American Express is building infrastructure that lets AI agents shop and pay on behalf of customers. The system uses intent contracts and single-use tokens to keep transactions within defined limits. It is called the Agentic Commerce Experiences (ACE) developer kit, and Amex is pitching it as what has been missing from agentic commerce so far.
The core pitch is control. When a user sets up an agent, they define what they want it to do and how much they are willing to spend. The ACE system then generates an Intent ID and a Proof of Intent Token, which lock in that authorization. When the agent is ready to pay, it receives a single-use token tied to those constraints.
"Once the agent has found the item that the customer has asked for, like red shoes, they'll make a call for the payment credentials, which is a token that has the boundaries that the card member has provided," said Luke Gebb, Amex's EVP and global head of innovation. "So, for instance, if they said they only wanted to spend $500, that token won't allow for a purchase of $600 because it has controls built in."
Amex has a structural advantage here that most payment companies lack. Unlike Visa or Mastercard, which operate payment networks but do not issue cards themselves, Amex functions as both the card issuer and the payment network. That closed-loop setup means it can validate agent-led transactions end to end without relying on a third-party bank.
Gebb framed this as a first. "Some of what is missing so far is the perspective of a company like ours," he told VentureBeat. "This is really the first time that an issuer is coming to the table."
Amex already participates in Google's Agent Pay Protocol, which focuses on interoperability across payment systems. ACE is a different angle — less about connecting to other networks, more about owning the full transaction stack.
The kit covers five areas: agent registration, account enablement, intent intelligence, payment credentials, and cart context. Registration handles identity verification between the customer's agent and the merchant's agent. Account enablement links the user's Amex account to their agent. Intent intelligence defines what the agent is authorized to do. Payment credentials handle the actual transaction. Cart context allows banks and merchants to compare what the agent bought against what the user originally requested.
But for all its structure, ACE has a transparency problem. Amex says it validates transactions and checks agent behavior against user intent — but it has not explained how that validation actually works. It describes the layers where validation happens, not the mechanics behind it.
That matters. Raj Ananthanpillai, founder and CEO of identity verification company Trua, argues that payment kits like ACE, Stripe's Agentic Commerce Suite, and Google's Verifiable Intent proof chain all share the same blind spot. "They excel at handling proofs, verifiable authorizations and the mechanics of fund movement, but leave upstream human validation opaque and underdeveloped," he said.
Ananthanpillai added that without a clear cryptographic link proving an agent is acting under verified human authority, the whole ecosystem is exposed. Merchants, issuers, and networks face real risks: repudiation, chargebacks, fraud, and potentially sanctioned individuals moving money through automated systems.
None of this is unique to Amex. Agentic commerce is still early, and most players are figuring out where accountability sits when an AI agent makes a bad call. Amex's kit is a serious attempt at building guardrails. Whether those guardrails are auditable enough for broad adoption is a different question — and one the industry has not yet answered.
