Building safe Payment Infrastructure for the autonomous economy — Steve Kaliski, Stripe

This talk addresses the challenge of enabling AI agents to spend money autonomously and safely. Steve Kaliski from Stripe presents a framework for separating non-deterministic discovery from deterministic transactions. He introduces three key components of Stripe's solution: Shared Payment Tokens for secure credential sharing with enforced spending limits, the Machine Payments Protocol for paying for API tool calls, and the Agent to Commerce Protocol (ACP) for structured, API-driven e-commerce checkouts. Through code examples, the talk demonstrates how these primitives create a secure and auditable payment infrastructure for the emerging autonomous economy.

June 6, 2026 4 min read

Building safe Payment Infrastructure for the autonomous economy — Steve Kaliski, Stripe — source: https://www.youtube.com/watch?v=KLSuFPj2ld0

The Dichotomy of Agent Operations

The central thesis is that for agents to become safe economic actors, we must separate two distinct modes of operation:

Discovery and Exploration: This phase benefits from the non-determinism of LLMs, which can sift through vast amounts of information to recommend products or businesses.
Transactions and Credentials: This phase requires determinism to ensure security, accuracy, and control. The goal is to isolate the “what to do” from the “how to transact.”

Agents are already economic actors, spending currency in the form of tokens with their respective LLM providers. The challenge is to extend this capability to any business in a secure and scalable way.

The Risks of “Human Mimicry” in Payments

Letting an agent operate a web browser like a human to make purchases introduces significant risks:

Wrong Place: An agent may not be able to reliably verify a website’s domain, potentially falling for phishing sites.
Wrong Thing: While navigating a site, an agent could easily select the wrong product or a much more expensive variant.
Wrong Amount: Agents can mis-parse prices from a webpage due to dynamic pricing, different currencies, or taxes, leading to incorrect spending.
Wrong Credential: Pasting raw credit card details into web forms is insecure and doesn’t work for many modern payment methods.

The ideal approach moves away from this “robot operating a browser” model towards a programmatic, API-driven interaction, much like developers use the Stripe API instead of its web dashboard.

Stripe’s Three-Pronged Solution for Safe Agent Transactions

Stripe has developed a set of primitives to build a deterministic and secure payment infrastructure for agents.

1. Shared Payment Tokens

This mechanism addresses the problem of securely sharing payment credentials. Instead of handing over a raw card number, an agent can provision a Shared Payment Token. This token has several key features:

Scoped to a Seller: The token is cryptographically bound to a specific merchant account.
Enforced Limits: The agent can encode a “smart contract” with limitations on usage, such as a maximum amount ($25), a specific currency (USD), and an expiration date (30 days).
PSP-Level Enforcement: These limits are enforced by Stripe. In the demo, a seller attempting to charge $50 against a token limited to $25 resulted in a payment failure, demonstrating the security rail.
Auditable and Universal: The system works across hundreds of payment method types and provides an auditable trail, while still giving the seller necessary risk-assessment data like card brand and last four digits.

2. Machine Payments Protocol

Developed with Tempo, this protocol is designed for paying for discrete tool or API calls. It standardizes the process of monetizing API endpoints:

An agent makes an HTTP request to a protected endpoint.
The server responds with a 402 Payment Required status code.
The response body contains an encoded payload detailing the cost, the recipient, and the payment mechanism.
The agent uses this information to approve and execute the payment to gain access to the resource.

This creates a deterministic flow for ephemeral, pay-per-use interactions.

3. Agent to Commerce Protocol (ACP)

Built in collaboration with OpenAI, ACP standardizes the entire e-commerce checkout process for agents. It replaces browser-scraping with a structured API dialogue between the agent, the seller, and the Payment Service Provider (PSP).

Programmatic Catalog: Businesses can expose their product catalog in a machine-readable JSON format.
Structured Checkout Flow: An agent sends API requests to update the cart (e.g., change quantity, select shipping).
Seller-Controlled State: After each request, the seller responds with the complete, updated state of the cart as a structured JSON object, including price, taxes, and fulfillment options. This ensures the agent has the authoritative, deterministic state of the purchase before committing to payment.

Conclusion: Building an Agent-Friendly Economy

To enable safe autonomous commerce, businesses should make their products “agent-friendly” by exposing APIs rather than relying solely on UIs. By leveraging primitives like Shared Payment Tokens and protocols like ACP, the industry can build an ecosystem where:

Discovery remains flexible and non-deterministic.
Transactions are constrained within verifiable, deterministic, and structured negotiations. This combination minimizes the “blast radius” of potential errors and enables agents to become powerful and safe economic actors.