Visa and Mastercard joined an alliance about who your agent answers to, and the law still says nobody

Rain launched the Agentic Payments Alliance on 18 August 2026, and Visa, Mastercard, Fiserv, Circle, Solana and Remitly put their names on it as founding members [1][2].

The day before, a separate piece of reporting set out that an agent which moves money cannot be sued for moving it wrongly [3]. Those two facts belong in the same paragraph, and mostly they are not.

Who is actually in it

The release is dated 18 August 2026 out of New York and names more than twenty-five organisations [1]. Alongside the two card networks sit Fiserv, Circle, Solana, Remitly, Shift4, Evertec, Lithic, Sardine, Chainalysis, Fireblocks, Uniswap Labs, Turnkey, Avalanche, Monad, Episode Six, Basis Theory, Crossmint, Coinflow, PayOS, Yuno, Kala, delta Network and Rialo by Subzero Labs [1]. Finextra and PYMNTS both carried it the same day [4][2].

Read the roster by function rather than by logo. There are issuers and processors, a stablecoin issuer, two chains, a chain analytics firm, a custody firm, two card issuing platforms and a fraud shop. That is most of an authorisation path, assembled by companies who each own one segment of it and none of whom own the whole.

The stated early work is shared research, testing emerging standards for agent identity and authorisation, and advocacy on the regulatory questions [1]. The number underneath it is McKinsey's projection of three to five trillion dollars in global agentic commerce by 2030 [1]. Sherri Haymond, executive vice president and global head of Digital Commercialization at Mastercard, framed the risk as innovation outpacing alignment [1].

She is describing a real problem. Both card networks already run their own agent schemes, which is why a coalition rather than a product is the thing being announced.

The gap the alliance is standing over

PYMNTS put the legal position plainly on 17 August, drawing on a Gamma Law analysis of whether an AI agent can form an enforceable contract [3]. An autonomous system cannot own property, incur an obligation or carry liability. When one gets a payment wrong, the loss lands on the user, the developer or the platform operator, because those are the parties the law can find [3].

The remedies the analysis reaches for are spending limits, approval thresholds, monitoring and audit logs [3]. Anyone who has run a payments operation will recognise that list. It is dual control, transaction limits and a reconciliation trail, which is what we built for human operators for the same reason: the authority had to sit somewhere a person could be pointed at.

This is why the alliance's identity and authorisation work matters more than a standards docket usually does. Deciding what an agent's credential asserts is deciding who eats a bad transaction, and that half is the one with money in it.

Meanwhile, almost nobody is spending on this

Ramp published its AI Index for August on 12 August 2026, measuring July spending [5]. The top one per cent of United States businesses spent a median of $7,400 per employee on AI. The top ten per cent spent about $650. The median company spent $11.95 [5][6].

Eleven dollars and ninety-five cents per employee buys a couple of seats and a trial nobody got round to cancelling. Running agents against your own money costs considerably more than that.

Two figures from the same reporting sit underneath that. Of the S&P 500 companies reporting second quarter earnings, two per cent quantified an AI effect at all, and of that two per cent, eleven per cent cited a measurable productivity gain [6]. Meanwhile 39.1 per cent of chief financial officers expect a positive return within one to two years, up from nothing in mid-2025 [6].

Read from the rails

Stack the three and they are running at different speeds. The infrastructure layer is organising now, on a roster of more than twenty-five companies and a projection. The legal layer has not moved at all, so a bad payment still lands on whoever deployed the agent that made it. Demand, meanwhile, is a median of twelve dollars a head, and ninety-eight per cent of the S&P 500 would not put a number on any of it in front of their own investors.

Rails get built by people who believe in the volume before the volume exists, which is the order it has always happened in and the reverse of how it gets told afterwards.

The practical read, if you are shipping into this: the identity and authorisation standards being drafted right now will decide your chargeback exposure in 2029, and the window in which a small integrator can say something about them is open while a working group is still writing rather than after it publishes. Rain says the coalition is run collectively by its founding members rather than owned by any one company [1]. The founding roster runs to more than twenty-five names, and not one of them is a retailer.