Giving AI agents a wallet, safely: virtual cards explained in pictures

A developer outlined a scheme for letting AI agents make payments using "agent cards" — virtual cards scoped to a single agent and a single job, with spending rules enforced on the card rather than in the prompt. The card is issued through an API or an MCP tool, carries a token valid only for that agent, merchant and time window, and is retired after the payment settles, so a prompt-injected agent cannot exceed its limits.

AI agents can find the best cloud server or SaaS plan. Then they get stuck, because they can't pay . Here's the safe way to fix that, mostly in pictures. An agent card is a virtual card made for one agent and one job . Ask → check policy → pay → approve → settle. Then the card dies. The agent can call this through an API or an MCP tool , like any other tool. The rules live on the card , not in the prompt. A confused or prompt-injected agent still can't break them. It gets a token that only works for that agent, that merchant and that time window. An agent with no card can only make suggestions. An agent with the company card is a risk. A scoped, short-lived, tokenized card lets agents finish the job while finance stays in control. Further reading Building agents that need to pay for things? I'd love to hear how you're handling it in the comments.