Amex wants a Proof of Intent token before your agent pays. Shopify just opened a billion listings to any agent

Three days after Elon Musk told people to hand Grok Bot a photo of their credit card, American Express published the opposite design. The Intent Intelligence Framework starts with a Create Intent API that records what the customer actually asked for: merchant, maximum budget, product constraints. The customer authenticates and signs off on that captured intent. Amex then mints an Intent ID and a Proof of Intent Token carrying the constraints, and that token is what obtains a digital payment credential for checkout. The agent never sees the card number. The same ID follows the transaction into fraud screening and disputes, so there is a log of what was authorized, by which agent, when. Hannah Bozian, Amex's VP of Agentic Partnerships, gave TechCrunch the example that matters: you ask for white Nikes in a size 9, the agent submits Adidas, and the network blocks it before the charge exists rather than after. Amex says it has seen no increase in disputes from agentic commerce yet and is building this ahead of the curve; the framework slots into the ACE developer toolkit it launched in April.

The same day Shopify removed the partnership requirement on the other side of the transaction. Since September only Meta's Muse could browse and buy from Shopify's catalog on a shopper's behalf. Now a shopper can connect any agent to their Shop account, give it rules like a budget cap or fast shipping only, and check out with Shop Pay inside the conversation. Every purchase still needs the buyer's approval. The catalog is over a billion listings on and off Shopify storefronts. Shopify's holiday post the same morning says 65 percent of shoppers plan to use AI for at least one shopping task this season and that Stanley 1913 is seeing five times the AI-referred US orders of last year.

The agent-authority thread has had its loudest counter-signal and its most concrete answer inside one week. Amex's framework is the first time a card network has defined intent as a first-class object with its own ID, which is the thing every prior scheme, Stripe Link, the Meta-Walmart-Stripe standard, Sierra's Poppy, left to the agent's own context window. Whether merchants and other networks adopt the token is the open question. Shopify opening to any agent makes it more likely: the demand side just became permissionless, so the constraint layer has to live at the rail.

Links: https://techcrunch.com/2026/10/13/amex-introduces-a-framework-to-prevent-ai-agents-from-making-unauthorized-purchases/ , https://www.theverge.com/news/1010365/shopify-opens-its-catalog-up-to-more-ai-agents , https://www.shopify.com/news/agentic-holiday-2026