? Was the account compromised? Did the actual account holder approve the charge?

Agentic commerce introduces a harder category: a properly authenticated agent making an allowed payment for the wrong reason.

Consider a few ordinary-sounding instructions:

"Keep our application online during the traffic spike." Does that authorize an agent to purchase $60,000 of emergency cloud capacity?

"Find a cheaper software provider and migrate us." Can the agent sign a three-year agreement? Accept automatic renewal? Send company data to the new vendor?

"Never let inventory run out." Can it purchase from an unapproved supplier? Pay for expedited shipping? Raise the budget when demand changes?

A human employee recognizes that these instructions contain ambiguity. An autonomous agent may interpret that ambiguity as latitude. The result is not necessarily fraud. It is something harder to contest: an agent acting within technical access while operating outside legitimate business authority.

A spending limit is not a governance system

The first response will be to give agents small budgets. That helps, but it does not solve the problem.

An agent with a $1,000 limit may execute ten $900 transactions. It may create multiple subscriptions whose lifetime cost exceeds the original cap. It may choose a prohibited vendor offering the lowest visible price. It may expose confidential information while completing an otherwise valid purchase.

Financial authority is multidimensional. A serious control must evaluate more than the transaction amount:

• Which agent is acting — and which version of it?
• Who delegated the authority, and for what approved objective?
• Which merchants and categories are permitted?
• What data may be disclosed during the transaction?
• Which jurisdiction is involved, and is the purchase reversible?
• Is the agent allowed to create recurring obligations?
• Has the original instruction changed since it was approved?
• Has the agent delegated part of the task to another agent?

A card limit answers only one of those questions.

The authorization gap

Payment networks are correctly concentrating on trusted credentials, authenticated intent, fraud protection, and secure settlement. Visa describes the need for clear controls around AI-initiated payments; Stripe's agentic network tokens can be scoped to customer intent without exposing underlying card details.

But enterprises face an additional layer of authorization. A payment system can determine whether a credential is valid and whether a transaction fits its configured restrictions. It cannot independently determine whether buying this product, from this vendor, for this purpose, under these contractual terms, is consistent with the organization's internal policies. That is a business-governance decision.

The first protects the payment. The second protects the organization. Agentic commerce needs both.

The AI agent's financial constitution

Companies should not give an agent a broad instruction and a payment method. They should give it a machine-enforceable financial constitution that establishes the agent's authority before any transaction occurs.

Identity

Every financial action should be tied to a verified agent identity — model or software version, organization, principal, and active session. "An AI made the purchase" is not an acceptable audit record.

Purpose

Authority should be attached to a specific business objective. An agent authorized to purchase cloud capacity for a defined incident should not inherit permanent authority to purchase unrelated infrastructure later.

Boundaries

Policy should specify permitted vendors, transaction types, jurisdictions, spending ceilings, cumulative budgets, frequency limits, contract terms, and data-disclosure restrictions.

Pre-execution decisions

The transaction should be evaluated before the agent commits the organization. The control should be able to allow the purchase, modify its parameters, block it, or escalate it to a human.

Evidence

Every decision should generate a durable record: the agent identity, delegated authority, applicable policy, transaction details, approval state, verdict, and resulting action. Without that evidence, a company may know money moved without being able to prove why it was allowed to move.

The real threat is legitimate credentials attached to manipulated intent

Agentic commerce also changes how attackers operate. Visa has warned that fraudulent merchants may manipulate the logic used by AI shopping agents — presenting convincing storefronts and attractive prices designed to steer automated buyers — and reported that synthetic businesses can be created quickly enough to challenge traditional fraud indicators.

This creates a new attack path. An attacker may not need to steal the payment credential. The attacker may only need to influence the agent's decision: manipulate the product ranking, poison a data source, insert instructions into a vendor page, impersonate a trusted supplier, or convince the agent that an urgent purchase is required. The agent then uses legitimate authority to complete the attacker's objective.

This is why protecting the credential is not enough. The intent, context, and execution path must also be governed.

The new separation of duties

Enterprises have spent decades separating financial responsibilities. One employee requests a purchase. Another approves it. A procurement system validates the vendor. A payment system settles the transaction. An accounting system records it.

Agentic systems collapse these responsibilities into one automated loop. The same agent may identify a need, select a vendor, negotiate, initiate payment, and verify delivery. That is efficient. It is also a concentration of authority that most internal-control programs would never permit a single human employee to hold.

The safer architecture preserves the separation:

• The AI proposes.
• A deterministic control evaluates authority and policy.
• A human approves exceptional or high-impact transactions.
• The payment network authenticates and settles.
• Independent evidence records what happened.

The intelligence layer should not be the final authority over its own spending.

Seven questions every board should ask

Before approving agents with financial capabilities, leadership should demand clear answers:

1. Which agents can initiate transactions today?
2. Can an agent create subscriptions or recurring obligations?
3. Can it split transactions to stay below approval thresholds?
4. How is authority revoked while an agent is running?
5. Can a delegated subagent inherit payment privileges?
6. What happens when the instruction is ambiguous?
7. Can the company independently prove why every agent-initiated payment was permitted?

If the answer to the final question is "we have logs," the system is not ready. Logs show activity. They do not prove authorization.

Where EVE AI Core fits

EVE AI Core is built around a simple principle: an AI action should encounter an independent governance decision before it produces an external consequence.

EVE CoreGuard evaluates actions against deterministic policy, returns an allow, modify, block, or escalation outcome, and produces evidence of the decision. The governed system does not receive unlimited discretion merely because it possesses the technical capability to act.

Applied to agentic payments, that architecture creates a boundary between what an agent wants to purchase and what the organization has actually authorized it to purchase. The payment credential becomes the settlement mechanism. It does not become the source of authority.

Before AI gets a card

The arrival of agentic commerce will be marketed as convenience — and it will be convenient. Agents will compare prices faster than humans, negotiate continuously, purchase digital services instantly, and eliminate enormous amounts of administrative work.

But the same speed that creates efficiency removes the pause in which organizations traditionally discover that a decision is wrong. By the time a dashboard detects the pattern, the purchases may already be complete. The contracts may already be active. The data may already be transferred. The agent may already have delegated the task and moved on.

The next generation of financial controls must therefore operate before execution — not after the monthly statement arrives. Before giving an AI agent a corporate card, give it three things: a constitution defining its authority, a gate capable of saying no, and evidence proving every decision it was allowed to make.

Because the most expensive AI failure may not begin with a jailbreak. It may begin with a perfectly valid payment.