Who is responsible when an AI agent buys the wrong thing

You send an agent to book a flight. It comes back with a twelve-hour layover on a non-refundable fare. You would have taken the direct one. The agent executed the instruction you gave it, with the money you gave it, and you lost a day and two hundred euros.

Now the merchant says that was the fare. You say nobody should have bought it. The agent says you asked for the best value. All three statements are defensible, and none of them answers the question. That question is AI agent liability, and it is the part of agentic commerce that everyone ships around rather than through.

Nobody has decided, and the people who would decide say so

Start with what the incumbents say in public, because it is more honest than the marketing above it. Reshmi Suresh runs agentic commerce at Worldpay, which now sits inside Global Payments: Visa, Mastercard and American Express have all launched frameworks for agent transactions, and who bears the loss in a dispute remains largely undecided. That is a payment infrastructure company, in its own words, conceding the gap after naming the three networks.

Visa says the same thing in its own research. Its report on agentic payments states that disputes lack established resolution mechanisms, and that chargeback windows and evidence requirements were designed for human-speed commerce with clear buyer intent. Read that sentence twice. The instrument that settles card disputes was built for a person clicking buy on a page they could see, at a speed a person can produce.

In January 2026 the Consumer Bankers Association published a white paper with the payments law firm Davis Wright Tremaine, and it is the banking industry's own trade body publishing a document whose sections map where the existing consumer protection frameworks reach agent initiated commerce, and where they stop. A banking association is not a natural advocate for a new entrant's argument. That is what makes the document useful.

The three answers people actually use

• The shared card. The agent spends on a card with no boundary. Finance finds out from the statement, and nobody can reconstruct why the purchase happened.
• The confirmation button. The agent proposes, a human approves every purchase. It is safe, and it makes the agent an inbox.
• Declared autonomy. The product executes and puts the outcome on the user. It is the most common position in this category, and the easiest one to write down.

I have written before that the third position is legitimate and that I disagree with it, and I want to be precise about why. It is not wrong because it is unfair. It is wrong because it is unprovable in the only room where it matters. When a dispute arrives, nobody is arguing about intent. They are arguing about the record.

Liability follows the evidence, and that is a product decision

The clearest writing on this is not from a vendor. It is from the payments practice of a law firm, in a five part series published between April and May 2026. The part on disputes makes two sentences that I have not been able to improve on since I read them.

Operational logs are not sufficient. Evidence-quality records are.

The party with the better record will not merely win. It will control how the dispute is framed, which doctrinal category it lands in, and whether the fight even gets to a court.

The same series separates agent purchases into buckets, and the separation is the useful part. In their plainly authorised bucket, the agent did exactly as instructed and the principal regrets it. They call that commercially and legally ordinary. Cases like the flight live there, and buyers tend to lose them, because the instruction was followed.

In the middle is misauthorised commerce: the agent stayed inside the general category of what it was allowed to do but stepped outside the specific boundary. That is where the category lines are not self executing, and it is where every real product will live. A procurement agent that buys from a vendor outside policy but inside the system's general rules is the example the lawyers wrote down. That is my buyer, described by someone with no stake in my product.

The same series also opens with a line that should end an argument I keep having. Network rules and the EMV 3DS specification already govern agentic commerce in part. The ambiguity is not an absence of applicable rules. The rules exist. The fight is about which rule applies, and the record decides that.

What I am willing to answer for

So here is the position I will defend: we answer for what we were asked to do, and we prove it. We do not promise the agent will choose well. Nobody can promise that, and anyone who does is selling a model, not a system. We promise that when it chooses badly, there is a row in the record that says which instruction it was given, which rule was in force, which decision was taken, and what the agent was allowed to do at that second.

It is an uncomfortable position, because it exposes us. It also implies something almost nobody writes down: the mandate has to be written by you, in your own words, before the agent runs. Not an interface guessing what you will allow later. A boundary you set while you still know what you meant.

The alternative is the one the industry has quietly chosen. Every network now ships credentialing for agents, and every network that ships it also documents that the product is in the process of deployment. Visa's own developer page says the depiction is a representation of potential features, and that the final version may not contain all of them. That sentence is not a scandal. It is the honest state of a category that is building the rails before writing the rules that will run on them.

Agent identity and liability is the row of our own capability table that we mark as not answered. I would rather publish that than have it found later: it is a legal and product decision that has to survive a real dispute, not a paragraph. What we do have is the mechanism that makes the question answerable at all, which is a boundary set before the money moves and a receipt that survives being read by someone who was not there.

If you are building an agent that spends, the useful test is not whether it can buy. It is whether you can reconstruct one bad purchase six weeks later, from the record alone, without the conversation that produced it. I am building that record into Noesia, and the argument it sits on is the money layer for AI agents. The next piece in this thread is why there should be no LLM in the authorization path. If that reconstruction is impossible in your system, I would rather hear where it breaks than where it works. The trust argument in one page is the agentic economy is a trust problem.