AI Agent

An AI agent is a piece of software that uses an artificial-intelligence model to pursue a goal on someone's behalf, deciding which steps to take and using tools, such as web browsers, databases, an application programming interface (API) or payment credentials, to carry them out. Businesses use agents for customer service, research, software development and back-office work; consumers increasingly use them to search, compare and buy.

In computer science, an "agent" has long meant any system that perceives its environment and acts to achieve objectives. The current meaning, common since about 2023, refers to agents built on large language models that can reason in natural language and call external tools. They differ from chatbots, which answer questions, and from traditional automation, which follows fixed rules. In payments, the term overlaps with agentic commerce, where an agent finds and pays for goods, and must not be confused with human or business agents such as an agent in banking or a payment services agent.

A chatbot is like a knowledgeable shop assistant who answers questions but never leaves the counter. An AI agent is more like a personal errand-runner. You say "book me a train to Manchester on Friday morning under £60," and it checks timetables, compares fares, picks a seat and pays, coming back only if something needs your decision.

The errand-runner is useful because it acts, and risky for the same reason. You need to trust its judgement, limit what it may spend, and be able to check afterwards what it did and why.

Most agents combine four parts:

• A model. A language model interprets the goal, breaks it into steps and decides what to do next.
• Tools. Connectors let the agent search, read files, run code, fill forms or call APIs. Open standards such as the Model Context Protocol describe how agents connect to tools and data sources.
• Memory and context. The agent keeps track of results so far and relevant information about the user.
• Guardrails. Permissions, spending limits and human approval steps restrict what it may do.

The agent runs a loop: plan, act, observe the result, and adjust until the goal is met or it needs help. Coding agents use the same loop to write and test software, which underpins much of vibe coding.

Agents vary in how much freedom they have. Some only suggest actions for a person to approve; others act alone within set limits; a few coordinate several specialised agents, one researching, another drafting and a third checking the work. The more autonomy an agent has, the more its designers rely on testing, monitoring and clear limits rather than on a person watching each step. Reliability also depends on the quality of the tools and data the agent can reach: an agent working from outdated prices or incomplete records will make confident but wrong decisions.

When an agent buys something, the payment system must answer questions it was not designed for: did the human authorise this purchase, within what limits, and who is liable if it goes wrong? Card networks and technology firms have published frameworks to address this. Examples include Visa Intelligent Commerce, Mastercard Agent Pay, the Agent Payments Protocol (AP2) and the Agentic Commerce Protocol (ACP).

Common building blocks are an agentic mandate, a signed record of what the user allowed; network tokenization, so the agent holds a restricted token instead of the real card number; and step-up checks such as strong customer authentication for higher-risk purchases. Banks and payment firms also use agents internally, for example to triage alerts in transaction monitoring or draft responses to disputes, usually with a person signing off. Agents can also help fraud detection teams investigate suspicious patterns faster, although final decisions to block accounts or file reports generally stay with trained staff.

Agents introduce several distinct risks:

• Errors at speed. A misunderstanding can lead to wrong purchases or transfers before anyone notices.
• Manipulation. Hidden instructions on a web page or in a document ("prompt injection") can steer an agent to leak data or pay the wrong party, a new form of social engineering.
• Credential exposure. Agents that hold passwords or keys widen the attack surface; a compromise can turn into account takeover or a data breach.
• Accountability. Firms remain responsible for decisions made by their systems, including consumer-protection, AML and privacy duties.

Good practice includes giving each agent the least access it needs, security hardening of the systems it touches, logging every action, setting monetary limits and keeping humans in the loop for irreversible steps. Frameworks such as the NIST AI Risk Management Framework and the EU Artificial Intelligence Act set broader expectations for testing, transparency and oversight.

• NIST AI Risk Management Framework
• Model Context Protocol