AI agents can find the best cloud server or SaaS plan. Then they get stuck, because they can't pay. Here's the safe way to fix that, mostly in pictures.
An agent card is a virtual card made for one agent and one job.
Ask → check policy → pay → approve → settle. Then the card dies.
The agent can call this through an API or an MCP tool, like any other tool.
The rules live on the card, not in the prompt. A confused or prompt-injected agent still can't break them.
It gets a token that only works for that agent, that merchant and that time window.
An agent with no card can only make suggestions. An agent with the company card is a risk. A scoped, short-lived, tokenized card lets agents finish the job while finance stays in control.
Further reading
Building agents that need to pay for things? I'd love to hear how you're handling it in the comments.