Overview
How might we let an agent pay a merchant without ever handing it the person’s real card number?
When to use
- The wallet can issue a one-time card or a shared payment token.
- The charge has a known merchant and amount.
- The person should see the scope before the credential exists.
- A later, different charge needs a new credential.
When to skip
- A saved card the person types themselves on a merchant site.
- A standing subscription the person manages in the merchant’s own billing page.
- Any flow that would hand the primary PAN to the model or to the agent runtime.
States
The credential is created for one charge and then dies.
- 01
Scoped
Merchant, amount, and expiry are fixed on the approval or the spending limit.
- 02
Issued
The wallet creates a virtual card or token. The agent receives the credential, not the PAN.
- 03
Charged
The merchant captures up to the cap. The activity log stores the masked instrument.
- 04
Declined
The charge misses the scope, or the network refuses it. Say why, and do not retry on the real card in secret.
- 05
Expired
The credential is dead. A new purchase needs a new one.
Key UX elements
What to show about a credential the agent can spend.
Scope
Lock merchant and amount.
One merchant, one amount, one expiry. Print that next to the masked number.
Mask
Show a masked instrument.
Last four is enough. The full number does not belong in chat or in the activity log.
Source
Name the wallet card behind it.
The person should see which real card funds the virtual one, without exposing that number to the agent.
Once
Say that it will not be reused.
A second merchant or a higher amount needs a new virtual card.
Release
Issue it only after the gate.
After agent payment approval, or after the charge fits the agent spending limit.
Rules
Telling the person the agent “has their card” when it only holds a scoped credential.
A virtual card with no merchant lock and no amount cap.
Releasing the credential before agent payment approval, or before the spending limit allows it.
Showing the full card number in the chat transcript.
Evidence
| Product | Implementation |
|---|---|
| Stripe Link | After approval, Link can release a one-time virtual card or a shared payment token bound to the spend request. |
| Visa Intelligent Commerce | A network token carries spend controls so the agent pays without the real card number. |
| Mastercard Agent Pay | The agent pays with signed vouchers inside the spending limit. The person’s card stays in the wallet. |
| Shop Pay | A wallet checkout can complete on the merchant while the shopper’s underlying card stays in the wallet. |