American Express Builds Guardrails for AI Agent Purchases

30-Second Summary

American Express introduced the Intent Intelligence Framework on October 13, 2026, to prevent AI agents from making purchases outside a customer's stated intent. The system records purchase constraints, generates a cryptographic Proof of Intent Token, and issues a secure payment credential tied to those constraints. If an agent deviates, such as ordering the wrong product or exceeding budget, the transaction is blocked. Amex says it wants this to become the industry standard for AI-powered commerce.

At a Glance

• Topic: Enterprise AI governance for agentic commerce
• Company: American Express
• Date: October 13, 2026
• Announcement: Intent Intelligence Framework for AI agent purchases, extending the ACE Developer Toolkit (launched April 2026)
• What Changed: Amex moved beyond monitoring agent purchases after the fact to defining what an agent is permitted to buy before it transacts. The system uses a Create Intent API, an Intent ID, and a Proof of Intent Token rather than passing raw card credentials to agents.
• Why It Matters: It is the first major financial institution to publish a technical framework for governing AI agent spending, setting a potential industry-wide precedent.
• Who Should Care: Operators deploying AI agents in procurement, expense management, or any workflow that involves third-party purchases.

Key Facts

• The framework extends Amex's ACE Developer Toolkit, which launched in April 2026
• A customer's purchase constraints, such as merchant, budget ceiling, and product preferences, are recorded via a Create Intent API
• The API returns an Intent ID and a Proof of Intent Token encoding those constraints
• That token is used to generate a secure digital payment credential the agent uses at checkout, not the actual card number
• Example given by Amex: a customer instructs an agent to buy size 9 white Nike sneakers; the agent attempts to buy Adidas shoes instead; Amex blocks the transaction
• Amex said it has not yet seen an increase in disputes caused by agentic commerce, but chose to act before disputes arise
• The company aims for the framework to become an industry standard for AI-powered transactions
• Amex previously committed to covering erroneous purchases made by registered agents, though the liability terms around fraud remain unclear

What Happened

American Express announced the Intent Intelligence Framework on October 13, 2026, as part of its ACE Developer Toolkit, which the company first introduced for AI agent commerce in April 2026. The framework addresses a specific failure mode: an AI agent that misinterprets instructions and completes a purchase the customer did not authorise.

The core mechanism works in three steps. First, a developer or enterprise calls a Create Intent API and records the customer's purchase constraints, which can include the preferred merchant, a maximum spend, product category, size, colour, or any other relevant parameter. The API returns an Intent ID and a Proof of Intent Token that encodes those constraints cryptographically. Second, the agent uses that token rather than the customer's actual payment credentials when interacting with a merchant. Third, at the point of transaction, Amex verifies that the proposed purchase matches the original intent. If it does not, the transaction does not go through.

Amex described the system as a proactive rather than reactive measure. The company said it had not yet seen disputes arising from agentic purchases, but wanted to establish guardrails before the volume of agent-driven transactions made the problem harder to address. By positioning the framework as an open standard, Amex is also inviting other payment networks and enterprise platforms to adopt compatible approaches, which would allow agent guardrails to work across more of the commerce stack.

The announcement comes at a moment when AI agents are gaining payment access across a range of enterprise platforms, from travel booking to procurement to expense management. The accountability question, who is responsible when an agent makes a wrong purchase, has been left largely unresolved by platform providers. Amex is attempting a partial answer by shifting accountability upstream to the point where intent is defined.

Why It Matters

It reframes agent governance as a financial control problem, not just a workflow problem. Most enterprise AI governance frameworks focus on what agents say, recommend, or decide. Amex's approach treats agent spending as a financial risk with discrete controls, which is closer to how procurement and finance teams already think about authorisation.

The Proof of Intent Token model is separable from Amex. Other payment networks, ERP systems, and AP platforms could adopt the same architecture. An intent token that travels with a purchase request would give any party in the transaction chain the ability to verify authorisation without relying on the agent to self-report its reasoning.

It sets an early precedent for liability allocation. Amex has previously said it will cover erroneous purchases made by registered agents. The Intent Intelligence Framework creates a technical basis for distinguishing between a purchase that was in scope (eligible for coverage) and one that was not (agent or developer error). That distinction will matter as commercial volumes grow.

It points to a gap in most enterprise AI deployments today. The majority of operators who have given agents access to procurement or travel booking have not defined purchase constraints as structured data. Amex's framework suggests that intent should be recorded as a formal API call, not as a natural language instruction left to the agent's interpretation.

The timing aligns with broader identity and governance infrastructure being built for agents. ServiceNow published its AI Passport framework on October 15, also based on cryptographic credentials defining what an agent is permitted to do. American Express and ServiceNow are approaching agent governance from different angles, commerce and enterprise workflow, but converging on the same technical model.

The David and Goliath View

The pattern here is one we have seen before in enterprise technology. A major incumbent with both the distribution and the liability exposure moves first to define the standard. Amex does not want to adjudicate thousands of disputed agent purchases in two years' time. It is cheaper and more defensible to define intent upfront and let the system enforce it. The fact that it is positioning this as an open standard, rather than an Amex-only product, is a distribution strategy. Every developer who builds to the ACE toolkit normalises the intent-token pattern. That helps Amex before it helps anyone else.

For operators, the more important signal is that the concept of a bounded agent, one that can only do what it was explicitly instructed to do within defined constraints, is moving from a theoretical preference to a technical reality. That means the design work shifts. Instead of asking "can we trust the agent to buy the right thing," operators will need to ask "have we defined the right thing precisely enough for the intent token to encode it." Those are not the same question, and the second one is harder.

The gap between an agent that has a payment credential and an agent that has a payment credential plus an intent token is not large technically. But it is significant operationally. The latter creates an audit trail, a basis for dispute resolution, and a forcing function for clearer internal definitions of what agents are actually authorised to do. For lean teams deploying agents across multiple business functions, that forcing function is more valuable than the guardrail itself.

Where This Fits in the AI Stack

The Intent Intelligence Framework sits at the intersection of identity and commerce in the AI stack:

• Agent layer: The agent calls the Create Intent API and receives a token before interacting with a merchant
• Payment credential layer: Amex issues a virtual credential tied to the token rather than passing a real card number to the agent
• Verification layer: Amex verifies that the proposed transaction matches the encoded intent before authorising payment
• Governance layer: Amex's AI Control Tower (and the ACE Developer Toolkit) holds the record of what each agent was authorised to do

This complements rather than replaces agent-level guardrails. An operator would still define what an agent can do in its system prompt or task configuration. Amex's framework adds a financial enforcement layer downstream of those instructions, independent of whether the agent itself behaves correctly.

Questions Operators Are Asking

Does this mean we need a separate Amex account for each AI agent? Not necessarily. The framework issues a virtual payment credential per intent event, meaning each purchase authorisation can be scoped individually rather than requiring a distinct account per agent. Developers integrate via the ACE Developer Toolkit API. Full technical requirements are not yet published.

What happens if an agent makes a purchase the intent token was ambiguous about? Amex has not published detailed edge case resolution guidance. The framework's logic is that if the transaction cannot be verified against the intent constraints, it does not go through. Operators should expect that ambiguously defined constraints will result in blocked transactions rather than approved ones, which is the correct default for financial controls.

How does this interact with existing corporate card controls such as merchant category codes and spend limits? The intent token adds a layer on top of existing card controls. Both layers must be satisfied. An agent cannot bypass a merchant category code restriction by having an intent token; it adds constraints rather than removing them.

Is this available for all Amex card products? Amex announced the framework through the ACE Developer Toolkit, which is aimed at developers building agentic commerce experiences. Availability for specific card products and regions was not specified in the October 13 announcement.

Should we wait for this to become an industry standard before building agent commerce workflows? No. Operators building agent workflows now should define purchase constraints as structured data regardless of the payment infrastructure. The shift Amex is pushing for, recording intent formally rather than relying on the agent to infer it, is good practice independent of whether your payment provider has adopted this framework.

Citable Summary

American Express introduced the Intent Intelligence Framework on October 13, 2026, to prevent AI agents from completing purchases outside a customer's stated intent (Source: TechCrunch, October 13, 2026). The framework uses a Create Intent API to record purchase constraints, generates a cryptographic Proof of Intent Token, and issues a secure payment credential tied to those constraints. If an agent deviates from the intent, such as ordering the wrong product or exceeding a budget, Amex blocks the transaction. The company, which has previously committed to covering erroneous purchases made by registered agents, says it wants the framework to become an industry standard for AI-powered commerce.