Autonomy Is Not Authority: What Agentic Payments Will Test in Japan

On 2 July 2026, Visa announced in Paris that AI agents were completing purchases with independent merchants on live card rails, with more than thirty European issuers behind them¹. A month earlier, Worldline and ING had run an agentic payment in production on the Mastercard network². DBS had piloted live agent-initiated food orders in Singapore in February⁴, and on 20 May Mastercard reported the first agentic transaction in a production environment in Japan³.

Every one of those transactions shares a condition that is easy to miss. A person approved it. Visa’s release says each payment was “explicitly authorised by the consumer”; Worldline’s says the agent “completes the transaction only after the consumer gives explicit approval”¹². What has gone live, in Europe, Singapore and Japan alike, is an agent that shops and a human who pays.

The consequential step is the next one: a person defines the authority in advance, within limits, and the agent executes without asking each time. No market has scaled that step. So the first question is not whether an agent can pay. It is whether the organisation has decided what it is prepared to delegate.

Why payments make the question concrete

Generative AI has mostly produced things for people to review. Agentic systems act. Singapore’s SAFR white paper, published in July 2026 under the Monetary Authority of Singapore’s BuildFin.ai initiative, says financial institutions are deploying agents “that can initiate actions rather than merely support decisions”, in some cases “without human review of each individual action”, and that some actions are “difficult to reverse”⁷. Payments make that irreversibility concrete. Federal Reserve Governor Christopher Waller put the change in authentication this way at Sibos in September: the question shifts “from proving that a buyer is an authorized payer to proving that an agent has the authority to pay on the buyer’s behalf”, and liability “comes down to a pretty simple question: Who is on the hook if an agent makes the wrong purchase?”⁵

Two models, and where the evidence stops

Waller separates two models. In the agent-assisted model the buyer “remains in control”, decides, and pays. In the agent-delegated model the buyer “grants authority to an AI agent to shop and make payments on their behalf”, within guardrails. Market participants “broadly agree that agentic commerce is in an early phase”, and the delegated model “requires a more extensive buildout of trust mechanisms and guardrails”⁵. Google’s Agent Payments Protocol draws the same line, separating real-time purchases from delegated tasks in which the user signs an intent mandate in advance, specifying price limits, timing and conditions⁶.

Every live transaction above sits in the first model. The second exists in specifications, pilots and policy language. On the first model Japan is neither ahead nor behind: its production transaction came within months of Europe’s, though Europe’s programme is far larger. The difference that matters is not the date of the first transaction. It is what each system has built for the second wave.

Japan has the parts, not yet the architecture

Japan’s institutions are now examining several of the components that delegated machine action would need, at roughly the same time, though not as one system. The Bank of Japan says programmability, the automation of funds through computer programs, “is finally becoming a reality with the emergence of AI agents”¹². Settlement has its own track: three megabanks aim to run live transactions in a jointly issued stablecoin within FY2026¹¹, and an FSA-supported experiment is testing stablecoin settlement of export receivables, triggered by a bank’s approval, with no AI component¹⁰. Supervision and identity are on the FSA’s research list for its on-chain finance initiative, which includes how supervision should change as AI spreads and a verification base for who is acting in a transaction, with an interim summary due in early 2027⁸. And a June 2026 Bank of Japan research-institute paper asks how private law should attribute an AI agent’s acts to a party and allocate the risk of an unexpected act¹⁴.

None of these tracks was designed around agents, and the evidence does not show them being coordinated into one architecture. The Bank of Japan itself rejects a leapfrog approach for an economy with established payment infrastructure¹². Japan has pieces of the governance that delegated action would require. It does not yet have the architecture that connects them.

Caution is raw material, not an advantage

It is tempting to say that a market known for careful delegation is well placed for a technology that delegates. The evidence does not support that as stated. Every live agentic payment anywhere keeps a person approving each transaction; explicit approval is the global state of the art, not a Japanese trait. Caution can also slow an organisation without making it safer.

Singapore has gone furthest in writing down what caution has to become. The SAFR paper, an industry reference model that states it “does not constitute regulatory guidance”, names three gaps in how institutions govern agents. Model-risk checks validate a model before it goes live, “not the decisions it makes in production”. Audits review transactions “hours or days after execution”. And there is no consistent standard for when a human should intervene, so oversight can become “a notification, an email alert, or a dashboard flag” that “gives the appearance of human oversight without the substance of it”⁷.

That is the difference between governance and bureaucracy, stated by practitioners rather than asserted here. A person approving every agent action is a brake that does not scale, and because it is ad hoc, it leaves no reliable record. SAFR’s alternative is a checkpoint “between every agent decision and its execution”, in which an action can auto-execute within thresholds, be escalated to a person, be observed, or be denied⁷. The human sits where the design puts them, not at every step.

Eveil View Caution becomes an advantage only when it is translated into governance rather than bureaucracy. The translation is specific: scope and limits written before execution, identity bound to each action, escalation set by threshold rather than habit, and a record that would let someone explain a wrong release. An organisation that keeps a person approving every agent action has not governed the agent. It has postponed deciding what the agent may do.

Japan’s practice habits are the raw material for that translation. When FSA published the results of an AI-assisted anti-money-laundering experiment in July, it advised that the firm remains responsible for the judgment, must not rely on alerts alone, and must be able to explain its basis¹³. Its practice guidance for customer-facing AI expects a step that confirms understanding before a process proceeds, monitored logs, and a route to a human at any time⁹. Explicit scope, an explainable basis and a named accountable party are the inputs a runtime checkpoint needs. Japan has those habits. What it has not yet produced is the checkpoint. The habits exist. The architecture does not.

The seven questions are a delegation readiness test

The technology question is whether an agent can act. The management question is whether the organisation has decided what authority it is prepared to delegate. An organisation should be able to answer seven questions about any automated process that may cause a payment:

1. What may the system decide?
2. What may it execute?
3. What hard limits sit outside the model?
4. Under whose identity does it act?
5. What evidence of each decision is retained?
6. Who can stop or override it?
7. Who remains accountable when the outcome is wrong?

These are the content of an intent mandate in AP2’s terms and of a controls repository in SAFR’s, which is why they are not a compliance checklist. An organisation that can answer them has a basis for letting an agent act without asking each time. One that cannot has two options, both bad: approve everything by hand, or delegate without having decided what was delegated.

What remains uncertain No market has scaled the delegated model, so no one can yet show that any governance architecture, Singapore’s included, holds at volume. The IMF describes legal and liability questions for agentic payments as unresolved¹⁵, and the Bank of Japan paper on attribution is a research contribution, not a position. Japan’s forum has not reported. Whether Japanese institutions turn their practice habits into runtime design, or into additional approval layers, is open, and the second outcome is at least as likely as the first.

What this changes for management

The decision this affects is not whether to let an agent pay. It is when, and on what terms, to move from the assisted model to the delegated one. The first wave is low-risk because a person still approves; treat it as practice for the second, not as its destination. Japan does not need to be first to give agents autonomy. The more consequential opportunity is to show that greater machine autonomy can coexist with clearly designed human accountability, and to show it before the delegated model scales anywhere. That is an opportunity, not an achievement.

What to validate next Before an automated process is given authority to execute payments, write down the seven answers and test one thing: would a person approving each action add information, or only delay? If it adds information, the mandate is not yet written. If it only delays, the organisation has a mandate and has not trusted it. Either answer is useful. Neither is reached by leaving the approval in place.

If Japan can turn caution into governance without turning governance into another barrier to adoption, the model would matter well beyond Japan. If it turns caution into approval queues instead, it will have been careful and late at the same time.