When an AI Agent Pays a Supplier, Who Sets the Limits?

A purchase can change after the instruction

The Deutsche Bundesbank published an analysis of agentic payments on 21 September. It describes a possible payment process in which an AI agent can choose the payment method and timing, then act within a mandate previously given by a customer. The Bundesbank says these systems still account for a small share of the market and are mostly at an early stage. Its concern is practical: as agents gain freedom to make choices, the conditions under which they may authorise a payment need to remain clear.

Imagine a facilities manager asks an AI agent to order replacement safety gloves from an approved supplier, spending no more than £600.

The supplier has run out. The agent finds a similar product elsewhere for £540. Delivery adds £45. The new seller also offers a recurring order that would save money on future purchases.

The original instruction has given the agent something useful to do. It has not answered every question raised by the alternative:

• Is the new supplier approved?
• Are the substitute gloves suitable for the intended work?
• Does the £600 limit include delivery?
• May the agent agree to repeat purchases?
• Who can approve a change to those terms?

A business could settle these questions in advance for some purchases. Others would need a person to decide. The important point is that the agent's ability to complete the order does not settle its authority to accept each change.

The payment mandate has several parts

The Bundesbank describes an authorisation layer that determines who grants a mandate to an agent, under what conditions, and how it can be reviewed or revoked. It also notes that an agent with greater autonomy may choose among payment instruments, timings and routes.

For the glove order, a useful mandate might identify the purchasing organisation, permitted suppliers, product category, total limit, expiry time and person authorised to approve an exception. It would also need a way to recognise that the proposed purchase has changed.

An agent's verified identity helps the business know which agent is asking to act. The transaction still needs to be considered against the authority that agent was given. A payment request for £585 from a different supplier presents a different question from the original £600 instruction.

The UK's Financial Services AI Adoption Plan, published on 14 July 2026, records industry concerns about consent, liability and fraud in automated payment flows. It recommends work on legal responsibility, agent identity, authentication and governance. These are recommendations and areas for further work; they do not establish a completed UK standard for agentic payments.

Check the proposed action while there is still time to change it

A business could allow the original purchase and send the substitute to an authorised buyer. It could approve the new supplier for one purchase while refusing the recurring order. If the agent cannot establish the seller or the full price, it could hold that purchase for review.

Those are decisions about a particular proposed action. They need to occur before the purchase is made.

Singapore's Monetary Authority has published an industry white paper called Safeguards for Agentic Finance at Runtime. Its 3 July announcement describes checkpoints that verify and record an agent's proposed actions before execution against defined mandates, policies and risk boundaries. MAS presents this as an industry framework under development, with further pilots and experimentation envisaged.

The commercial question for a payment provider or business is therefore concrete: when the agent changes the supplier, amount or terms, does the approval process see the purchase it is now proposing?

Keep the decision and the payment connected

If the order is disputed later, the business will need more than a record saying that an agent placed it.

It may need to establish the original instruction, the changed purchase, the authority available at that point, any human approval and the result returned to the agent. The merchant and payment systems must supply their own evidence of what was accepted and paid. A record of an authority decision alone cannot establish that the payment took place.

PF Systems' proposed role is to help an organisation evaluate a consequential action against governed context and preserve evidence of that evaluation. PF Memory provides the relevant context. PF Kernel evaluates the proposed action and can return Allow, Deny, Modify, Step Up or Stop the Line. PF Core preserves linked evidence and lineage so the governed evaluation can be checked or replayed where the necessary material has been retained. ClientBridge connects systems without taking Kernel authority; PF Trace displays the evidence, and Proof Harness can qualify it against a defined exercise.

That proposition does not make the agent's underlying AI deterministic. It also does not establish that a purchase was lawful, suitable or successfully paid. Those claims need their own authority and evidence.

Start with one purchasing workflow

The first useful PF Systems exercise would be a controlled shadow pilot using representative purchase requests. The existing purchasing and payment process would continue as usual. PF Systems would evaluate copies of proposed actions without sending a live order or payment.

The test could include an approved purchase, a changed supplier, a delivery charge that crosses a limit, a request for a subscription and a revoked mandate. Reviewers could then ask whether each proposal reached the right decision, whether a person was involved when required, and whether they could reconstruct why.

That would give the organisation evidence about one defined workflow. Connecting a control to live payment execution would require a separate technical, operational and legal decision.

The Bundesbank's report shows why this question matters now. As agents gain more room to choose how a task is completed, businesses need to know whether the final transaction still falls within what the customer authorised.