Five Ways AI Agents Authorize Payments: A Taxonomy of Authorization Models
_Last updated: 2026-06-10_
AI agents can authorize payments in at least five distinct ways: Mastercard Agentic Tokens, Stripe Shared Payment Tokens (SPTs), AP2 Verifiable Mandates, Shatale Scoped Delegation Tokens, and network-delegated credentials under Visa Intelligent Commerce. They differ in where control lives, how portable the authorization is, and how much real-time policy enforcement each supports. Knowing which model you're using (or defaulting to) is one of the more consequential architectural decisions in an agentic payment stack.
---
Key takeaways
- All five models solve the same core problem: proving an AI agent is authorized to initiate a payment, without a human approving each transaction in real time.
- Where control lives is the real difference: at the issuer or network level, at the platform level, or at the deploying organization's own control layer.
- Mastercard and Visa are network-level approaches, with broad reach and less per-agent granularity. Stripe and AP2 are platform-level. Shatale is the organization's own scoped control layer.
- None of the five are mutually exclusive. In practice, layers combine (e.g., Visa Intelligent Commerce credential management plus Shatale policy enforcement).
---
The comparison at a glance
| Model | Owner | Where control lives | Real-time policy enforcement | Delegation chain | Chargeback / recourse |
|---|---|---|---|---|---|
| Mastercard Agentic Tokens | Mastercard | Card network + issuer | Network-level rules; issuer can add controls | Token tied to cardholder; agent identity implicit | Standard Mastercard dispute process |
| Stripe Shared Payment Tokens (SPTs) | Stripe | Platform (Stripe / ACP) | Stripe Radar + issuer rules; platform-level | SPT scoped to user account; agent uses user's token | Stripe dispute process |
| AP2 Verifiable Mandates | Google (FIDO-stewarded) | Credential issuer (operator or user) | Mandate payload bounds scope; real-time check requires additional policy layer | Cryptographic chain: issuer → agent → payment | Rail-dependent; mandates serve as dispute evidence |
| Shatale Scoped Delegation Tokens | Shatale (deploying org) | Deploying organization's control plane | Real-time at the authorization moment; policy enforced before money moves | Explicit human-to-agent chain, per-task scoping, immutable audit | Card network recourse if card-based; audit trail supports dispute |
| Network-delegated credentials (Visa Intelligent Commerce) | Visa | Card network + issuer | Network-level; user-set spending limits supported | Credential tied to cardholder, delegated to agent | Standard Visa dispute process |
---
1. Mastercard Agentic Tokens
Mastercard's agentic payment framework (launched April 2025) issues network-level tokens, aliases for the card credential, provisioned to a specific agent or platform. Authorization scope (merchant categories, spend limits, time windows) is encoded at issuance.
Strength: universal Mastercard merchant reach, PCI-compliant tokenization, existing dispute protections. Limitation: controls are static. They're set at provisioning, not dynamically enforceable. Control lives at the network and issuer, not at the deploying organization.
---
2. Stripe Shared Payment Tokens (SPTs)
Stripe's SPTs, a primitive of the Agentic Commerce Protocol (launched September 2025 with OpenAI), let an agent charge a user's stored Stripe payment method within parameters set at authorization. Stripe Radar evaluates each transaction automatically.
Strength: low integration overhead for Stripe-native stacks. Limitation: it works only inside Stripe's platform. SPTs represent the user's payment method, not the deploying organization's budget, which creates cost-center tracking ambiguity in enterprise deployments. Control lives at Stripe's platform, not the deploying organization.
---
3. AP2 Verifiable Mandates (Google)
Google launched AP2 (Agent Payments Protocol) in September 2025; the FIDO Alliance has stewarded it since April 2026. It uses W3C Verifiable Credentials: signed by the authorizing party, self-contained, verifiable offline without calling back to Google. The three-mandate chain (Intent → Cart → Payment) creates an auditable trail of the purchase decision. Any counterparty with the issuer's public key can verify the mandate cryptographically. No platform lock-in; the standard is open.
Limitation: mandates prove authorization was granted at a point in time. They don't enforce current conditions. Budget depletion, revoked delegation, or a policy update after issuance are invisible to the mandate, so a real-time policy layer has to sit alongside mandates for dynamic enforcement. AP2 adoption is still growing; not all processors handle mandate verification today. Control lives at the credential issuer. The mandate is a proof artifact, not a policy engine.
---
4. Shatale Scoped Delegation Tokens
Shatale issues agent-scoped virtual cards within the deploying organization's own control plane, not delegated through a card network or payment platform. Each card is tied to a specific task, budget envelope, cost center, and time window.
Authorization requests hit Shatale's policy engine before reaching the card network: merchant category, per-transaction limit, aggregate budget, and active delegation, all checked in real time at card-network latency. Out-of-policy transactions route to human approval before completing. Policy is dynamic; rule or budget changes apply immediately. The delegation chain runs human → agent → task → card, every step logged immutably. Control lives at the deploying organization, the highest organizational ownership in this taxonomy.
---
5. Network-delegated credentials (Visa Intelligent Commerce)
Visa Intelligent Commerce (launched April 2025) provisions agents with tokenized credentials and payment passkeys, keeping the raw PAN out of agent memory. The agent carries a token; Visa resolves it to the actual credential at authorization time. Any Visa-accepting merchant is reachable, the infrastructure is mature, and users can set spending limits on what the agent's credential can do. A separate piece, Visa's Trusted Agent Protocol (TAP, launched October 14, 2025 with Cloudflare), handles agent identity: cryptographically signed HTTP messages that let merchants verify a legitimate agent is knocking, not a scraper.
The limitation: this is credential management plus coarse user-set limits, not organizational policy enforcement. Intelligent Commerce doesn't run per-agent delegation rules, cost-center budgets, or approval workflows, and TAP only vouches for the agent's identity to merchants. Whether the agent should be making this specific transaction under this specific task still needs a separate layer, whether at the issuer or a dedicated control plane.
---
How do these models combine in practice?
They often stack. A common production setup: Visa Intelligent Commerce handles credential management and keeps the PAN out of agent memory, with Visa's Trusted Agent Protocol verifying the agent's identity to merchants. Shatale's control plane enforces dynamic spend policy at authorization time. AP2 mandates provide external proof of authorization to counterparties outside your own systems. Each does a distinct job; they're not competing.
The question worth asking of any setup: where does real-time policy enforcement actually happen? "At the network, via rules I set at provisioning" means static limits, not governance.
---
Frequently asked questions
What is the difference between a Mastercard Agentic Token and a Shatale Scoped Delegation Token?
Mastercard Agentic Tokens are network-level, with spending rules set at provisioning. Shatale Scoped Delegation Tokens enforce dynamic, per-agent policy in real time at every authorization via the deploying organization's own control plane. A Mastercard token can't differentiate between two agents sharing a limit; Shatale tokens enforce separate rules per agent, per task, per cost center.
What is a Stripe Shared Payment Token (SPT) and when should I use it?
An SPT lets an AI agent charge a user's Stripe-connected payment method within defined parameters. It's the natural choice for Stripe-native stacks where agents transact on behalf of end users with stored Stripe credentials. It's less suitable for enterprise deployments that need per-agent delegation chains, cost center tracking, and organizational budget governance.
Do AP2 Verifiable Mandates replace the need for a control plane?
No. Mandates prove authorization was granted at a point in time. They don't enforce current budget conditions, revoked delegation, or dynamic policy updates. A control plane checks current state at the authorization moment. That makes it a complement to mandates, not a replacement.
What is Visa TAP and what does it not do?
Visa TAP (Trusted Agent Protocol, launched October 2025 with Cloudflare) is agent identity verification: agents sign their HTTP requests cryptographically so merchants can confirm a legitimate agent is transacting. Credential management is a different Visa product, Intelligent Commerce, which provisions tokenized credentials and payment passkeys so agents never hold the raw card number. Neither enforces per-agent delegation rules or approval workflows; that needs a control plane.
Can I use multiple authorization models simultaneously?
Yes, and most production stacks do. Visa Intelligent Commerce handles credential security and TAP verifies agent identity to merchants. AP2 mandates provide external proof. Shatale's control plane enforces dynamic policy. Each operates at a different layer; they complement, not compete.
---