AI agents get access to company money: Stripe, Visa and Mastercard set the approval rules

Global reference

• Vendors: Stripe; Visa, with BILL and Billtrust; Mastercard; Anthropic (Claude Duet)
• Topic: AI agents that can view balances and start or complete payments
• Key dates: Mastercard 20 October 2026; Stripe, Visa and Anthropic 21 October 2026
• Status: Stripe agent tools in public preview; Visa pilot live; Mastercard early access for developers; Claude Duet research preview for United States Pro and Max subscribers

Stripe Treasury for agents

• Agents connect through Stripe’s Model Context Protocol server, with set-up guides for Claude, ChatGPT, Codex and others.
• The business chooses which accounts and data an agent sees, whether it can only read or can act, and when a person must approve.
• Stripe’s documentation says that by default you must review and approve any agent action that moves live money.
• Spending limits for agents are due “in the coming weeks”, and card creation “soon”.

Visa, BILL and Billtrust

• The pilot is live and processing end-to-end transactions between participating BILL customers and Billtrust suppliers.
• Visa’s Trusted Agent Protocol confirms the agent’s identity and authority. Tokenised credentials replace shared supplier-portal logins.
• It links the buyer’s invoice approval with the supplier’s acceptance, so it is clear who acted and what was approved.
• Visa Commercial Payment Controls let businesses limit spend by amount, merchant category, location and timing.

Mastercard and Claude Duet

• Mastercard Agent Pay for Machines: the agent pays with signed vouchers that carry the spending limit. In the pilot, one approved budget covered nine payments to two merchants.
• Claude Duet shows each payment before it is made and waits for approval. Trading securities and moving money between accounts are off-limits even with approval.

What to do now

• Add AI agents to the delegation of authority and the payment approval policy before any pilot.
• Keep human approval on every live payment until spending limits and logs are tested.
• Give each agent its own credentials. Never share a person’s login or API key with an agent.
• Check that agent actions appear in the audit log with the approver’s name.
• Review segregation of duties: an agent that sets up a recipient should not also pay it.

Our take

This is the week AI agents moved from reading the numbers to touching the money. The vendors have built the right defaults: approval first, limits next. Treasury should write its own rules now, before the first agent is connected by someone in a hurry.

Important. This summary is for general information and is not treasury, technology or financial advice. It is based on public Stripe, Visa, Mastercard and Anthropic information and may be incomplete or out of date. The official publications prevail; check the official source before acting.