American Express has a plan for the nightmare scenario of agentic shopping: you ask an AI agent for white Nike sneakers in size 9, and it checks out with Adidas. On October 13, 2026, Amex introduced the Intent Intelligence Framework, a way to capture what you authorized before the agent pays, and to check the purchase against it afterward. It is a payments-network answer to a model-behavior problem, and the design is worth understanding whichever card you carry.
TL;DR
| Question | Answer |
|---|---|
| What is it? | A framework that records and authenticates a customer's purchase intent before an AI agent completes a transaction |
| Who announced it? | American Express, via TechCrunch's interview with Hannah Bozian, VP of Agentic Partnerships and Strategy |
| Core mechanism | Create Intent API, customer sign-off, Intent ID, Proof of Intent Token, then a secure payment credential for the agent |
| What does the agent get? | A digital payment credential instead of the customer's real card number |
| Is it live for everyone? | No; Amex is in discussions with payments partners about implementation |
| Have disputes risen? | Amex says no, it is building ahead of the curve |
| What is unproven? | How well it works against a compromised or prompt-injected agent |
Primary reporting: TechCrunch's interview. Background on the April toolkit: FStech.
How does the Intent Intelligence Framework work?
Per TechCrunch, the flow has five steps.
- Create Intent API. The agent captures the customer's instructions and constraints, such as the merchant's name, maximum budget and product preferences. How that intent is collected can vary by AI model; Amex says the framework is meant to be flexible enough for all agentic commerce models.
- Customer sign-off. The customer authenticates their identity and approves the captured intent.
- Intent ID and Proof of Intent Token. Amex generates a unique Intent ID and a token containing the customer's high-level constraints.
- Secure credential. The token is used to obtain a digital payment credential that the agent uses at checkout in place of the customer's actual card number.
- Downstream reuse. The Intent ID and token can be used later in the transaction for fraud prevention and dispute resolution.
The point is ordering. Bozian told TechCrunch: "Our approach differs from the implementations of others in that it pulls intent earlier into the transaction flow. And this is important because it helps mitigate some risk before the risk occurs." Most dispute systems work after money has moved. This one tries to check a charge against a signed record while the charge is being made.
Why now: agents are nondeterministic
Language-model agents misfire. They pick the wrong variant, misread a budget, or follow instructions from a web page. TechCrunch frames the problem as the "nondeterministic nature of large language models," which makes unauthorized or mistaken purchases a realistic cost of delegating spending.
Amex also cites demand. In its recent Trendex report, 66% of surveyed US consumers said they were likely to use AI agents to research the best price for a product or service, and 61% said they would use them for recommendations over the next 12 months (figures supplied by Amex to TechCrunch, not independently verified). The same interview says Amex has not yet seen disputes rise because of agentic commerce, and is acting proactively.
This is the same tension we have followed across the agent-payments stack. Mastercard's Agent Pay for machines approached it from the network side, Cloudflare Wallets gave agents capped spending balances, and Baselayer's know-your-agent identity tackled who the agent actually is. Amex's piece is the "what exactly were you allowed to buy" layer.
How does it relate to the April ACE toolkit?
The framework follows Amex's April launch of Agentic Commerce Experiences, the ACE Developer Kit. According to FStech's report on that launch, ACE has five core services: agent registration, account enablement, intent intelligence, payment credentials and cart context. The intent service is now the Intent Intelligence Framework, and Amex hopes it becomes an industry standard.
April also brought Amex Agent Purchase Protection. FStech reports Amex said it would protect eligible cardholders from charges arising from AI agent errors, provided the user authorizes the agent and authenticated purchase intent is transmitted. Read that condition closely: the protection depends on the intent record existing. The new framework is how that record gets created.
FStech describes the protection as a proposed model covering charges caused by agent errors. It is not clear from what we could read that it extends to an attacker who hijacks the agent, so check the terms before relying on it.
Autonomy is the real target
Bozian made a point that clarifies the design. Many agents today ask for consent before buying, but Amex expects agents to act more autonomously in some cases, for example re-ordering household staples like paper towels where only price and size matter, not brand. In those cases, she said, it makes sense to have technology "in the loop" performing an extra check that the transaction matches the customer's intent.
A log of which agent was authorized to do what, and when, could also help with fraud involving agents, she noted. That audit trail is useful whether or not the model is trustworthy, because it gives merchants, banks and customers a shared record in a dispute.
Timeline: from ACE to intent
| Date | Event | Source |
|---|---|---|
| April 15, 2026 | Amex launches the ACE Developer Kit and Agent Purchase Protection | FStech |
| Since April | Amex says it has seen no rise in agentic-commerce disputes | TechCrunch |
| October 13, 2026 | Intent Intelligence Framework introduced; Bozian presents it at TechCrunch Disrupt's Industry Stage | TechCrunch |
The sequence matters. In April Amex offered a promise (protection for agent errors) and a toolkit. In October it adds the specific data structure, the intent record, that makes the promise enforceable and auditable. That is a common pattern in payments: first the liability rule, then the technical standard that lets everyone prove which side of the rule a transaction falls on.
Questions people are asking
Does the agent ever see my card number? According to Amex's description, no. The agent receives a secure digital payment credential obtained through the token, not the real card number. That limits damage if the credential leaks, though a stolen credential tied to a valid intent could still be used within its constraints.
Who decides whether a purchase matches the intent? Amex, in its role across the transaction. The company argued in April that its closed-loop position as issuer, network and acquirer gives it end-to-end visibility, which is why it can check an agent's request against the stored constraints. Open-network card systems would need several parties to cooperate to do the same.
What happens when the agent is only a little off? The interview describes a clear mismatch, a different brand. It does not say how strict matching is for fuzzier constraints such as "a similar jacket under $150." Expect that tolerance to be a policy decision negotiated with merchants.
Is this a standard yet? No. Amex says it hopes the framework becomes an industry standard, which is an aspiration, not an adoption claim.
What the framework does not solve
- Prompt injection. If a malicious page tricks the agent into proposing a different intent, and the user rubber-stamps a sign-off screen, the token will faithfully certify the wrong thing. The control is only as good as the human approval step.
- Merchant-side agents. The framework protects the card. It does not stop a rogue agent from other harmful actions such as leaking data or making non-payment API calls.
- Adoption. Amex says it is in discussions with partners across the payments ecosystem. Until merchants, wallets and agent platforms integrate the Create Intent API, it protects nothing.
- Platform friction. Retailers are already pushing back on agents, as in Amazon blocking Meta's Muse shopping agent and the startup angle in Paul Graham's note on agent bans.
- Competing standards. Stripe and Link, Shopify's agentic checkout work with Meta and the Personal Agent Protocol are all aiming at overlapping ground.
What to do if you build or buy with agents
If you build agents that spend money, adopt the pattern even without Amex.
| Practice | Why |
|---|---|
| Capture constraints explicitly (merchant, cap, item attributes) before any checkout step | A machine-checkable intent beats a chat transcript |
| Require human sign-off for new merchants or amounts above a cap | Limits blast radius when the model misreads |
| Use scoped, single-use credentials, not stored cards | A leaked credential then buys little |
| Log every authorization with agent identity and timestamp | You will need it for disputes |
| Verify the final cart against the intent in code, not in the prompt | Models are the unreliable part |
For teams worried about agents taking dangerous actions beyond payments, a runtime control such as AgentBeam, the agent security platform from the explainx.ai team, is built to stop AI agents before they take dangerous actions, which complements what a payment network can check at the credential layer.
If you are a consumer: keep agent spending limits low, review confirmation screens instead of tapping through them, and ask your card issuer in writing what protections cover agent-initiated charges.
Our read
Amex's move is notable because it treats agent purchases as a three-party transaction, consumer, merchant and agent, and puts a signed statement of intent at the center. That is a sound security pattern, borrowed from how payments already separates authorization from settlement. It is also early: no availability date, no independent testing, and a protection promise whose fine print we have not seen in full. Watch for which payment partners sign on, whether Visa and Mastercard converge on a compatible token, and the first real dispute data.
Related reading
- Mastercard Agent Pay for machines
- Cloudflare Wallets for AI agent payments
- Baselayer and know-your-agent identity
- Stripe Link and Grok shopping
- Shopify and Meta agentic checkout
- Personal Agent Protocol open standard
- Amazon blocks Meta's Muse shopping agent
Details are accurate as of October 13, 2026 and rely on Amex statements reported by TechCrunch and FStech; check Amex's documentation for current terms.