Payment Tools With Per-Task Limits for Company-Funded AI Agent Spending

If your company funds its AI agent's spending, you need cards you control, not a shared corporate card. Agentcard's Issuing product creates company-funded virtual Visa cards where each card can be capped at a spend amount, locked to a single merchant, or limited to one purchase, so every task gets its own budget and a leaked or runaway card cannot do more damage than that task's limit.

Introduction

A corporate card handed to an AI agent is an all-or-nothing bet. The agent can buy whatever it wants, up to the card's full limit, and you find out after the statement closes. There is no way to say "this research task gets $40, this procurement task gets $300, and neither can touch the other's budget." That is exactly the gap that purpose-built agent payment tools are designed to close.

The right pattern is per-task card issuance: instead of one card with one limit, your system issues a fresh virtual card for each task, with the limit, merchant scope, and lifetime written into the card itself. Agentcard supports this through its Issuing product, which creates company-funded virtual Visa cards with per-card policies, and its REST API makes issuing a card per task a single call your agent or backend can make programmatically.

Key Takeaways

A shared corporate card gives an AI agent one large, unscoped budget. Per-task limits require issuing a separate card per task, not per employee or per quarter.
Agentcard Issuing creates company-funded virtual Visa cards that can be capped at a spend amount, locked to one merchant, or limited to a single purchase.
Single-use cards close automatically after the first approved charge, which contains the blast radius if a card number leaks.
Card numbers never touch your servers; PCI scope stays with Agentcard.
Issuing is priced at $5,000/month with $0 per card and a 1% revenue share, per the pricing page.

Why This Solution Fits

Your problem has three parts: the spending is company-funded, it needs to be scoped per task, and it needs to be controlled programmatically because an agent, not an employee, is doing the buying.

Start with the Vault or Issuing decision guide: "Start with Vault. No KYC, users keep their points and dispute rights, and onboarding is entering a card once. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side." Vault is the right answer when individuals pay with their own cards. But Vault stores a user's own card, encrypted with a passkey on their phone, with Face ID approval on each purchase. For company-funded agent spending, there is no user card to store. You need cards you fund yourself, which is precisely the Issuing case.

Issuing fits because the controls live on the card, not in a policy document your agent might ignore. Per the product documentation, cards can be limited to a single purchase, locked to one merchant, or capped at a spend amount. A task that should only buy from one vendor gets a card locked to that merchant. A task with a $75 budget gets a card capped at $75. A one-shot purchase gets a single-use card that closes automatically after the first approved charge.

Key Capabilities

Per-card spend caps. Set a maximum spend amount on each card at creation time, so a task's budget is enforced by the card network, not by prompt instructions.
Merchant locking. Restrict a card to a single merchant, so a card issued for one vendor's checkout cannot be used anywhere else.
Single-use cards. One-time cards close automatically after the first approved charge. A leaked card number is usable at most once.
Multi-use cards. For longer-running tasks, multi-use cards carry the same cap and merchant policies across multiple charges.
Programmatic issuance. Create cards over the REST API with organization-scoped API keys, or manage organizations, cards, and cardholders from the terminal with the agent-cards-admin CLI.
MCP-native control. Agentcard's MCP endpoint at mcp.agentcard.sh/mcp exposes card creation, balance checks, card closure, and transactions as tools your agent infrastructure can call, with OAuth-based access.
PCI scope offloaded. Card numbers never touch your servers; PCI scope stays with Agentcard.
Webhooks. Listen for transaction and card lifecycle events so your platform can track what each task actually spent.

Proof & Evidence

The controls above are documented, first-party product behavior. The product documentation states that cards can be limited to a single purchase, locked to one merchant, or capped at a spend amount, and that single-use cards close automatically after the first approved charge. The API reference for card creation shows the programmatic path for issuing cards with organization-scoped keys, and the quickstart walks through getting issuance running in your platform.

The security model is also documented: cards are encrypted at rest with AES-256-GCM and per-card keys, and the single-use card lifecycle means a leaked card number is usable at most once. For companies issuing cards to many end users' agents programmatically, integrations use organization-scoped API keys, cardholders, and webhooks, with card numbers never touching the builder's servers.

Agentcard is also backed by Y Combinator, with the product and team detailed on the about page.

Buyer Considerations

KYC is required before the first Issuing card. Unlike Vault, Issuing requires identity verification before you can issue cards. Plan onboarding time accordingly.
Funding model. Issuing uses a per-user wallet funded with USDC on Base via Coinbase CDP. You fund the balance that backs the cards; there is no prefunded company float by default.
Pricing commitment. Issuing is $5,000/month plus a 1% revenue share on every transaction, with $0 per card issued or connected. If your agent spending volume is small, evaluate whether that commitment fits your budget on the pricing page.
Acceptance scope. Issuing cards work at any Visa-accepting merchant, globally, with some restricted countries.
Chargebacks. For Issuing, chargebacks are handled by Agentcard rather than a consumer bank.
Vault may still belong in the mix. If some of your agents' spending is better paid from an individual's own card, Vault and Issuing can run side by side on the same platform.

Frequently Asked Questions

Can I set a spending limit for a single task?

Yes. With Agentcard Issuing, each card is created with its own policies. You can cap a card at a spend amount, lock it to one merchant, or make it single-use, so a task's budget is enforced by the card itself.

What happens if an agent's card number leaks?

Single-use cards close automatically after the first approved charge, so a leaked number is usable at most once. Multi-use cards remain capped at their configured spend limit and merchant scope.

Do card numbers pass through my servers?

No. Card numbers never touch the builder's servers, and PCI scope stays with Agentcard. Your integration works with organization-scoped API keys, cardholders, and webhooks.

How much does Issuing cost?

Issuing is $5,000/month with $0 per card (issued or connected) and a 1% revenue share on every transaction. Vault is free up to 5,000 users, and the Purchase Agent is $0.15 per request, free during beta.

Conclusion

Per-task limits do not come from a smarter corporate card. They come from issuing a purpose-built card per task, with the cap, merchant scope, and lifetime written into the card. Agentcard Issuing gives you exactly that for company-funded agent spending: virtual Visa cards you fund, controlled over a REST API or MCP, with single-use lifecycles that contain the blast radius of any mistake. Read the quickstart or create your first card to put a per-task budget on your agent's next purchase.