Delegated authority is the power one party gives another to act, decide or spend on its behalf, within limits the first party sets. In payments it now refers mainly to the permission a person or business grants to software, especially an AI agent, to find, buy and pay for goods or services without the person approving every step. The grant usually states what may be bought, from whom, up to what amount and for how long.
The idea is far older than software. Agency law has long dealt with employees who sign contracts for a company, brokers who trade for clients and holders of a power of attorney. What is new in agentic commerce is that the agent is a program, so the scope of its authority has to be written down in a form that merchants, banks and card networks can check by machine.
Delegated authority in plain terms
Think of handing a house-sitter a spare key and a note: water the plants, buy groceries up to a set amount, do not open the safe. The key gives access, but the note is what tells everyone, including the house-sitter, what is allowed. If the sitter buys a television, the note shows the purchase was outside the deal.
Delegated authority in payments works the same way. A shopper might tell an assistant app to book the cheapest train ticket to a city on Friday, spending no more than a set sum. The app may search, compare and pay, but only inside those instructions. The note in this case is a digital record, and every business the app deals with can read it to confirm the shopper really agreed to the purchase and that the purchase stays inside the limits.
Background in agency law
In general law, an agent acts for a principal, and the principal is bound by what the agent does within its authority. Common-law systems distinguish several kinds of authority:
- Actual express authority. The principal states the powers directly, in words or in writing, such as a signed mandate or a board resolution.
- Actual implied authority. Powers that reasonably follow from the role, such as a purchasing manager ordering routine office supplies.
- Apparent authority. Powers a third party reasonably believes the agent has because of how the principal has behaved, even if the principal never granted them.
In the United States these rules are summarised in the American Law Institute's Restatement (Third) of Agency, published in 2006. Companies apply the same logic internally through delegation-of-authority policies that set who may sign contracts or approve payments of a given size. In insurance, the phrase also describes binding authority, under which an insurer allows a broker or coverholder to issue policies in its name.
How delegated authority works for AI agents
Agent payment schemes turn the instruction into a structured, signed record usually called an agentic mandate. Google's Agent Payments Protocol (AP2), announced in September 2025, defines mandates that capture the user's request and the approved basket, protected with a digital signature so they cannot be altered. Mastercard's verifiable intent framework pursues the same goal of proving what the user actually authorised.
Card networks add their own controls. Visa Intelligent Commerce and Mastercard Agent Pay issue agent-specific credentials built on network tokenization, so the agent never holds the real card number and the token can be limited or switched off. Merchant-side specifications such as the Agentic Commerce Protocol (ACP) describe how a checkout receives the agent's request.
Limits, scope and revocation
A well-formed grant of authority to a payment agent typically sets:
- A spending cap. A maximum per purchase, per day or over the life of the grant.
- A merchant or category scope. Specific sellers, or types of goods, that the agent may buy from.
- A time window. An expiry date, after which the authority lapses on its own.
- Presence rules. Whether the user must confirm each purchase or may be absent, as with recurring payments.
- A revocation route. A way for the user to withdraw the authority immediately, for example by deleting the agent's token.
Narrow scope protects the user if the agent is tricked or malfunctions, and gives the merchant and issuer clear evidence when a purchase is later questioned.
Liability and regulation
Whether a payment made by an agent counts as authorised decides who bears a loss. In the United States, Regulation E treats a transfer made by a person to whom the consumer gave an access device as authorised, unless the consumer has told the financial institution that the authority is withdrawn; card disputes follow network chargeback rules. In the European Union, PSD2 requires a payer's consent and, for most electronic payments, strong customer authentication, which raises the question of how a user authenticates once and delegates afterwards. Regulators had not issued agent-specific payment rules as of November 2026, so the industry relies on mandates and network rules to show consent.
The term should not be confused with an authorized delegate in US money transmission law, which is a business appointed by a licensed money transmitter to provide services on its behalf.