American Express (Amex) is building a system that will allow AI agents to shop and pay on behalf of users — but it’s currently only on its own payment network and still contains a black box that could hinder trust and auditability.
Amex already participates in agent trading protocol projects, specifically Google’s Agent Payment Protocol (AP2)it focuses on interaction. Amex’s Agentic Commerce Experiences (ACE) developer kit, by contrast, addresses something that most protocols currently lack: Full transactional control at the Payment layer.
But it’s still not entirely transparent about how it handles verification. Ace uses a closed-loop system that serves as both a card issuer and a payment network to verify agent-led transactions.
Luke Gebb, EVP and global head of innovation at Amex, told VentureBeat that the company believes this model is the missing piece in agent trading.
“Some of what’s been missing so far is the perspective of a company like ours: We feel that trust and security are essential to growing this space,” Gebb said. “This is really the first time an issuer has come to the table.”
Amex sits in an interesting space: Unlike other financial institutions or card providers like Chase or Bank of America, Amex can route transactions through the American Express Network. Visa and Mastercard are two of the most popular payment networks, but these companies do not issue the cards themselves and must work with a bank.
The ongoing black box of agent trading
The ACE suite is just one approach to solving some of the biggest challenges of the agent trade: trust, control, accountability, verification and security.
Consumers generally don’t want rogue agents to take their bank accounts and run around buying stuff. Merchants don’t want to be stuck with unpaid merchandise. Banks don’t want to deal with the flow of chargebacks and the potential for fraud.
Projects like the ACE suite aim to build trust and accountability by verifying an agent’s identity and goals. This can create the trust that agent trading so desperately needs.
Amex claims to offer confirmation, although the process behind it is not clear. It abstracts how it performs validation, although it does not explain in which layer it does it. More traditional systems have a mix of deterministic checks and flexible, semantic evaluation that helps match the goal and outcome for validation. Amex said agents set up with ACE can submit user shopping carts and verify them against the agent’s original intent. However, they did not explain how it works.
Practitioners building the agency commerce ecosystem report that despite progress in building a layer of trust, many black boxes remain that could prevent widespread adoption.
Payment protocols and software suites such as Stripe’s Agtic Commerce Suite, Google’s Verfiable Intent proof chain, and the ACE developer kit, Raj Ananthanpillai, founder and CEO of identity and authentication system provider Trua, told VentureBeat. "excels in handling the mechanics of proofs, verifiable permissions and funds movement, but leaves upstream human verification opaque and underdeveloped."
Ananthanpillai continued: "Without a clear, highly secured cryptographic link that proves an agent is acting under the express authority of a verified human owner, merchants, issuers, and networks face increased risks of denials, mass payouts, sanctioned individuals conducting financial transactions, and fraud."
ACE kit
According to Gebb, the ACE developer suite solves several problems associated with trading agents and gives developers access to integrated services:
-
Agent registration
-
Account activation
-
Intent intelligence
-
Payment credentials
-
Cart context
First, agent registration deals with establishing identity and trust with both consumer and company agents. When a transaction begins, the agent acting on behalf of the customer and the merchant’s agent can verify each other’s identities and ensure that they are dealing with the correct entity.
Next comes account activation, which links the user’s Amex account to their agent and authorizes the agent to operate or purchase something in the case of an agent trade.
Intent intelligence creates what Amex calls an intent contract, where the user specifies what they want the agent to do. Once the goal is determined, the ACE system creates a form Intent ID and a Proof of Intent Token which conclusively proves authorization in case of dispute.
Amex handles the actual transaction part, where the user pays for the product via a one-time token. ACE determines the payment credentials used for the transaction based on intent and restrictions.
“Once the agent finds the item the customer requested, such as red shoes, they’ll call for a payment credential, which is a token with borders provided by the cardmember,” Gebb said. “So, for example, if they say they only want to spend $500, that token won’t allow a $600 purchase because it has control over it.”
According to Gebb, the final piece is cart context and validation, which helps banks and brands match a user’s cart with what their agents present against their intent.
Amex’s approach shows that for agent trading to really take off, providers need to understand what systems will enable agents and who is responsible if something goes wrong.
