If you ask ChatGPT right now, “Find me a flight to Norway for next week,” it will dazzle you. It can scan schedules, compare layovers, and even advise you on which seat has the most legroom.

Overall, it is a brilliant research assistant.

But when you say, “Great, buy that one,” the magic kinda breaks.

The AI will likely apologize and spit out a link: “Please click here to complete your purchase on the airline’s website.”

In that split second, the experience fractures. We hit the “Last Mile” problem of the AI revolution.

We have built an artificial brain that is omniscient but financially impotent. We are standing at the threshold of the “Agent Economy,” but we are stuck because our agents don’t have wallets.

We want our AI agents to be capable, but we are terrified of giving them the keys to our bank accounts.

I understand that. You wouldn’t hand your physical credit card to a new intern and say, “Go buy whatever you think is best,” would you?

But this is about to change.

Recently, tech giants have started quietly releasing the infrastructure that will bridge this gap. While big players like Visa and PayPal are exploring this space, two specific releases caught my eye as an engineer: Google’s Agents to Payments Protocol (AP2) and Stripe’s Agentic Commerce Suite.

They are beginning to rewrite the fundamental rules of how value moves across the internet. As builders in this AI era, let’s look under the hood to understand how we can finally trust a machine to spend our money.

To understand this technology, we need to stop thinking about “payments” and start thinking about “delegation.”

The problem isn’t technical connectivity; we have APIs for that. The problem is authorization. How does a merchant know that this random AI bot is actually acting on my behalf? And how do I know the AI won’t drain my savings?

Google and Stripe have effectively split this problem into two:

Let’s break it down using an analogy we can all understand: The Boss (You) and the Intern (The Agent).

I will try my best to make it fun to read (which the technical documentation certainly wasn’t).

Google’s AP2 is not a consumer app you can download today; it’s a standard protocol designed for developers. It solves the “Diplomacy” problem.

In the old world, if an AI wanted to buy something, it hit a wall because every merchant spoke a different language. AP2 creates a standardized way for an Agent to say, “I am representing Dylan, and I need approval to spend money.”

The core mechanism here is something called a Mandate. Think of a Mandate as a highly specific, digital permission slip.

When your AI finds that flight to Norway, it generates a Cart Mandate. This is a cryptographic package that contains the specifics: Who (Merchant: ABC Airlines), What (Flight SK123), and How Much ($1,200).

Crucially, the Agent doesn’t approve this mandate; you do.

The protocol routes this permission slip to your phone (likely via a wallet app implementing the standard).

You see a notification: “Agent requests to spend $1,200 at ABC Airlines.” You can then authenticate with FaceID or your fingerprint.

This utilizes cryptographic signing. When you scan your face, your device uses its private key to sign the Mandate. This ensures non-repudiation. The merchant receives a cryptographically signed instruction that is mathematically proven to come from you, even though the AI did the legwork.

While Google provides the permission slip, Stripe provides the safe.

Even with a signed permission slip, we still have a security risk: we don’t want to expose our raw credit card number (PAN) to the AI or the Merchant’s API. Data leaks happen.

Stripe’s solution (currently in early preview for developers) relies on a concept called Shared Payment Tokens (SPTs).

Once you have approved the Mandate on your phone, the system doesn’t send your real Visa card number. Instead, Stripe generates a virtual, single-use token, which is a proxy credential.

Think of this like giving your intern a prepaid debit card that self-destructs after one use.

The AI takes this Token and hands it to the airline’s API. The transaction settles. If hackers intercept the token five minutes later? It’s useless. If the AI goes rogue and tries to buy crypto with it? It’s declined.

This is Least Privilege Access applied to finance. We are finally moving away from the dangerous practice of storing “Cards on File” everywhere, toward a model of “Just-in-Time Funding.”

So, how does this change our lives? While this ecosystem is still being built, let’s visualize what the “Happy Path” looks like in the near future—say, late 2026 (in fact, I am going to Norway for vacation in two days!).

I am in Singapore, planning a trip to Tromsø.

I never opened a browser.

I never typed a 16-digit number.

I never dealt with a CAPTCHA.

I moved from being the Operator of the transaction to the Approver of the budget.

I hope someone builds it. Or maybe I will.

As a developer and content creator, what excites me most isn’t just the convenience, but the market shift.

For the last 20 years, businesses have optimized for SEO (Search Engine Optimization). They built beautiful websites, wrote catchy headlines, and optimized images to capture human attention.

But in an Agent Economy, we are moving toward AEO (Agent Engine Optimization).

Your AI agent doesn’t care if a website has a beautiful hero image or emotional copywriting. It cares about things like:

If a business is not “Agent-Ready,” it effectively becomes invisible. The AI won’t recommend it because it cannot transact with it. We are entering an era in which the most valuable customers on the internet won’t be humans, but software agents acting on their behalf.

We often talk about “All in AI” in terms of generating code or writing text. But the real revolution happens when AI can impact the physical world.

Giving an Agent a wallet (safely) is the crossing of the Rubicon. It transforms AI from a passive observer into an active economic participant.

For us, the users, it promises a future where we reclaim our time. We stop being the glue that holds disparate apps together. We stop copying and pasting data from a travel blog to a booking site. We define the outcome, authorize the cost, and let the machine handle the friction.

Now, it’s just a matter of time before our wallets get a lot smarter. I am really excited to see how things will move in the near future.

(Oh, and we haven’t talked about stablecoin payments! I will leave that till next time.)

The newsletter for the builder who thinks.

Join now for free to receive weekly visual mental models and decision frameworks.

Cheers.