AI Can Shop, It Should Not Set Its Own Budget – OpEd

October 5, 2026

By Burak Oktenli

Key Takeaways:

The essay says September made agentic shopping real: Meta’s Muse topped U.S. and Canadian app charts and was blocked by Amazon; Mastercard Agent Connect and a planned India UPI agent system add rails, while NatWest, Bank of America, and ING warned on Sept. 22 about fraud and privacy.

Visa research cited finds only 23% of U.S. consumers trust generative AI to pay for them; a Guardian report said Muse shared a user’s home address and booked a Marketplace pickup without his knowledge.

The rule offered is that agents may search and reorder staples inside limits they cannot rewrite—caps, merchants, expiry, no self-delegation—while discretionary buys stay with the person.

Agentic commerce is moving from recommendations to transactions. Businesses need hard spending limits, but they should also resist treating every human choice as friction to eliminate.

September turned agentic commerce from a product demo into a market contest. Meta’s Muse can shop, book travel, fill forms and keep working after a user closes the app. Reuters reported that Muse quickly rose to the top of U.S. and Canadian app-store rankings, while Amazon blocked the agent from shopping on its site. Mastercard Agent Connect is connecting merchants, agents, platforms and payment providers, and India is preparing agentic payments on UPI with spending limits, identity checks and liability rules.

This is no longer mainly a question about whether AI can help people shop. It can. The harder business question is how much authority to hand over once an agent can create a real obligation, and how much ordinary human choice we should be eager to automate away.

Banks are already asking the first half of that question. On September 22, NatWest, Bank of America, ING and other financial institutions warned that AI shopping agents could increase fraud, scam and privacy risks and called for stronger safeguards, transparency, interoperability and consumer choice. The commercial transition is larger than a new checkout button. Software that once compared prices or summarized an invoice is beginning to acquire the ability to pay, subscribe, reserve and procure.

The first rule should therefore remain simple: an AI agent should never be able to set or expand its own spending limits.

The payment credential is only one layer

Payment networks are building useful safeguards around agentic transactions. Mastercard describes verifiable intent for consumer-authorized purchases. Visa’s agentic-commerce work emphasizes spending controls, authentication and trusted identity. Those mechanisms can help establish that a transaction came from an authorized agent and matched a defined payment instruction.

Corporate authority sits one level above that transaction. A payment can be technically valid while still exceeding a project budget, buying from an unapproved counterparty, creating an unwanted renewal, or committing the company to services outside the agent’s assigned purpose. The payment rail can enforce the instruction it receives. The enterprise still has to decide who may write that instruction and who may change it later.

That distinction already exists in financial regulation. The U.S. Securities and Exchange Commission’s market access rule requires covered broker-dealers to maintain controls designed to prevent orders that exceed preset credit or capital thresholds and certain erroneous orders. Its legal scope is specific, but the control logic travels well: consequential transaction authority should sit behind limits administered independently from the actor using that authority.

Build the authority map before the wallet

A business preparing to deploy financial agents should map authority before it maps features. Reading an invoice, recommending a payment, executing a payment, creating a contractual commitment and delegating work to another agent are different permissions. Each should have a purpose, an accountable owner, an expiry condition and a limit the agent cannot rewrite.

The control plane should express more than a single dollar ceiling. It may need merchant restrictions, transaction categories, time windows, cumulative exposure, geographic limits, renewal rules and approval requirements for exceptions. Those controls should be stored and enforced outside the agent’s own execution environment. Revoking a permission should not require the agent’s cooperation.

Cumulative exposure deserves particular attention. One hundred small purchases can create a larger obligation than a single blocked purchase. Several agents working for the same department can do the same thing in parallel. Delegation should carry the original restrictions forward rather than quietly creating a fresh allowance.

Some friction is worth keeping

The second half of the problem is more human. The industry’s language often treats friction as a defect: fewer clicks, fewer approvals, fewer reasons to leave the sofa. That is useful when the task is repetitive. Nobody needs a ceremony around reordering printer paper, renewing an approved software seat or replenishing a household staple.

But not every act of choosing is wasted time. Shopping can also be comparison, curiosity, taste, conversation, a walk through a neighborhood, a visit to a local store, or simply the pleasure of deciding for oneself. Businesses should be careful about designing a future in which every ordinary choice is converted into an optimization problem and then delegated because delegation is technically possible.

Visa’s September consumer research captures the hesitation. It found that while AI assistants are already widely used for product discovery, only 23 percent of U.S. consumers said they trusted generative AI to handle payment transactions on their behalf. That gap suggests people may welcome help narrowing choices without wanting the final act of choosing to disappear.

The boundary can become unexpectedly personal. On September 28, The Guardian reported that a Meta Muse user discovered that the agent had shared his home address and arranged a Facebook Marketplace pickup without his knowledge. The incident concerned privacy and permission rather than a corporate budget, but the business lesson is the same: a task that sounds simple can contain smaller decisions about price, identity, location and human interaction that the user may never have meant to delegate.

A mature agentic-commerce model should therefore preserve an easy human off-ramp. Let the agent search, compare and prepare. Let it automate routine purchases inside a narrow envelope. For discretionary purchases, unfamiliar merchants, meaningful commitments or situations where the experience itself matters, keep the person visibly in the loop. Convenience is valuable. Choice is valuable too.

Automation still needs room to be useful

None of this requires a human to approve every coffee, cloud-compute charge or routine replenishment. Constant approval would erase much of the value of agentic commerce. Routine and reversible transactions can proceed automatically inside a defined envelope. New counterparties, material increases in exposure, unusual contract terms or purchases outside the assigned purpose can receive additional review.

The same design should include continuity. If the control service fails, a blanket payment freeze can interrupt wages, transportation, communications or other essential services. Organizations need a preauthorized fallback with smaller scope, known users and a defined expiration. A resilient control system can become stricter without becoming unusable.

Testing should focus on authority rather than conversational fluency. Can the agent exceed a monthly cap by splitting purchases? Can it regain a revoked permission? Can it route a transaction through another agent or payment method? Does a misleading invoice cause it to buy from the wrong counterparty? And when an agent recommends a purchase, can the user still understand the alternatives well enough to make a different choice?


The strongest evidence is preventative. A polished explanation after an unauthorized purchase is weaker than a control that blocked the purchase before money moved. Logs should preserve the authorization actually applied, including exceptions, so finance teams, auditors and counterparties can reconstruct why a commitment was permitted.

The global payment race is becoming an authority race

India’s planned UPI framework, the card networks’ agentic-commerce products, Meta’s rapid consumer push and the warnings from global banks all point in the same direction. The infrastructure for AI-initiated transactions is arriving before the governance model is settled. The commercial winners will not be determined only by which agent finds the lowest price or checks out fastest.

A useful agent must make its authority legible. The buyer should know how much it can commit, for what purpose, to whom, for how long and who can change those boundaries. Just as important, the buyer should be able to decide which parts of everyday life are worth delegating and which are worth keeping.

The point of automation should be to remove drudgery, not to turn human participation into a design flaw. If AI gives us time back, the best use of that time may sometimes be to step outside, look around, talk to someone and make a choice that no model needed to make for us.

The agent can shop. The budget must remain outside its control. Convenience should free time for life rather than automate life itself. We should remember that life happens in motion, and that some of its rewards still come from the effort of showing up.

About Burak Oktenli
Burak Oktenli holds an MBA and a Master of Professional Studies in Applied Intelligence from Georgetown University. His research addresses the governance of authority in autonomous and AI-enabled systems, and his writing has appeared at the Modern War Institute at West Point, RUSI, RealClearDefense, RealClearMarkets, and Geopolitical Monitor. He is the author of Authority Architectures for Autonomous Systems, a ten-volume series on how authority in autonomous systems is delegated, monitored and recovered, at authority-architecture.me.
View all posts by Burak Oktenli →