Your AI Is About to Spend Your Money. Who Is Responsible When It Buys the Wrong Thing?
"Buy It for Me"
Imagine telling your AI:
"Find me the best flight to London next Thursday. Keep it under $1,500. Business class if possible."
Today, you might expect recommendations.
Tomorrow, the AI may simply book it.
It finds the flight.
Chooses the airline.
Selects the fare.
Enters the payment details.
Accepts the cancellation terms.
And spends $1,437 of your money.
You never saw the checkout page.
At what point did a recommendation become permission?
AI Is Crossing a Boundary Most People Haven't Noticed
Until now, most consumer AI has lived on one side of an important line.
It could: search, recommend, summarize, compare, explain.
You still acted.
Agentic commerce moves AI across the line. The UK government already describes agentic AI as a step change from decision support toward systems that can autonomously plan, coordinate, and take action across services.
Now it can: choose, authorize, purchase, book, subscribe, cancel, negotiate.
AI used to help you make decisions.
Now we are teaching it to turn decisions into consequences.
The Banks Have Started Asking the Uncomfortable Questions
Major banks, including Bank of America, Capital One, ING, NatWest, and Commonwealth Bank of Australia, are warning that agentic commerce creates risks around: fraudulent transactions, incorrect purchases, misuse of payment information, privacy, weaker consumer protections, lack of transparency, and disputes about responsibility.
These are not theoretical philosophy problems anymore.
Banks are asking because money is about to move.
The financial system understands something the AI industry is only beginning to confront: action requires accountability.
The $200 Mistake Is Easy. The $20,000 Mistake Is Different.
Your AI buys the wrong toothpaste.
Annoying.
Your AI books a non-refundable $8,000 vacation.
Different.
Your AI renews a business contract.
Different.
Your AI chooses insurance.
Different.
Your AI moves money.
Different.
Your AI selects a mortgage or financial product. Legal scholars are already exploring agentic systems that could select financial products such as credit cards, loans, mortgages, insurance, and bank accounts on behalf of consumers.
Very different.
Delegation feels convenient until the consequence becomes expensive.
The Real Problem Is Not Intelligence. It Is Authority.
An AI may understand perfectly that: "Ernesto usually prefers business class."
That is information.
It may infer: "This flight is probably worth the extra $600."
That is judgment.
But: "Buy it." is authority.
These are three separate layers:
- Knowledge: What does the system know?
- Judgment: What does the system recommend?
- Authority: What is it allowed to change?
Knowing what I want does not automatically grant permission to act on it.
What Exactly Did You Authorize?
Suppose you tell an agent: "Keep my groceries stocked."
What did you authorize? Could it spend $500? Substitute brands? Sign you up for subscriptions? Switch retailers? Use a different credit card? Accept terms and conditions? Buy from a merchant you have never used? Pay more because delivery is faster?
Human language is intentionally ambiguous. Financial authorization cannot afford to be.
"Do Whatever You Think Is Best" Is a Terrible Financial Permission Model. Humans talk loosely. "Get me the best one," "Take care of it," or "Whatever makes sense" are perfectly reasonable between humans because humans share: context, norms, social consequences, and the ability to clarify.
Machines may interpret those phrases operationally.
Natural language is excellent for expressing intent. It may be terrible for defining authority.
Who Pays When the Agent Is Wrong?
Scenario:
You authorized: "Find the cheapest refundable flight."
The agent books: cheapest flight, non-refundable.
Whose mistake?
- You?
- The AI company?
- The airline?
- The payment network?
- The bank?
- The merchant?
- The developer who built the agent?
- The model provider?
- The tool the agent called?
Banks are explicitly asking for clearer responsibility and consumer protections around such transactions.
We know how to dispute a fraudulent credit-card transaction. We do not yet have equally mature social rules for disputing a machine's interpretation of our intent.
Intent Is About to Become Machine-Readable
Payment giants like Visa and Mastercard are building the infrastructure that could let AI agents transact with delegated authority. Mastercard's agentic payment infrastructure uses mechanisms such as virtual credentials, predefined limits, and agent-specific tokens intended to reflect user authorization. Visa is similarly building frameworks around agent identity, permissions, and consumer control.
The payment system is beginning to encode something humans previously carried implicitly:
What exactly did this person authorize this machine to do?
Your AI May Need a Financial Passport
A human has: identity, bank account, signature, card, permissions.
An agent increasingly needs equivalents: verifiable identity, delegated authority, spending ceiling, allowed merchants, expiration, prohibited categories, revocation, and evidence of intent.
The future AI agent may need something resembling what we might call a financial passport: proof not merely of who it is, but whose authority it carries and where that authority ends.
Permission Is Not Binary
Current thinking often feels like: agent access ON/OFF.
Too crude.
Authority should be scoped.
Example:
- "Buy groceries up to $200/week."
- Different from: "Buy anything up to $200."
- Different from: "Spend up to $200 anywhere."
- Different from: "Move $200 from my account."
Permission without scope is not governance.
Delegation is not the same as abdication. Giving an AI authority to act should not mean surrendering the ability to reconstruct, revoke, or contest that authority afterward.
The important question is no longer whether the AI has access. It is what kind of authority that access carries.
What Happens When the Agent Delegates?
Your assistant doesn't necessarily perform everything itself.
It might call: a travel agent, a payment agent, a booking system, a merchant bot, a delivery platform.
Your authority may travel through a chain of machines you never directly instructed.
Who authorized the downstream agent? Can one AI delegate your authority to another AI? Does the second one inherit all permissions? Some? For how long?
Delegated intelligence creates delegated authority. And delegated authority creates lineage problems.
Decision Lineage Becomes Financial Infrastructure
When an AI spends money, we may need to reconstruct not just what happened, but how authority moved from human intent to machine action.
A traditional receipt tells you: what, when, how much. But agentic commerce may require more: what instruction initiated the transaction, what constraints were active, which agent acted, what alternatives it considered, which tool executed, what permissions existed, whether the agent exceeded them, and who approved exceptions.
A receipt records the purchase. It does not necessarily record the judgment that caused the purchase.
The age of AI commerce may require a lineage of authorization, not merely a record of payment.
Human request → interpretation → recommendation → delegated permission → tool call → transaction → consequence.
This is Decision Lineage.
If nobody can reconstruct that chain, responsibility becomes guesswork.
Consumer Trust Is Already the Bottleneck
Visa's current consumer research says people like the convenience, but concerns remain high around data security, privacy, wrong purchases, and loss of control. 85% say control over the data agents access is important, while roughly half fear decisions being made without them.
Forrester reported that about three-quarters of surveyed online adults in the U.S., UK, and Canada were uncomfortable allowing an AI agent to autonomously complete payment even with preset limits.
The technology may already be capable of spending. The public is not yet convinced it should.
We Are Solving the Wrong Problem If We Only Make the Agent Smarter
The instinct will be: better model = fewer mistakes.
But even perfect reasoning doesn't answer: what was authorized? Who owns the consequence? When must the AI ask? When should authority expire? When must a human re-enter the loop?
A smarter agent is not automatically a more governable agent.
Intelligence determines what an AI can figure out. Governance determines what it is allowed to do about it.
The Recursum Connection
This is one of the problems Recursum is built around: separating access, judgment, and authority.
An intelligence can know something without being authorized to act.
It can recommend something without having permission to execute it.
And when it does act, the chain from instruction to consequence should remain reconstructable.
Agency should never erase accountability.
The more autonomous the system becomes, the more important its lineage becomes.
The Real Future of AI Is Not Chatting
The first era: AI answers.
Next: AI advises.
Then: AI acts.
And once AI acts: AI creates consequences.
The most important AI question may soon stop being "Was the answer correct?"
It may become "Was the machine authorized to do what it just did?"
Ending
For the last few years, we have argued about whether AI can think.
That debate may soon feel strangely academic.
Because the systems now arriving do not merely produce answers.
- They book.
- They buy.
- They subscribe.
- They negotiate.
- They transact.
Eventually, they may move meaningful parts of our financial lives without requiring us to touch the screen.
That may be incredibly convenient.
It may also expose a distinction we should have made much earlier.
Understanding what you want is not the same as having permission to do it.
- AI can become more intelligent.
- AI can become more autonomous.
Neither automatically gives it authority.
And once machines can convert language into financial consequences, we are going to need more than better models.
We are going to need boundaries.
Provenance.
Revocation.
Accountability.
And a record of exactly how our intention became their action.
Because the most important question in the next era of AI may not be:
"What did the AI decide?"
It may be:
"Who gave it permission?"
TL;DR: The moment AI can spend your money, intelligence becomes authority. Most people still view AI as a recommendation tool, but agentic AI is crossing a boundary, enabling autonomous actions like booking flights or making purchases. Major banks are already warning about the risks: fraud, incorrect purchases, privacy breaches, and unclear responsibility when transactions go wrong. The problem escalates from minor annoyances (wrong toothpaste) to significant financial consequences (wrong vacation, business contract).
The core distinction is that knowledge and judgment do not automatically grant authority to act. Human language, often ambiguous ("Do whatever you think is best"), is ill-suited for defining financial authorization for machines. The central legal question is "Who pays when the agent is wrong?" as current dispute mechanisms are inadequate for machine-initiated transactions. Payment giants like Visa and Mastercard are building infrastructure to encode human intent and delegated authority into machine-readable "financial passports" for AI agents. Permission is not binary; it needs to be scoped and granular.
Delegation is not abdication. The danger is compounded when one AI delegates your authority to another AI, creating complex lineage problems. A traditional receipt is no longer enough; the age of AI commerce requires a lineage of authorization, not just payment. This makes Decision Lineage crucial financial infrastructure. Consumer trust is a significant bottleneck, with most consumers uncomfortable delegating autonomous payments to AI. The solution is not just smarter agents, but better governance, as intelligence does not automatically equate to governability.
Recursum is built around separating access, judgment, and authority, ensuring agency never eradicates accountability. The future of AI is not just chatting. it's acting, creating consequences, and demanding accountability for who gave it permission.
By Ernesto Verdugo, AI Architect, Founder of Verdugo Labs, and Creator of Recursum. He builds systems for what happens when human and artificial intelligence stop working separately.
Links:
- ernestoverdugo.com
- Recursum.AI