American Express publishes a framework to stop AI agents making purchases you didn’t approve

What did American Express publish?

American Express published its Intent Intelligence framework on 13 October 2026. The company describes it as its recommended approach to “capturing and authenticating a customer’s purchase intent before an AI agent completes a transaction,” and then keeping that intent as a control through the rest of the transaction. Amex says it made the framework public to help build a common industry approach.

The pitch is simple: when software shops for you, the card network should know what you actually asked for. “Providing authorized purchase intent before an agent transacts can give issuers greater confidence that an agent is acting as a customer intended,” said Luke Gebb, Amex’s head of global innovation, in the announcement.

Hannah Bozian, Amex’s vice president of agentic partnerships and strategy, told TechCrunch that these transactions now involve “a consumer, a merchant, and an agent,” and that Amex wants them to be “seamless, trusted, and secure.” She was due to present the framework at TechCrunch Disrupt the same day.

How does Intent Intelligence work?

Amex describes four steps. First, the Create Intent API captures the customer’s instructions and constraints, such as the merchant, a maximum budget and other preferences. The customer then authenticates their identity and signs off on the intent the agent has captured.

Second, Amex creates an Intent ID, a unique identifier for that instruction, and a Proof of Intent Token that carries its high-level constraints. Third, the token is used to obtain a secure digital payment credential for checkout. The agent pays with that token, not the customer’s real card number, and the credential is scoped to what the customer approved.

Fourth, the Intent ID and token stay attached to the purchase. Amex says they can act as controls later in the transaction, to check that a purchase request matches what was authorised and to support fraud prevention, authorisation decisions and dispute resolution.

The key difference, Amex argues, is timing. In many current setups the issuer sees only a payment request. Here the issuer receives the authorised intent before the agent buys anything. Bozian gave TechCrunch an example: if a customer asks for white Nike sneakers in size 9 and the agent tries to buy Adidas shoes, Amex could stop the transaction.

She told Digital Transactions that customers can edit or cancel an intent through Amex or through their agent, and that issuers with earlier access to intent data could approve more good transactions while cutting fraud. The framework is meant to work whoever collects the intent, whether the agent maker, the merchant or a wallet.

Where does it fit in Amex’s ACE developer kit?

Intent Intelligence is one of five services in Amex’s Agentic Commerce Experiences (ACE) developer kit, which Amex launched in April. The ACE page lists Agent Registration, to ensure only verified agents transact on the Amex network; Account Enablement, to let cardholders link cards to verified agents; Intent Intelligence; Payment Credentials, for tokenised agent checkout; and Cart Context, which uses cart-level details for validation and disputes.

According to that page, the specifications for Account Enablement, Intent Intelligence and Payment Credentials have been available since 14 April 2026, while Agent Registration and Cart Context are still under development. So the 13 October release is best read as the published design and rationale for a service that already had a specification, not a brand-new API.

Amex says it is “actively developing ACE Kit integrations” and is in talks with partners across the payments industry. It also says it is engaging with EMVCo, the body behind card payment standards, on card-based agentic transactions, and supporting the x402 Foundation’s work on internet-native payments. Digital Transactions reports that Amex chairs EMVCo’s agentic commerce working group.

Amex is not the only company building agent checkout plumbing. On the same day AWS published a guide to agents that transact with Anchor Browser and AgentCore payments, and protocols such as Sierra’s draft Personal Agent Protocol try to define how personal agents act for users.

What protection do cardholders get?

The framework underpins a promise Amex made in April called Amex Agent Purchase Protection. The ACE page says that if a cardholder authorises a registered AI agent to buy something, and the agent sends Amex the customer’s authenticated intent, Amex will protect eligible customers from charges caused by the agent’s error.

The conditions matter. The agent must be registered with Amex and integrated with ACE, and Amex must have received the authenticated intent. An eligible error is a purchase that deviates from that intent. The cardholder must first try to return the item to the merchant where possible. Claims can be refused when intent is subjective or cannot be checked, and Amex gives “best” or “really nice” as examples.

The coverage applies to US cards issued by American Express, sits on top of normal dispute rights, and Amex says full terms will be published later. In other words, the more precise your instruction, the easier it is to prove an agent got it wrong.

Why do AI agent payments need this?

Card payments were built for two parties, a buyer and a seller, with rules for disputes between them. An AI agent adds a third party that can misread an instruction, act on a stale preference or be manipulated by a malicious web page. When that happens, it is hard to show afterwards what the customer actually authorised.

Amex says it has not yet seen more disputes because of agentic commerce, but wants controls in place before volumes grow. Bozian told Digital Transactions that Amex already sees “thousands” of agentic commerce transactions a week across its integrations. An Amex survey cited by TechCrunch found 66% of US consumers likely to use AI agents to research prices over the next 12 months.

Bozian also expects agents to act more on their own over time, for instance reordering paper towels where only price and size matter. That is where a pre-approved, machine-readable intent becomes useful. Retailers have so far kept humans in the loop: Safeway’s ChatGPT grocery experience, for example, builds a cart but leaves checkout with the retailer.

What are the limits and open questions?

Intent Intelligence checks a purchase against stated constraints. It cannot judge whether an agent picked a good product within those limits, and vague requests remain hard to enforce, as Amex’s own protection terms admit.

It also depends on adoption. Agents, merchants and other issuers have to carry the Intent ID and token through their systems, and the agent-registration piece is not finished. The framework is public, but Amex has not said who has implemented it. Fraud teams will still need their own models, such as Coinbase’s post-trained fraud classifier, alongside intent checks.

Finally, the figures about disputes, volumes and consumer interest come from Amex, and AI Lookout has not tested the API. The useful signal is that a major card network now wants a signed record of what you asked your agent to do before money moves.