The agent economy is the set of transactions in which an AI agent, on behalf of a person or a company, finds a product or service, places the order and pays for it on its own. In 2025–2026 dedicated protocols appeared for such payments: AP2 from Google, x402 at the Linux Foundation, Mastercard Agent Pay. Liability for a wrong payment by an agent lies with the party in whose name it pays: the agent itself cannot be liable.
In brief
- Europe’s first live payment by an AI agent was completed by Santander and Mastercard on 2 March 2026, in a controlled environment, within predefined limits and permissions. It is a pilot, not a commercial rollout.
- AP2 (Google, 16 September 2025) confirms an agent’s authority with signed “mandates”: the merchant and the payment chain receive cryptographic proof that the user authorized this purchase.
- x402 is an open standard for payments over HTTP: the server answers with status code 402 “Payment Required”, the agent pays and repeats the request. Since 14 July 2026 it has been stewarded by the x402 Foundation at the Linux Foundation, which has 40 member organizations.
- Juniper Research forecasts (7 April 2026) that agentic commerce spend will reach $1.5 trillion in 2030; trust will remain the number one barrier.
- A person or a company answers: an agent is not a party to civil-law relations, and the fact that “the agent paid” does not by itself release anyone from liability.
What is the agent economy?
It is the part of the economy where the buyer and payer is not a person but the person’s AI agent, acting on instructions and within the authority it was given. A person sets a task and limits, and the agent carries it out. The example from the AP2 announcement: “Buy concert tickets the moment they go on sale”, with price limits and timing.
Payment systems were built for something else. As Google writes in the AP2 announcement, “today’s payment systems generally assume a human is directly clicking “buy” on a trusted surface”. When an agent pays, this assumption no longer holds, and three questions arise:
- authorization: did the user give the agent authority for this particular purchase;
- authenticity: does the agent’s request reflect the user’s true intent;
- accountability: who answers if the transaction turns out to be fraudulent or incorrect.
For now the scale is estimated by forecasts. Juniper Research expects agentic commerce spend to grow “from only pilot deployments in 2025 and 2026” to $1.5 trillion in 2030. In its view, agentic commerce will become an important access channel “but will not replace traditional eCommerce checkouts for the foreseeable future.” On the money going into agentic AI and the risks of deploying it: the page on AI agents for business.
How does an AI agent make a payment?
The agent receives a task and limits from the user, assembles the purchase and presents proof of its authority to the merchant and the payment chain; the money moves over existing payment networks.
This is how the Santander and Mastercard pilot (2 March 2026) worked. The bank “carried out the transaction in a controlled environment using Mastercard Agent Pay”, but through its live payments infrastructure, to validate the end-to-end operational and control framework under real conditions. The solution “enables AI agents to initiate and execute payments on behalf of customers within predefined limits and permissions.” In Santander’s description, “Mastercard Agent Pay integrates AI agents into the payment flow as visible, governed participants”. PayOS supported the end-to-end orchestration.
The AP2 specification (version 0.2) distinguishes two modes:
| Mode | What the human approves | What confirms the payment |
|---|---|---|
| Human Present | The specific purchase and its payment; the user sees the final checkout | The user’s signature |
| Human Not Present | In advance, a set of constraints: what, for how much, under which conditions | The agent’s key; trust in the key comes from an “open” mandate signed by the user, or from a trust list of agent providers |
In both modes the verifier receives a “closed” mandate for the specific purchase and the specific payment. The constraints let it verify that the purchase matches the user’s intent.
What are AP2 and x402?
AP2 answers the question “is the agent allowed”, x402 the question “how to pay”. They are protocols of different levels, and the AP2 specification describes how they work together.
| Mastercard Agent Pay | AP2 | x402 | |
|---|---|---|---|
| Who leads it | Mastercard | Google with more than 60 organizations (2025) | The x402 Foundation at the Linux Foundation; the protocol was contributed by Coinbase |
| What it does | Brings the agent into the card payment flow as a governed participant | Gives the merchant and the payment chain signed proof of the agent’s authority | Builds payment into an ordinary HTTP request: code 402, payment, repeated request |
| Status | Pilot with Santander in Europe, 2 March 2026, not a commercial rollout | Specification, version 0.2 | Open standard; the foundation has operated since 14 July 2026 |
AP2 (Agent Payments Protocol) was announced by Google on 16 September 2025 together with more than 60 organizations, including Adyen, American Express, Coinbase, Mastercard, PayPal, Revolut and Salesforce. In the words of the specification, it “provides a protocol to secure Agent-performed payment transactions” and “operates as a security feature within a Commerce Protocol” rather than as a payment system of its own. There are two mandates:
- Checkout Mandate: “cryptographic proof that the Shopping Agent is authorized to purchase the Checkout that it has assembled”, provided to the merchant;
- Payment Mandate: the same kind of proof for the credential provider, the network and the merchant payment processor that the agent “is authorized to pay for a particular Checkout”.
In the 2025 announcement the mandates were called the Intent Mandate and the Cart Mandate. In a dispute, the mandates and receipts “can be brought together to provide a non-repudiable picture of the transaction”. How exactly they are used for dispute resolution is outside the scope of the specification.
x402 is “an open, neutral standard for internet-native payments”. The flow is simple: the agent sends a request, the server answers with HTTP 402 “Payment Required”, the agent pays and repeats the request, and access is granted. “Stablecoin payments are the primary use case”; according to the Linux Foundation, the standard supports “payment types ranging from traditional cards to stablecoins”. The protocol was started at Coinbase. On 14 July 2026 the Linux Foundation announced the operational launch of the x402 Foundation: 40 member organizations, with premier members including Adyen, AWS, American Express, Cloudflare, Coinbase, Google, Mastercard, Shopify, Stripe and Visa.
Who is liable for a wrong payment by an agent?
The person or company in whose name the agent pays. This section describes Russian law. An agent is a tool, not a party to civil-law relations: under Article 2, point 1 of the Civil Code, the parties are individuals and legal entities; the Russian Federation, its constituent entities and municipalities also take part in them.
Towards the bank. A bank account agreement may provide that the rights to dispose of funds in the account are certified by electronic means of payment and other methods using analogues of a handwritten signature, codes, passwords and other means confirming that the order was given by an authorized person (Civil Code, Article 847, point 4). If an agent pays with the company’s keys, codes or card, its order is confirmed by the company’s own means. The fact that “the agent paid” does not by itself cancel the payment.
Towards a counterparty. If an agent disrupted the performance of a contract, by failing to pay on time or transferring the wrong amount, the company is liable as the party that breached the obligation. For businesses the rule is strict: unless the law or the contract provides otherwise, only force majeure releases from liability (Civil Code, Article 401, point 3), and a mistake of the company’s own tool is hard to present as an extraordinary and unavoidable circumstance. In detail: the page on liability for AI mistakes.
If the money went to the wrong recipient. A person who acquired property at another’s expense without legal grounds must return it, except in the cases of Article 1109 (Civil Code, Article 1102, point 1), and this applies even if the enrichment resulted from the conduct of the victim itself or happened against the will of the parties (Article 1102, point 2). But this is a claim against the recipient, not a cancellation of the payment: if the recipient does not return the money voluntarily, a court decides the dispute.
If the agent went beyond its rules. For people, the Civil Code resolves a similar case with the rule on a transaction made without authority (Article 183), but an agent is neither a representative nor a person. How a court will qualify a purchase that an agent made beyond the rules set for it is still an open question.
The protocols help with evidence, not by shifting liability. An AP2 mandate shows what exactly the user authorized and what each party saw. In the Santander pilot, limits and permissions were set before the payment. The conclusion for a company is simple: the limits of an agent’s payments are set in advance and checked before execution, and the proof of authorization is stored so that it cannot be rewritten.
This is a review of the rules, not legal advice. The conclusion in a specific case belongs to the organization’s lawyer.
What to do
- Decide which payments can be entrusted to the agent: amounts, recipients, purchase categories, timing.
- Give the agent a separate means of payment with a limit, not the company’s main account or card.
- For payments without a human, use constraints signed in advance and check each payment against them before execution. How a check before execution works: the page on IS 3.0.
- Keep the proof: what the human authorized, what the agent saw and did. The log must not allow edits after the fact.
- Check the contracts with the bank and the agent provider: how payment orders are certified and who pays for a mistake.
- For strategy: the institute’s book “Proven Action” (in Russian), on power and control over agents that act in the name of people and companies.
Frequently asked questions
What is the agent economy in simple terms?
It is the set of transactions in which the buyer and payer is not a person but the person’s AI agent, acting on instructions and within the authority it was given. Dedicated payment protocols for agents have appeared for this: AP2, x402 and Mastercard Agent Pay.
How do AI agent payments work?
The user gives the agent a task and limits: an amount, a recipient, conditions. The agent assembles the purchase and presents proof of its authority to the merchant and the payment chain, and the money moves over existing payment networks. In the Santander and Mastercard pilot of 2 March 2026, the payment went through in a controlled environment within predefined limits.
What is the AP2 protocol?
AP2 (Agent Payments Protocol) is a protocol to secure payments performed by an AI agent. Google announced it on 16 September 2025 together with more than 60 organizations. Signed mandates give the merchant and the payment chain proof that the user authorized the agent to make this purchase and this payment.
What is x402?
An open standard for payments over HTTP: the server answers the agent with status code 402 “Payment Required”, the agent pays and repeats the request. The protocol was started at Coinbase; since 14 July 2026 it has been stewarded by the x402 Foundation at the Linux Foundation.
Who is liable if an AI agent pays by mistake?
The person or company in whose name the agent pays: under the Russian Civil Code a program is not a party to civil-law relations. If the money went to the wrong recipient, it can be claimed back as unjust enrichment (Civil Code, Article 1102); the conclusion in a specific case belongs to a lawyer.
Sources
- Santander, “Santander and Mastercard complete Europe’s first live end-to-end payment executed by an AI agent”, 2 March 2026: https://www.santander.com/en/press-room/press-releases/2026/03/santander-and-mastercard-complete-europes-first-live-end-to-end-payment-executed-by-an-ai-agent
- Google Cloud, “Powering AI commerce with the new Agent Payments Protocol (AP2)”, 16 September 2025: https://cloud.google.com/blog/products/ai-machine-learning/announcing-agents-to-payments-ap2-protocol
- Agentic Payment Protocol (AP2), specification, version 0.2: https://ap2-protocol.org/ap2/specification/
- x402, the standard’s website: https://www.x402.org/
- Linux Foundation, “Linux Foundation Announces Operational Launch of x402 Foundation…”, 14 July 2026: https://www.linuxfoundation.org/press/linux-foundation-announces-operational-launch-of-x402-foundation-to-standardize-internet-native-payments-for-ai-agents-and-applications
- Juniper Research, “Agentic Commerce Set to Generate $1.5 Trillion Globally by 2030…”, 7 April 2026: https://www.juniperresearch.com/press/agentic-commerce-set-to-generate-15-trillion-globally-by-2030-as-payments-infrastructure-leaders-revealed/
- Civil Code of the Russian Federation (Part One), as amended on 10 June 2026: Articles 2, 183, 401 (in Russian), ConsultantPlus: https://www.consultant.ru/document/cons_doc_LAW_5142/
- Civil Code of the Russian Federation (Part Two): Articles 847, 1102 (in Russian), ConsultantPlus: https://www.consultant.ru/document/cons_doc_LAW_9027/
Checked: 17 October 2026. The legal conclusion in a specific situation belongs to the organization’s lawyer.