← Back to Playbooks
Payments

Use the Counterparty’s Agent Path, Not the Customer’s Login

Banks, brokers, card networks and supplier portals now give agents a fenced path; build to it instead of a borrowed password

Operator recipe for agents that act at a bank, broker or supplier on someone’s behalf. In October 2026 the institutions on the other side drew the same line from several directions. OnePay gives a customer’s agent its own sub-account: "Your agent will be able to spend only from its own balance and never from your main account, with per-purchase limits and monthly caps that you set" (19 Oct). Visa, BILL and Billtrust are piloting a registered payment agent that pays a specific invoice with "Tokenized payment credentials rather than shared supplier-portal logins" (20 Oct), and Mastercard opened early access to Agent Pay for Machines, where an agent pays inside an approved budget (20 Oct). The pattern: the agent gets its own identity, a budget, and a credential scoped to one task, never the human’s login. This playbook covers access at the counterparty; for your own spend controls see /playbooks/agent-payments-spend-policy/, and for agent identity see /playbooks/agent-identity-kya/.

Core Workflows (7)

Each workflow represents a critical business function. Click any workflow to see detailed automation architecture.

01

Retire agents that drive a customer’s own login

Led by: Integration Owner

List every place an agent signs in with a person’s username and password or rides a person’s browser session at a financial institution or supplier portal. Expect those paths to be detected and refused. Replace each with the institution’s sanctioned interface, or stop the task.

Sub-Agents
Working Agent
Skills Required
Integration inventory
Human TouchpointA person signs off the list of borrowed-login paths and the date each one is retired
02

Build to the counterparty’s MCP server or agent API

Led by: Working Agent

Where an institution offers an MCP server or agent API, use it and accept its scopes. Treat missing tools, such as money movement, as a policy boundary, not a gap to work around with a browser.

Sub-Agents
Integration Owner
Skills Required
MCP clientsScoped API access
Human TouchpointAnything the sanctioned interface leaves out goes to a person, not to a workaround
03

Start read-only and add actions one at a time

Led by: Integration Owner

OnePay’s connected agent starts with no actions: it "can only see your OnePay accounts. It can’t take any action. You choose what it can do next." Mirror that in your own setup: connect read-only first, then enable each action separately with its own approval.

Sub-Agents
Working Agent
Skills Required
Read-only defaultsPer-action enablement
Human TouchpointThe account holder approves each new action type
04

Fund the agent separately and cap it at the counterparty

Led by: Finance Owner

Prefer counterparties that hold the limit for you: a separate balance for the agent with per-purchase and monthly caps, as OnePay describes, or a budget the payment network enforces, as in Mastercard Agent Pay for Machines. A cap enforced by the bank or network still holds if the agent, or your own spend layer, gets it wrong.

Sub-Agents
Working Agent
Skills Required
Agent sub-accountsNetwork-enforced budgets
Human TouchpointA person sets and reviews the caps; the agent cannot change them
05

Pay with a credential scoped to one transaction or invoice

Led by: Working Agent

Use credentials that are good for one payment: OnePay uses an "agentic single-use payment credential that expires immediately after the transaction", and the Visa, BILL and Billtrust pilot uses "A purpose-built payment path tied to the specific invoice". A leaked or replayed credential then has nothing left to spend.

Sub-Agents
Finance Owner
Skills Required
Tokenized credentialsInvoice-bound payments
Human TouchpointReconcile each payment to its invoice or task weekly
06

Register the agent instead of getting it past bot checks

Led by: Integration Owner

In the Visa pilot the BILL payment agent is "registered using Visa’s Trusted Agent Protocol and Agentic Directory", and Visa says "This agent authentication can satisfy the site protections historically provided by CAPTCHA and other bot blocking mechanisms, without requiring an additional agent login." Where a directory or agent-authentication scheme exists, enroll the agent under its own identity rather than having it pass as a person.

Sub-Agents
Working Agent
Skills Required
Agent registrationAgent identity
Human TouchpointA person approves each directory or network the agent is enrolled in
07

Keep a per-agent revoke switch

Led by: Finance Owner

Make sure you can cut off one agent at the counterparty without touching the others. OnePay says "you can revoke any one agent without affecting the others." Test revocation before go-live and after every integration change.

Sub-Agents
Ops Agent
Skills Required
Per-agent revocation
Human TouchpointA person can revoke any single agent within minutes, and has tested it

Sources (3)