Every payment rail for AI agents now answers one question: can this payment be verified?

x402 went to the Linux Foundation. AP2 to the FIDO Alliance. UCP and ACP cover checkout. EMVCo published a draft. Visa, Mastercard and Amex all have agent programmes.

None of them answers the other question: should this agent spend this money on this task, right now?

That gap is where money actually goes, and it is documented:

An agent paginating a paid API through a bug made 41 000 calls over one weekend . Every call was correctly signed and settled. A per-call limit never noticed — each call was legal. The budget was gone.

In a September 2026 preprint, hidden text in product descriptions made an AP2 shopping agent assemble a different cart than the one shown to the user in 56 % of trials. The mandate signed it faithfully.

Of 47 vendors checked in September, 11 publicly document a kill switch.

AP2's own security guidance assumes the agent may be compromised and calls prompt-injection prevention infeasible.…