Agentic payments have an identity layer. The audit gap remains open.
The infrastructure for AI agents to transact autonomously has matured at striking speed. Google's Agent Payment Protocol, Visa's Trusted Agent Protocol, Mastercard's Agent Pay, the OpenAI-Stripe Agentic Commerce Protocol and Coinbase's x402 rail collectively answer two foundational questions: who is this agent, and did a human authorise it? According to Ithelia Dias, founder and CEO of Wyoming-based authorisation startup Saifuro, those two questions are the wrong ones to stop at.
In an industry perspective submitted to Disrupts, Dias argues that a third question remains structurally unanswered: at the precise moment a payment executes, does this transaction actually conform to the mandate a human signed days, weeks or months ago? The gap, she contends, is where enterprise losses will surface first.
The consent signature is not a payment check
The distinction matters more than it may appear. A mandate is a forward-looking statement: "this agent may spend up to $2,000 a month with these vendors until quarter-end." A payment is a present fact: $340 to a specific recipient at a specific timestamp. Whether the fact fits the statement depends on real-time conditions the mandate cannot anticipate when signed: remaining budget, live policy versions, whether the recipient remains approved, whether a duplicate request was submitted forty seconds earlier.
Dias identifies three places where that check currently lives, each carrying the same structural defect. First, the agent's own code, where a system prompt sets the limit. This is the weakest option, she argues, because the party enforcing the constraint is the party being constrained, and prompt injection has become a well-documented attack vector. Second, the card-level spend control or virtual card, which sees an amount and a merchant category but has no visibility into the mandate, the agent identity or the policy version. Third, the ledger itself, which is authoritative but entirely retrospective. None of these, she argues, produces a verifiable record a third party can check without trusting the party that created it.
The convergence stakes are larger than payments
The audit question Dias raises is not confined to fintech plumbing. As agentic AI systems begin to operate across enterprise procurement, logistics contracting, energy trading and healthcare supply chains, the inability to produce a per-transaction verification record that any auditor can independently reconstruct becomes a systemic risk spanning every sector adopting autonomous workflows.
Regulators in the EU and UK are already signalling that accountability for automated decisions must be traceable to a human principal. If the payment layer cannot produce a cryptographically signed, policy-version-stamped verdict per transaction, that traceability breaks at exactly the point where money moves. For institutional investors pricing AI-enabled enterprise software, or sovereign funds allocating into agentic infrastructure plays, the auditability gap is a material due-diligence question. Capital flowing into the agentic commerce stack is substantial: Stripe, Visa and Mastercard have each made public commitments to the protocol layer Dias describes as incomplete, while a growing cohort of non-custodial authorisation startups, of which Saifuro is one, are positioning to close it.
Dias proposes a structural fix: a signed verdict document, issued per payment by a party independent of both the agent and the merchant, binding the specific amount, recipient, mandate reference and live policy version, carrying a nonce to prevent replay and expiring within minutes. Her additional requirement carries the logic of traditional payments compliance: the entity that issues the authorisation verdict should never hold the funds, preserving separation of duties in an architecture where both functions could otherwise collapse into a single custodian and a single point of failure.
The piece closes with five due-diligence questions Dias recommends any enterprise or platform buyer apply to vendors claiming agent-spending controls, centred on offline verifiability, policy versioning under the signature, downtime behaviour, custody arrangements and auditor-reproducible logs. Disclosure: Saifuro builds the layer she describes, and the piece says so clearly.