When an AI Agent Wants to Pay, Who Holds the Authority?

Consider a travel assistant that notices your train has been cancelled. It finds a replacement, checks the price against your preferences and offers to book it. Most of that workflow is information work. The moment it commits money, a different set of questions appears. What exactly did you authorize? How long does that authority last? Who can stop the payment, and what evidence remains if something goes wrong?

The European Central Bank has now put agent-mediated payments on the exploration agenda for the potential digital euro. Its 28 September 2026 call for expressions of interest has two workstreams. An experimentation track, expected to run from January to June 2027, will test ideas such as integrated receipts, multi-payer and multi-payee transactions, conditional payments and app features. An exploration track will hold workshops in the first half of 2027 on technological possibilities, including AI-enabled payment experiences, interactions among AI agents and micropayments. Applications close at 17:00 CET on 9 November 2026. The ECB is explicit that the decision to issue a digital euro would follow adoption of the relevant EU legislation; this call does not announce a launch. Source: ECB call.

The intriguing part is the boundary between an agent’s recommendation and a payment instruction. An agent can compare options, prepare a basket and explain tradeoffs. It should not acquire an unlimited right to spend simply because it can complete the earlier steps. The design problem is to express a mandate in terms a person and a payment service can both understand: permitted merchant or category, maximum amount, expiry, frequency, context and the point at which a fresh approval is required.

That mandate has to survive a real workflow. Prices change. A preferred provider becomes unavailable. A merchant presents a different legal entity at checkout. The agent retries after a network error. A conditional payment is triggered later by an event. Each transition can change the meaning of the original instruction. A robust architecture records the proposed action, the authority used, the evidence behind the decision and the final outcome as separate events. It also gives the user a direct way to inspect and revoke delegated authority.

Privacy creates another constraint. An agent may know why a customer is travelling, what they can afford and which alternatives they rejected. A payment provider needs enough information to execute and protect the transaction, but not necessarily the entire conversation. The ECB specifically calls for alignment with privacy by design, user control and data protection in the AI payments exploration. That makes data minimization part of the architecture, not a later screen in the app. Source: ECB call.

It is tempting to treat conditional payments as a shortcut to programmable money. The ECB draws a distinction: a conditional payment executes when predefined conditions are met, whereas programmable money restricts the money itself to predefined uses. The Commission’s proposed digital euro framework, as described by the ECB, does not envisage a digital euro that is programmable money. Product teams should keep that distinction clear when sketching agent use cases. Source: ECB call and explanatory note.

For an open agent orchestration platform such as Archy, a useful prototype would stop before actual payment execution. Give an agent a bounded purchase task, let it assemble evidence and a proposed instruction, then pass the proposal through a policy service and a human approval step. Record what changed between proposal and approval. Simulate retries, cancellation and a merchant substitution. Such a prototype would test the control model without claiming that the ECB has endorsed a particular design or that digital euro interfaces are available today.

The next signal is not whether an agent can click “pay” in a demo. It is whether the ECB’s workshops and experiments produce patterns for limited delegation, identity, revocation, consent and audit that work across providers. If they do, agent payments become a serious architecture domain. If they do not, the attractive demo remains a fragile exception to the rules that make payments trustworthy.