Giving AI agents a wallet, safely: virtual cards explained in pictures

AI agents can find the best cloud server or SaaS plan. Then they get stuck, because they can't pay. Here's the safe way to fix that, mostly in pictures.

1. Don't hand over the company card

An agent card is a virtual card made for one agent and one job.

2. How it works

Ask → check policy → pay → approve → settle. Then the card dies.

3. For developers, it's one tool call

The agent can call this through an API or an MCP tool, like any other tool.

4. Every payment passes five checks

The rules live on the card, not in the prompt. A confused or prompt-injected agent still can't break them.

5. The agent never sees your real card number

It gets a token that only works for that agent, that merchant and that time window.

6. Five layers of safety

7. Two ways to build it

8. Where to start

An agent with no card can only make suggestions. An agent with the company card is a risk. A scoped, short-lived, tokenized card lets agents finish the job while finance stays in control.

Further reading

• Virtual cards for AI agents (Ramp)
• Visa Intelligent Commerce (Visa Developer)
• Mastercard Agent Pay discussion (Checkout.com)

Building agents that need to pay for things? I'd love to hear how you're handling it in the comments.