The next challenge in agentic commerce may not be proving who authorized a transaction, but instead proving what they authorized.
Most of the conversation about AI agents and banking centers on access and authentication. Should banks let third-party agents into customer accounts? How do we know an agent is legitimate? Who is responsible when something goes wrong?
Sardine's introduction of Know Your Human (KYH) is an important step in answering some of them. In connecting the human's device and identity signals to the agent performing a transaction, we begin bridging a gap that traditional fraud detection was never built to handle. KYH can support merchant approvals and dispute evidence, but it doesn't independently establish the full scope of a consumer's instructions.
From my years working inside financial institutions, though, there's another question I can't stop thinking about.
What happens when a customer says, “That's my agent, but I never told it to do that”?
Key takeaways:
- For agentic commerce compliance, a verified human is not the same as an authorized action. Know Your Human (KYH) connects a person’s device and identity signals to the agent, but it cannot establish the full scope of what the customer told an AI shopping agent to do.
- A fraud investigator reviewing a disputed agent purchase sees a legitimate customer working with a legitimate agent and a payment the bank approved, and friendly fraud and honest agent errors can arrive in the same dispute queue.
- Visa Compelling Evidence 3.0 helps merchants defend certain disputes with prior transaction history and identifiers such as device data, and proving a consumer is connected to an agent does not prove the consumer authorized everything that agent did.
- An evidence exchange modeled on Ethoca Alerts would let a financial institution request a limited record of the instructions and AI agent permissions behind a disputed transaction from the agent provider. It is a proposal, and no industry standard exists yet.
- Community banks and credit unions with lean fraud teams should not wait for a standard, because agentic banking adds a third job to fraud programs, which is understanding the delegated authority a customer has given technology acting on their behalf.
The dispute we haven't figured out yet
Say I tell my agent: “Find me a laptop under $1,000, and check with me before you buy.” Instead it comes back with a $1,400 laptop it already paid for. The merchant received a valid payment, and my bank authorized it like any other transaction on my account. The agent is tied to my verified identity. Everything looks legitimate, except that I never approved that purchase.
Now imagine I call my financial institution to dispute the charge. If you’re a fraud investigator, I’m honestly not sure what you have to investigate. You’re looking at a legitimate customer working with a legitimate agent, plus a payment the bank approved without a hitch. What you don't necessarily have is visibility into the conversation between me and my agent.
At least four different stories could explain that charge:
- I approved the purchase and forgot about it.
- The agent misunderstood my instructions.
- The agent went beyond the permissions I gave it.
- I changed my mind after the fact.
These are very different circumstances, yet they could arrive in the same dispute queue.
Verified is not the same as authorized
The industry has spent years on friendly fraud. With Visa's Compelling Evidence 3.0, merchants use prior transaction history and identifiers such as device data to defend certain disputes. While that evidence still matters, proving a consumer is connected to an agent does not prove the consumer authorized everything that agent did.
There's an opportunity for new types of first-party misuse, too. A consumer could knowingly authorize a purchase through an agent and later claim the agent acted outside its instructions. Meanwhile, another consumer might have a legitimate claim against an agent that exceeded its authority.
Telling those two consumers apart raises questions for everyone involved:
- How does an investigator distinguish between the two?
- How does a merchant defend itself?
- How does the bank determine whether a claim is legitimate?
- Most importantly, who has the evidence needed to make that determination?
The industry isn't ignoring intent. On October 20, 2026, Visa, BILL, and Billtrust announced a live pilot of Visa's Trusted Agent Protocol that lets an authorized agent complete buyer-approved invoice payments within buyer-defined controls. The question I still have is what happens after the payment, when someone says it went wrong: how does the evidence travel between the parties?
What Ethoca already taught us
With Ethoca Alerts, an issuer can tell participating merchants about a disputed transaction quickly enough that they may stop fulfillment, refund the customer, and avoid a chargeback. It works because the issuer and the merchant each hold information the other lacks. With the alert in hand, the two start talking before the formal dispute.
I think we could apply a similar concept to agentic commerce.
Imagine an independent service that connects financial institutions, merchants, and AI agent providers during the investigation of a disputed agent-initiated transaction. Instead of an investigator relying solely on traditional authorization data, the institution could request evidence from the agent provider. Not necessarily the consumer's entire conversation history, but a secure, limited record of the instructions and permissions relevant to that specific transaction.
The request might establish:
- Whether the consumer authorized the agent to make purchases.
- Whether a spending limit or other restriction was established.
- Whether the transaction required additional consumer approval.
- Whether the agent acted within those instructions.
- Whether the consumer later revoked or modified the authorization.
A merchant who sees this early can fix a genuine mistake before it becomes a chargeback. Issuers can tell an agent error from unauthorized activity from first-party misuse. And the consumer isn't stuck between the bank, the merchant, and the AI provider.
To be clear, this is a proposal, not something the industry has standardized, yet. Existing networks and emerging agent protocols may supply some of the pieces, and evidence that an instruction was given won't by itself settle liability. I stand by the principle. When several parties hold different pieces of the evidence, resolving a dispute takes collaboration instead of another fraud rule.
Why community banks and credit unions should care
Now take this a step further. What happens when consumers give AI agents permission to manage their money?
Think about an agent that compares deposit rates, opens accounts, moves funds between institutions, manages subscriptions, or pays bills.
A customer might authorize an agent to “optimize their savings”, but what does that actually mean? That leaves open questions like:
- Can it move $500, $5,000, or their entire savings balance?
- Does that authorization expire?
- Does the consumer have to approve each transaction?
- What if the agent moves money to an institution the consumer never intended to use?
We’ve built fraud programs around authenticating customers and monitoring transactions. Agentic banking adds a third job, understanding the authority a customer has delegated to technology acting on their behalf. A verified human doesn't automatically mean an appropriately authorized action. Institutions with lean fraud teams shouldn't wait for someone to hand them the answer.
Where I think agentic commerce goes
I don't think blocking agents is a sustainable strategy. Banks have legitimate security concerns that need answers before agents get meaningful transactional access. Even so, consumers will experiment with tools that save them time, so we need to build guardrails that let that happen responsibly.
The pieces are coming together. Responsible agentic commerce needs us to:
- verify the human,
- identify the agent,
- establish its authority,
- record the instructions behind a transaction, and
- resolve disagreements
KYH speaks to the first. Agent protocols are working on identity, permissions, and intent. What deserves more attention is the evidence and collaboration layer after the transaction.
If we’ve learned anything from years of payment disputes, it’s that an authorization alone doesn't tell the whole story. Agentic commerce makes that lesson more important, not less.
My question for the industry: who is building the equivalent of Ethoca for agentic transactions, and what should a financial institution be able to ask for when an agent's actions are disputed?
Frequently asked questions
What is KYH in agentic commerce compliance, and how is it different from know your agent?
Sardine’s Know Your Human (KYH) connects a person’s device and identity signals to the agent transacting on their behalf. This lets a merchant see a verified human behind the purchase in agentic commerce. Know your agent frameworks work from the other direction by verifying the agent’s own identity, ownership, and permissions. Neither one shows the full scope of what a customer told the agent to do.
Why is a verified human not enough to prove AI agent authorization?
A verified human shows who is behind an agent’s purchase, and AI agent authorization asks whether the customer approved that specific purchase. An agent can be tied to a verified identity while the customer never approved the transaction, as when an AI shopping agent told to check before buying a laptop under $1,000 comes back with a $1,400 laptop it already paid for.
What is delegated authority, and what AI agent permissions should a bank ask about?
Delegated authority is the scope of what a customer has allowed an agent to do on their behalf. In agentic banking, it raises questions about how much the agent can move, whether the authorization expires, whether the customer must approve each transaction, and what happens if the agent moves money to an institution the customer never intended to use. The AI agent permissions behind each answer are what a bank may need to see when a customer disputes a transaction.
How does Visa Compelling Evidence 3.0 apply to disputes involving AI agents?
Visa Compelling Evidence 3.0 lets merchants defend certain fraud disputes by showing earlier undisputed transactions that share identifiers such as device and IP data with the disputed one. That evidence still matters for friendly fraud. It shows a customer’s connection to an agent, and it does not show what the customer instructed the agent to do.
How could an Ethoca Alerts-style process support chargeback prevention for agentic payments?
Ethoca Alerts supports chargeback prevention by letting an issuer tell participating merchants about a confirmed fraud or dispute in near real time. The merchant can then stop fulfillment and refund the customer before a chargeback posts. A similar service for agentic payments could let an institution request a limited record of the instructions and permissions behind a disputed agent-initiated transaction from the agent provider. That service is a proposal and not an industry standard today.
What is the Visa Trusted Agent Protocol, and what is the BILL and Billtrust pilot?
The Visa Trusted Agent Protocol lets approved agents sign their requests so merchants can recognize them. On October 20, 2026, Visa, BILL, and Billtrust launched a live pilot in which an authorized agent completes buyer-approved invoice payments within buyer-defined controls. The pilot addresses identity and approval controls and leaves open what happens after the payment when someone says it went wrong.
Why should community banks and credit unions care about agentic banking?
Community banks and credit unions have built fraud programs around authenticating customers and monitoring transactions, and agentic banking adds a third job, which is understanding the authority a customer has delegated to technology acting on their behalf. Lean fraud teams should not wait for someone to hand them the answer, and a fraud investigator will need a defined way to ask what the customer authorized when a dispute arrives.
