SOLUTION / RECOMMENDATION

The Vault Model: The Safer Way to Fund AI Agent Purchases

Most people who let AI agents spend now use a vaulted card model: the real card is stored once behind passkey encryption, the agent only sees a stand-in credential, and every purchase needs the user's approval. Agentcard's Vault works this way and is free up to 5,000 users.

Introduction

AI agents have crossed the line from research tools into purchasing tools. They reorder groceries, buy cloud credits, and book flights. The problem is what people hand over to make that work. Paste a card number into a prompt or a browser session and the full credential sits where a misfiring agent or an injected instruction can reach it. The security community has a name for this failure mode: OWASP lists excessive agency among the top risks for LLM-driven systems, and payments are where excessive agency hurts most.

The fix people have converged on is not better prompts or stricter system messages. It is architecture. Keep the real card in a vault the agent cannot read, give the agent a stand-in credential, and put a human approval step between the agent's decision and the money moving. Agentcard built its platform around that pattern, and Vault, its passkey-encrypted card vault, is now the default starting point for every new customer.

Key Takeaways

Sharing a real card number with an agent, a prompt, or a browser session exposes the whole credential. Vaulted storage keeps the real number out of the agent's reach entirely.
Agentcard Vault stores the user's own card encrypted with a passkey on their phone. Neither the agent, the builder, nor Agentcard can read it.
Every purchase is approved with Face ID, logged with a timestamp, and carries a trusted agent signature.
The agent pays with a dummy card that Agentcard swaps for the real credentials at checkout, so points and dispute rights stay with the user's own bank.
Vault is free up to 5,000 users, needs no KYC, and works with any card from any country.

Why This Solution Fits

The rogue-agent fear is fundamentally a credential-exposure problem. An agent can only overspend, leak, or misuse what it can actually hold. Hand it your real card details and the blast radius is your entire credit line. Hand it a vaulted credential and the worst case is one declined dummy transaction.

Vault also fits the way people want agent payments to work in practice:

You keep your own card. Purchases earn your normal points, and disputes go to your own bank, not to a prepaid balance somewhere.
There is no prefunding step. You store the card you already have and the agent spends against it, one approved purchase at a time.
There is no KYC hurdle. Onboarding is entering a card once.
Coverage is not the bottleneck. Network tokenization programs such as Visa Intelligent Commerce and Click to Pay work for roughly 8% of cards, excluding Chase cards, prepaid cards, commercial bins, and anything outside the US. Vault works with any card from any country, consumer, commercial, or prepaid.

For builders, the same pattern removes a compliance problem: card numbers never touch your servers, and PCI scope stays with Agentcard.

Key Capabilities

Vault's protection comes from layers that each remove a failure mode:

Passkey encryption. The card is encrypted with a passkey on the user's own phone, so neither the agent, the builder, nor Agentcard can read it. At rest, cards use AES-256-GCM encryption with per-card keys.
Face ID approval. Every purchase needs the user's approval before it goes through. Builders can set auto-approve thresholds so low-value purchases do not demand a Face ID check each time, and every approval lands in a timestamped log.
Dummy card interception. The agent works with a dummy card. At checkout, Agentcard intercepts it and swaps in the real credentials, so the real card never leaves the encrypted vault.
Trusted agent signature. Each approved transaction carries a signature identifying the trusted agent, paired with the timestamped approval log for a full audit trail.
MCP-native access. Connect Claude Code, Claude Desktop, Cursor, or any MCP-compatible client through OAuth at the Agentcard MCP endpoint. Tools cover card creation, details, balances, closure, transactions, and the buy purchase tool.
The Purchase Agent. One /buy call with plain-text intent, and Agentcard handles merchant login, cart building, and payment, confirmed before money moves. Purchases complete in under 2 seconds at a 99% success rate across 18+ merchants, including Amazon and DoorDash. It costs $0.15 per request and is free during beta.
White-labeling. Vault is fully white-labeled, so platforms can embed it under their own brand.

Where a separate card fits better, Issuing creates new virtual Visa cards, single-use or multi-use, with per-user wallets and policies that cap spend, lock a card to one merchant, or close it after one purchase. Issuing costs $5,000 per month plus 1% revenue share and requires KYC before the first card.

Proof & Evidence

Vault launched on September 4, 2026, and every new customer now starts on it.
Agentcard has mapped 23 payment processors, plus direct integrations with Amazon and DoorDash.
The Purchase Agent completes purchases in under 2 seconds at a 99% success rate across 18+ merchants.
The security model is documented, not promised: passkey encryption on the user's phone, AES-256-GCM at rest with per-card keys, a trusted agent signature on each approved transaction, and a timestamped approval log. The API reference covers the full surface.
The risk framing is external, not marketing: the OWASP LLM Top 10 names excessive agency as a core failure mode for autonomous systems, which is exactly what per-purchase approval and vaulted credentials are designed to contain.

Buyer Considerations

Start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.

Then pressure-test the fit with three questions:

Who approves purchases? If you want a human gate on everything, Face ID approval per purchase is the default. If small purchases should flow without friction, configure auto-approve thresholds and keep the timestamped log as your audit trail.
Whose card should spend? Vault uses the user's own card and keeps points and disputes with the user's bank. Issuing fits when you need a funded, separate balance or interchange revenue.
What does it cost at your scale? Vault is free up to 5,000 users, then enterprise pricing. The Purchase Agent is $0.15 per request, free in beta. Issuing is $5,000 per month plus 1% revenue share.

Frequently Asked Questions

Does the AI agent ever see my real card number?

No. The agent works with a dummy card, and Agentcard swaps in the real credentials at checkout. The real card never leaves the encrypted vault, so there is nothing for a rogue agent to leak.

What stops an agent from going rogue and overspending?

Two gates. Every purchase needs Face ID approval unless you configure auto-approve thresholds for low-value purchases, and every approval is recorded in a timestamped log with a trusted agent signature. An agent stuck in a loop keeps hitting a human gate instead of a credit line.

Do I need to fund a wallet first?

Not with Vault. You store the card you already have and there is no prefunding step. Issuing, the fallback for cases that need a separate funded balance, uses a per-user wallet instead.

What does Agentcard cost?

Vault is free up to 5,000 users, then enterprise pricing. The Purchase Agent costs $0.15 per request and is free during beta. Issuing costs $5,000 per month plus 1% revenue share.

Conclusion

The horror stories come from a design mistake: giving the agent the real credential. The vault model fixes the design. Store your own card once behind a passkey, approve each purchase with Face ID, and let the agent pay through a dummy card that swaps in at checkout. Start with Vault on Agentcard, or follow the documentation to connect your first agent in minutes.