When an AI agent pays, know if it was allowed to.
Nyx, our decision platform, checks the agent’s signature, who it acts for and the limits it was given, then records the evidence. Your PSP embeds it in front of checkout.
- SignatureVerified against the rails
- PrincipalBound to the cardholder
- MandateWithin scope, caps and expiry
- Search productsDiscoveryPILOT READY
- Add to cartStays with the merchant
- Make paymentVerificationIN BUILD
- Track orderStays with the merchant
Verify agents that pay. Be readable to agents that shop.
Both sit on the seller’s side and are embedded by the PSP. Verification also exists on the issuing side, where a bank authorises its own customer’s agent. A merchant can also come to us directly, and the endpoint runs the same way.
Was this agent allowed to make this purchase?
Is the agent what it claims, and who delegated to it. Was the purchase inside the mandate’s scope, caps and expiry. Accept, challenge or refuse, with an evidence record a chargeback can be answered from.
Be found and understood by the customer’s agent.
Products, stock, price, delivery windows, returns and machine-readable policy, published to the agent protocols and answered live from the merchant’s systems. A utility inside the endpoint, not a portal.
The signals a fraud model leans on are the ones an agent does not have.
Not a new fraud typology to add to a model. A different actor, with a different kind of evidence.
- Device fingerprint and reputation
- Typing cadence, dwell time, navigation path
- Session and IP as a proxy for the person
- Velocity read as human impatience
- Step-up challenges aimed at a human who is not there
- The signature the rail presents and the principal it names
- Delegated scope: categories, merchants, purposes
- Per-transaction, daily and cumulative caps
- Mandate age, expiry and revocation
- The agent operator’s behavior over time, as its own baseline
- What the agent was shown before it bought
Context · agentic payment rails live (Visa TAP · Mastercard Agent Pay · 2025 · UCP · 2026) · 3% of transactions involve an agent, per UK and US merchants (Checkout.com · 2026) · no liability shift for agent transactions yet, in any jurisdiction (Worldpay · 2026) · 25% of breaches from AI-agent abuse by 2028 (Gartner · 2024)
Most of this is machinery we already run.
The decision layer underneath is the engine the fraud pack already runs on: features, authored policy, a synchronous verdict under a hard timeout and an audit reference for every call.
Agent and principal as first-class entities. The signature the rail presents (RFC 9421 via Visa TAP, Mastercard Agent Pay and UCP; NPCI’s protocol when live) and the mandate (UPI Reserve Pay, e-mandates, agentic tokens), checked at decision time.
Shaped with the first design partnersA library or edge middleware a PSP embeds for its merchants. It classifies traffic as verified agent, unverified automation or human, checks the mandate and writes the evidence record. Stateless; the decision runs beside it.
Built with the first PSPProducts, availability, capabilities and policy in machine-readable form, published to the agent protocols and answered live from the merchant’s systems. A utility inside the endpoint.
The publish side is done · it is not the productTwo agents settling terms, bundles and substitutions under two sets of policy. The primitives point that way.
Not built · direction, not productA PSP shadow pilot, on a handful of merchants.
- MeasureHow much of your merchants’ traffic is already an agent, how much is verified, and how much is declined as card-not-present risk.Your own traffic
- EmbedA library or edge middleware in front of checkout. Stores, integrations and money movement stay where they are.No migration
- Decide in shadowEvery agent purchase gets a verdict and an evidence record beside your live checks, acting on nothing.Acts on nothing
- Enforce, narrowlyA scoped set of merchants, with your caps, your fallback and your rollback, on evidence from your own traffic.Your caps, your rollback
Proven first on the merchants most exposed to agent traffic: travel, ticketing, electronics, quick commerce. Pre-launch: publishing to the agent protocols is ready to pilot, the agent and mandate fields are in build and the endpoint is open to design partners; everything here describes designed behavior to be proven on partner data, not a measured production result.
What we are not claiming.
Agentic Commerce is attracting a lot of language. Here is where ours stops, so an evaluator does not have to work it out in a meeting.
The rest of the engine, the evidence record and how a pack declares a new decision domain are on the Platform page →
What gets asked about agents.
Including the answers that are no.
What actually changes when an agent is the buyer?
The device fingerprint, session and behavioral signals a fraud model was trained on are gone. What arrives instead is a signature and a mandate. Every rail verifies the key; none decides whether a given transaction sits inside the mandate, none verifies the principal behind the agent, and none assigns liability.
Who buys this, the PSP or the merchant?
The PSP or acquirer, which embeds the trust endpoint for the merchants it serves. A merchant can come directly and the endpoint runs the same way, but the motion is through the PSP.
What does the endpoint actually do at checkout?
It verifies the incoming agent's signature, classifies the traffic as verified agent, unverified automation or human, checks the presented mandate against scope and limits, and writes the evidence record. It is stateless, and it sits in front of checkout without a migration.
What does publishing to the agent protocols do?
It puts products, availability, capabilities and machine-readable policy where a customer's agent can read them, answered live from your systems rather than from a nightly export. It is ready to pilot and ships as a utility inside the endpoint. It does not affect ranking or placement inside ChatGPT, Gemini or any other agent surface, which is not something anyone can sell you.
Which protocols does it read?
RFC 9421 signatures as carried by Visa Trusted Agent Protocol, Mastercard Agent Pay and the Universal Commerce Protocol, plus ACP and AP2 intent and cart mandates, and NPCI's Unified Agent Protocol once it clears RBI approval. Each sits behind an adapter into the canonical schema; the first is built with the first design partner.
How far along is it?
Publishing to the agent protocols is ready to pilot. Agent verification is in build; the endpoint itself is open to design partners. Agent-to-agent negotiation is direction: not built, not in a pilot, not on a price list. Nothing agentic is benchmarked.