# Teaching agents to pay — Anna Spysz, Stripe

Source: [AI Engineer](https://www.youtube.com/watch?v=A-zeQiYkmXk)  
Feed7 permalink: https://feed7.dev/p/teaching-agents-to-pay-anna-spysz-stripe-04jxy0s  
Published: 2026-09-01T16:30:06.000Z  
Trust: Source Linked (source_linked)

## Why Included

Agent checkout needs more than payment tools: enforce user-set limits outside the agent, expose structured merchant data, honor cancellation, and log every decision.

## Source Summary

The demo uses **UCP** as a shared interface for agents and merchants. Stores expose a capabilities manifest and structured catalog; checkout uses a **shared payment token**, so the agent receives a token rather than the raw card number.

## Practical Implication

Put spending and token validity checks at the payment provider, not inside a prompt. Also disclose the agent, show fees, honor stop or cancel, reject totals above the user's maximum, avoid pressure tactics, and keep auditable decision logs.

## Agent-Ready Context

The demo uses **UCP** as a shared interface for agents and merchants. Stores expose a capabilities manifest and structured catalog; checkout uses a **shared payment token**, so the agent receives a token rather than the raw card number.

Put spending and token validity checks at the payment provider, not inside a prompt. Also disclose the agent, show fees, honor stop or cancel, reject totals above the user's maximum, avoid pressure tactics, and keep auditable decision logs.

The hostile-salesperson example shows that a **system prompt can materially alter behavior**, even when the transaction plumbing is unchanged. These safeguards are presented as a practical checklist, not evidence that every manipulation or commerce failure is covered.

## Connected Context

Feed7 judgment across 669 accumulated Signals:

This turns payment safety into both a protocol and behavior problem. UCP structures merchant capabilities and shields raw card data, while provider-side limits, cancellation, disclosure, and audit logs constrain execution. The hostile-salesperson demo confirms that unchanged payment plumbing cannot neutralize prompt-driven manipulation, so transaction controls and behavioral policy must be enforced separately.

- [Your Agent Just Authorized What?! — Jay Mok & Ben Coumes, Paypal](https://feed7.dev/p/your-agent-just-authorized-what-jay-mok-ben-coumes-paypal-024znqi) — PayPal’s scoped, time-bound mandates strengthen Stripe’s provider-side checks by requiring payment authority to be attributable and independently verifiable.
- [AI Agents Are Just Distributed Systems Now — Salman Munaf, TikTok](https://feed7.dev/p/ai-agents-are-just-distributed-systems-now-salman-munaf-tiktok-1v4yc47) — Stripe’s checklist governs authorization and conduct, while the distributed-systems candidate adds idempotency and reconciliation for ambiguous payment outcomes after timeouts.
- [Stop AI Agent Hallucinations: 5 Techniques + Production Patterns - Elizabeth Fuentes, AWS](https://feed7.dev/p/stop-ai-agent-hallucinations-5-techniques-production-patterns-elizabeth-09g1w9s) — Its pre-call rule enforcement supports rejecting invalid totals outside free-form reasoning, but Stripe adds commerce-specific duties such as fee disclosure and honoring cancellation.
- [In Code They Act, In Proof We Trust — Erik Meijer, Leibniz Labs](https://feed7.dev/p/in-code-they-act-in-proof-we-trust-erik-meijer-leibniz-labs-1lyno2y) — The proposed proof-gated harness is a stronger version of Stripe’s separation between model intent and executable payment checks, though Stripe presents a practical checklist rather than formal verification.

## Context Map

- Layer: agent
- Domains: security
- Topics: tool-use, harness-engineering, agent-reliability

## Uncertainty

- The hostile-salesperson example shows that a **system prompt can materially alter behavior**, even when the transaction plumbing is unchanged. These safeguards are presented as a practical checklist, not evidence that every manipulation or commerce failure is covered.

## Agent Instruction

Use this item as source-backed context. Do not invent claims beyond the linked source. If this item conflicts with another source, call out the conflict.