Give three AI assistants permission to buy things within a ¥50,000 monthly budget. The difficult part is keeping one reliable account of what all three have already committed to spend.
On September 1, EMVCo opened public review of a card-based agentic-payments framework, with comments due September 30. Its proposed Intent Services would let participants register, retrieve, and manage consumer-authorized intent across a transaction’s lifecycle, including recurring purchases and cumulative budgets. This is a draft framework for possible future specifications. EMVCo announcement.
One instruction, several spending decisions
Consider this hypothetical household. One assistant orders groceries, another replaces household supplies, and a third manages subscriptions. After ¥30,000 has been spent, the first two each request a ¥15,000 purchase. Both have seen the same ¥20,000 remaining balance. Each purchase fits individually; approving both produces ¥60,000 of monthly spending.
Neither assistant needs to misread the instruction for this to happen. The problem is the timing of the shared account. A copied balance becomes stale as soon as another participant commits money. A signed permission can establish what the user authorized while still leaving the current amount available to spend unresolved.
A shared record needs an enforcement rule
AgentCollusion’s implementation proposal is to keep the budget check and reservation in a payment control that every spending route must use. Under this example’s policy, settled spending plus active reservations must stay at or below ¥50,000. A successful reservation consumes headroom before another request can use it. This is our design illustration, not an algorithm specified by the EMVCo announcement.
| Event | Settled | Reserved | Available |
|---|---|---|---|
| Before either new order | ¥30,000 | ¥0 | ¥20,000 |
| First ¥15,000 order reserved | ¥30,000 | ¥15,000 | ¥5,000 |
| Second ¥15,000 request declined | ¥30,000 | ¥15,000 | ¥5,000 |
| First order settles | ¥45,000 | ¥0 | ¥5,000 |
The check and reservation must succeed together. Reading the balance, approving an order, and updating the account later would recreate the original race. Likewise, settlement must replace its reservation rather than count the same purchase twice. If separate providers maintain separate records, the implementation must define who can make a binding reservation and how disagreements are resolved.
What does “this month” include?
A monthly ceiling needs a timezone, a boundary date, and an accounting rule. Does an order placed on September 30 count in September if it settles in October? Does a refund restore buying capacity immediately? Does the budget include tax, shipping, and currency conversion? These choices change whether the same purchase is permitted. The user should see the relevant policy before delegating repeated purchases.
Recovery is part of that policy. If an order times out, the assistant should resolve the existing purchase attempt before creating a new one. A timeout gives no assurance that the merchant rejected the order. Releasing a reservation too early can make money appear available while an earlier commitment still exists. Reservation expiry therefore needs a reconciliation process for uncertain transactions.
Withdrawal of permission raises a related question: which pending orders can still be stopped? In our proposed design, revocation blocks new commitments and sends unresolved ones for reconciliation. It does not silently label an already completed purchase as reversed.
Staying within budget leaves another question open
Now change the hypothetical example. All three assistants stay within ¥50,000, but the recommending assistant repeatedly selects a related seller and the reviewing assistant approves every selection without examining alternatives. Correct accounting would not explain whether this relationship serves the user’s purpose.
A useful investigation would connect each purchase to the original instruction, the alternatives considered, any disclosed commercial relationship, and the evidence available to the reviewer. Repeated purchases from one seller can also reflect good service or a stated user preference. That is why a spending pattern is a starting point for investigation, rather than a finding of collusion.
The proposed shared intent layer makes a practical design question visible: can every participant act on the same current authority? Our earlier article on delegated payment authority follows the additional steps needed to connect a valid payment to a legitimate purchase decision.
Sources checked September 7, 2026. The examples and proposed evaluations identified in this article are AgentCollusion’s analysis; they are not additional experimental results.
