Amex's Pre-Authorization Framework Exposes Agentic Spending Controls Gap
Source
American ExpressWhat happened
American Express announced the Intent Intelligence Framework, a technical standard designed to ensure that AI agents complete only purchases a customer has explicitly authorized in advance. Before a transaction executes, the framework requires a call to a Create Intent API. That call captures the customer's purchase parameters, returns a unique Intent ID, and issues a Proof of Intent Token. The agent must present that token at checkout. Card numbers are replaced with a secure digital reference tied to those pre-set constraints, so an agent cannot exceed the approved scope even if it tries. The announcement comes as agentic purchasing tools proliferate and as concerns about unauthorized agent actions have drawn regulatory attention, including the FTC's industry-wide probe into rogue AI agent risks.
Why it matters
- ·Organizations running AI agents that make purchases through non-Amex payment rails have no equivalent network-level pre-authorization control. Internal policy limits and spend caps remain the only safeguard against unauthorized agentic transactions.
- ·The framework introduces a new artifact, the Intent Token, that functions as audit evidence of authorized spend. Compliance teams that rely on NIST AI Risk Management Framework (AI RMF 1.0) and Playbook principles or internal AI decision-logging controls will need to determine whether their systems can capture and retain these tokens as part of an agent action audit trail.
- ·Because the framework is a vendor-side technical standard rather than a regulation, it creates asymmetric risk. Enterprises using Amex for agentic payments gain a built-in control. Those on other rails must build equivalent pre-authorization logic themselves or accept a higher residual risk of unauthorized agent spending.
Stay ahead of stories like this
Get developments like this, plus everything else that matters in AI governance. Every Thursday.
Recent issues
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Map every AI agent in your environment that has the ability to initiate or complete a purchase, expense claim, or procurement action, and identify which payment rails each one uses.
- ☐For agents that do not transact through American Express, document what pre-authorization control prevents an agent from spending beyond its approved parameters, and flag gaps where only a policy rule or spend-cap setting exists.
- ☐Ask your finance and engineering teams whether Intent Tokens or equivalent authorization records will be captured and retained in your AI action audit logs, and confirm your log retention policy covers them.
- ☐Review vendor contracts with any third-party agentic purchasing or procurement tool to confirm whether the vendor provides a pre-authorization mechanism and what evidence they supply for audit purposes.
- ☐Add agentic payment authorization to your next agent permission boundary review, and set criteria for when a human must approve an intent configuration before an agent is allowed to use it.
What to watch next
The FTC's open probe into rogue AI agent risks means that unauthorized agentic purchases could trigger enforcement action, not just internal audit findings. Watch for other payment networks and procurement platforms to respond with comparable pre-authorization standards. Such standards would establish an industry baseline and raise the bar for what regulators and auditors consider a minimum control. Organizations preparing for the EU AI Act (Regulation (EU) 2024/1689) should also monitor whether agentic purchasing tools get classified as high-risk systems. That classification would impose additional conformity requirements on intent-capture mechanisms.