Amex wants to stop your AI shopping agent from going rogue
American Express has built an authentication layer that locks a shopper's instructions into every agentic transaction, and it could reshape how Indian fintechs approach AI-driven payments.
The News
American Express has unveiled the Intent Intelligence Framework, a system that records and verifies exactly what a customer wants to buy before an AI agent is allowed to complete the purchase. The company announced the framework on 13 October 2026, with Hannah Bozian, Amex's VP of Agentic Partnerships and Strategy, scheduled to present it at the TechCrunch Disrupt 2026 Industry Stage the same day.
The mechanics turn on a few moving parts. A Create Intent API first captures the shopper's instructions and limits, such as the merchant, a maximum budget and product preferences. The customer then authenticates and approves that captured intent. The system mints a unique Intent ID plus a Proof of Intent Token carrying those constraints, and at checkout the token fetches a secure digital payment credential so the agent never touches the actual card number.
Bozian described agentic transactions as involving "a consumer, a merchant, and an agent", and the framework carries the shopper's instructions through that entire chain. If a customer asks for white Nike trainers in size 9 and the agent reaches for Adidas instead, Amex says it could block the payment before it clears. The framework extends the Agentic Commerce Experiences (ACE) Developer Toolkit that Amex launched in April.
Why It Matters
Large language models are nondeterministic, which is a polite way of saying they sometimes do the wrong thing with confidence. As agents start spending real money, that unpredictability turns from a quirk into a liability, and the open question for the payments industry has been who absorbs the cost of a mistaken purchase. Amex is trying to answer it by making verified intent, rather than the agent's judgement, the thing that authorises a transaction.
The timing echoes earlier platform land-grabs. When card networks raced to set tokenisation standards for mobile wallets a decade ago, the winners were those whose rails became the default. Amex clearly hopes its framework becomes that default for agentic commerce, which is why it is courting partners rather than keeping the system proprietary. Its own Trendex research adds urgency: 66% of surveyed US consumers said they were likely to use AI agents to research the best price, and 61% expected to lean on agents for product recommendations over the next 12 months.
Indian Angle
For Indian payments, the framework lands on familiar territory. The Reserve Bank of India has spent years building exactly this kind of consent architecture, from the Additional Factor of Authentication mandate to card-on-file tokenisation and the e-mandate rules that govern recurring payments. An agent that spends without explicit, auditable consent would collide head-on with those norms, so Amex's "proof of intent" design is less a novelty here and more a translation of principles the RBI already enforces.
That gives Indian players an opening. The NPCI has been piloting conversational and delegated UPI features, and fintechs such as Razorpay, PayU and Cashfree sit on the merchant side where intent tokens would need to be honoured. A home-grown equivalent, binding agentic purchases to UPI's existing mandate and tokenisation stack, is a plausible next step that regulators may prefer to a foreign card network's standard.
For Indian developers building shopping agents, the lesson is practical. Design consent capture and audit logging in from the start, because the RBI is unlikely to let autonomous spending bypass the verification rules it applies to every other digital transaction.
FAQ
When does the framework take effect?
Amex announced the Intent Intelligence Framework on 13 October 2026 as part of its ACE Developer Toolkit, which first launched in April 2026. The company says it is still in discussions with partners across the payments ecosystem about implementation, so broad rollout will depend on those agreements.
How does it stop an agent from overspending?
The customer's constraints, such as a maximum budget and specific product, are captured and locked into a Proof of Intent Token. If the agent tries to buy something outside those limits, Amex can block the transaction before it completes, and the logged Intent ID supports later fraud and dispute checks.
What does this mean for Indian fintechs?
The RBI already mandates strong consent and authentication for digital payments, so Amex's model aligns closely with Indian rules. Domestic players building on UPI's mandate and tokenisation framework could create a comparable agentic-payment standard suited to local regulation.
Where can I read the original announcement?
TechCrunch first reported the framework, with details from Amex's Hannah Bozian. The full coverage is linked in the attribution below.
This story was reported by TechCrunch. Read the full original coverage at TechCrunch.