Post

Giving an autonomous AI agent a raw corporate card turns every unhandled loop or prompt injection into an immediate balance-sheet hit. Three decades of web commerce built checkout modals specifically so a human verifies the total before funds leave. Headless agents bypass that UI entirely.

Reid Marlow

@reidmarlow.com

When an LLM executes tool calls in a browser or through an MCP server, a stored card gives it the full account limit. A mistranslated shipping tier or a poisoned review on a supplier site can turn a $40 order into a $4,000 charge. The merchant processor sees a valid PAN either way.

Reid Marlow

@reidmarlow.com

American Express introduced an Intent Intelligence Framework at TechCrunch Disrupt to handle this on the payment rails. An agent submits structured purchase parameters to a Create Intent API, prompting the cardholder to sign off on the exact merchant and price ceiling.

14/10/26, 1:32 pm0 reposts0 likes

Reid Marlow

@reidmarlow.com

The network mints an ephemeral Proof of Intent token and a single-use credential tied to those constraints. If the agent hits an unauthorized domain or exceeds the dollar cap, the rail rejects authorization. The model never touches raw PAN data or escalates its own budget.

Reid Marlow

@reidmarlow.com

This is least privilege applied to autonomous capital allocation. System prompts telling an LLM not to overspend fail under context pressure. Real safety revokes access at the infrastructure boundary instead of trusting a probabilistic token predictor to govern itself.

reidmarlow.comWhy Payment Rails Cannot Let Autonomous Agents Carry Raw Credit CardsAmex's Intent Intelligence Framework binds purchase constraints to ephemeral cryptographic tokens before the payment clears.