Google’s agent payment protocol writes a very good receipt, and nobody has said who pays when the agent buys the wrong thing

Google’s Agent Payments Protocol will hand you an excellent receipt. Fortune’s piece of 24 August 2026 is precise about what is on it. AP2 “creates records that can show the user’s approved limits and the information presented to each participant when a transaction is disputed”, and it “shows how the evidence could travel” [1]. It is a real piece of engineering and it does the hard half.

What it does not do, in the same article’s wording, is decide who bears the loss, or specify how long each company must keep that evidence and how it can be retrieved later [1].

I have built dispute handling on card rails, where retention periods are written down and boring and argued over by people whose job is retention periods. A record that everyone can produce and nobody is obliged to keep is not evidence. It is evidence-shaped.

The token outlives the instruction

The smaller problem in the same piece is the one that will actually bite a builder this quarter. An OAuth access token issued for one purpose does not stop existing when the purpose does. Fortune puts it plainly: the application “may still obtain or present a valid access token that permits checkout today, even when the current instruction says to search but not buy” [1].

Read that as a shape rather than as a Google problem, because it is not one. Your agent holds a credential scoped to what it might ever need. Your prompt scopes what it should do this minute. Those two things live in different systems, they are written by different people, and only one of them is checked at the moment money moves. The instruction sits in a log and the token sits in the request, and the payment network only ever sees one of them.

Fortune also reports that NIST is working through comments on its February 2026 draft on agent identity and authorisation, and that the initial effort covers agents operating inside organisations, explicitly leaving out agents arriving from untrusted outside sources at this phase [1].

The first federal attempt is riding inside an antitrust bill

S.5051 is worth reading for its title. Congress’s own bill status record gives the official title as “A bill to promote competition and reduce consumer switching costs in the provision of online services, and for other purposes”, sponsored by Senator Mark R. Warner of Virginia, introduced on 21 July 2026 and read twice and referred to the Committee on Commerce, Science, and Transportation the same day [2]. The short title is the Artificial Intelligence Access, Gatekeeper Exchange and Nondiscriminatory Transfer Act of 2026, which is where the AI AGENT acronym is quarried from [3].

PYMNTS, writing on 14 July 2026, sets out the mechanism. Large online platforms, defined as those with at least 50 million customers or subscribers in the United States, would have to build what the bill calls an interoperable interface, so that an outside agent a consumer has chosen can reach the platform. Where the consumer uses the platform’s own agent instead, that agent would owe the consumer a duty of care: protecting user data, keeping real-time records, avoiding actions against the user’s interests, and not transferring authority without permission. Providers would register their agents with the Federal Trade Commission [3].

So the record-keeping duty that would answer Fortune’s question is a clause inside a switching-costs bill, in a committee that handles commerce and transportation, one of thousands introduced in this Congress. Anyone holding off on a retention policy until the rule lands should price that wait in sessions of Congress.

Underneath the argument, the plumbing shipped anyway

Cloudflare’s changelog, 25 August 2026: “MCP server portals support the stateless MCP 2026-07-28 specification for client and upstream server connections” [4]. The portal’s /mcp endpoint accepts stateless 2026-07-28 requests and earlier 2025 Streamable HTTP clients. Connecting outwards, it checks whether the upstream server speaks 2026-07-28 and falls back to the 2025 handshake when it does not. SSE connections stay on the legacy protocol [4].

Then: “Client and upstream protocol selection are independent, so clients and servers can upgrade separately without portal configuration changes” [4]. Anyone who has run a protocol migration across two sets of software owned by two sets of people knows what that removes. It is a coordination problem turned into two independent decisions, which is most of what a portal is for.

One other line from the same day, and it is a cost line rather than a payments one. Vercel put Speed Insights on a free tier: 10,000 events per team every 30 days, on every plan, across unlimited projects. Before this the free offering was “limited to a single project on Hobby, and upgrading to Pro meant losing it unless you paid for the add-on” [5]. Existing paid customers keep the same pricing and capabilities under the name Speed Insights Plus, which retains slow-route diagnostics, history, Drains and CLI access [5]. If you dropped real-user monitoring the day you upgraded to Pro, it is back.

What I would do this week

Take each agent you run and answer one question in writing. If it buys something nobody asked for, which log proves what it was told to do, who holds that log, and how long does it live? Most shops can answer the first part from an application log and stall on the third. The retention answer is usually a default nobody chose.

Then separate the two scopes. Whatever credential your agent holds should be narrower than the set of things it might one day be asked to do, and a purchase should be a distinct grant rather than a side effect of a session that was opened to read a catalogue. That is work you can start on a Tuesday. It does not need a standard, a working group, or a bill in committee.

NIST’s first pass at agent identity covers agents operating inside organisations and, per Fortune, leaves out agents arriving from untrusted outside sources at this phase [1]. The agent that spends your money on a website you do not run is, from where the standard currently stands, outside.