Amex will now check what your agent was allowed to buy. Who checks everything else?

American Express just said out loud what most companies running agents still haven't. Asking the agent to behave is not a control. The "yes" has to be written down before the agent acts, and something other than the agent has to check it. Amex built that for card payments. Your agents' other actions still don't have it.

/01What Amex shipped

On 13 October, Amex published a framework it calls Intent Intelligence¹². The idea is simple. Before an agent buys anything, the person's instructions become a set of limits. The person signs off on those limits. Then the card issuer holds the agent to them.

The steps, from Amex's own write-up¹:

1. /01

   Capture the intent. The agent asks follow-up questions until it knows enough. Then it records the limits: a maximum amount, an expiry date, a merchant preference, and the maximum number of purchases.

2. /02

   Sign it. The person confirms who they are and signs off on the limits the agent captured. Amex names Passkey as one way to do this¹.

3. /03

   Issue proof. After sign-off, an Intent ID and a Proof of Intent Token are issued. The token is a JSON Web Token that carries the high-level limits¹.

4. /04

   Scope the card. The token is used to get a payment credential for checkout, instead of the real card number. That credential is scoped to what the person signed¹².

5. /05

   Check at checkout. Later purchase requests can be checked against the signed intent. The same record backs fraud checks and disputes².

Amex's VP of Agentic Partnerships and Strategy, Hannah Bozian, gave TechCrunch an example³. You ask for white Nike sneakers in size 9. The agent tries to buy Adidas. Amex could stop that transaction, because it doesn't match what you signed.

Amex says it has not yet seen a rise in disputes from agentic shopping³. It is building this anyway, before agent shopping scales.

/02Why this is the right shape

Look at where the check sits. Not in the prompt. Not in the model's judgment. It sits with the issuer, a party the agent can't talk into anything.

Amex is also blunt about where agents go wrong. In a cart flow, the agent could change the cart after you approve it¹. In a broad request ("build me a website, but don't spend more than $100"), it has to read your intent, pick the merchant, and get the purchase right¹. Each of those is a step where a well-meaning agent can drift.

The answer isn't a smarter agent. It's a boundary the agent can't edit, checked when the money moves.

/03The gap Amex can't close for you

Intent Intelligence covers one action: paying with a card.

Now list what your agents do that never touches a card. They draft and send supplier emails. They update the bank details in your vendor master. They approve refunds, change prices, close tickets, post to Slack. None of those pass through an issuer. Nobody checks the change against a limit someone signed.

So the payment might be the safest thing your agent does. A bank-detail change that sends next week's payment to the wrong account can go through with no check at all.

One more detail worth reading closely. Amex lets the issuer hand sign-off to a third party, and the agent is on that list¹. That's a sensible option for a network built for many models. Inside your own company it's a trap. If the agent collects the "yes", the agent can be handed a fake one.

/04What to copy this week

1. /01

   Write limits, not instructions. For each action an agent can take, state the cap: amount, counterparty, expiry, count. "Refunds up to $200, this customer, today, once" is a rule. "Be careful with refunds" is a wish.

2. /02

   Get the sign-off from a person, outside the chat. The approval should arrive in a channel the agent can't write to. If a "yes" can show up as a message the agent reads, it isn't sign-off.

3. /03

   Enforce at the moment of action. Amex checks at checkout, not at planning time. Your rules should run right before the write happens, so a changed plan still meets the same wall.

4. /04

   Give the agent a scoped key, never the master key. Amex never hands the agent the real card number. Give your agents credentials limited to the signed task, and let them expire.

5. /05

   Keep the record for the argument later. Amex built this largely around disputes. Yours will be an auditor or a customer asking, "who allowed this?" Store what was approved, by whom, and what actually ran.

That's the job Gatehouse does for everything that isn't a card payment. Every agent action is checked against your rules before it runs. Anything outside them is held for one named approver. Every decision lands on the record.

Start small. Pick the one agent action that moves money and isn't a card payment. Write down its limits today.

Want the next one? News with a take, three times a week. Follow by RSS →