Agent Payments & Spend-Policy Control Plane

Human enrolls a credit or debit card once. The PAN is tokenized in a PCI-compliant vault (Nevermined documents Stripe, Braintree, or Visa Intelligent Commerce). The operator never hands the raw card number to the agent.

Set the policy before any buy: total budget, time window that auto-stops, optional per-purchase cap, optional transaction count, optional merchant/API-key restriction. Enforcement is server-side before settlement. A raw unbounded payment method makes the spend answer “everything”; a delegation makes it a cap, a clock, and an off switch.

The agent receives a scoped credential — a payment capability / virtual-card credential encoding identity, limits, and restrictions — not the enrolled PAN. One capability can be reused across sessions, tools, and frameworks until the mandate expires or is revoked.

When the agent hits a paid API or tool, it presents the payment token (x402 / payment header) and settles inside the mandate. LangChain’s Nevermined cookbook shows mid-task purchase and top-up of search credits without a human in the loop for each in-mandate buy; out-of-policy amounts pause. This is the same pattern Stripe Link uses for a one-time card or shared payment token after a spend request — different vendor, same “capability not PAN” rule.

KYA: Ant International, Mastercard, and Visa announced collaboration on a Know-Your-Agent interoperability framework (2026-09-10) so networks can recognize agents across ecosystems while keeping their own verification. Treat that as interop in progress, not a live shared cert. Connections: LangChain Managed Deep Agents stores named credentials as agent-owned (shared by every caller) or caller/user-owned (resolved per person at runtime). Decide ownership when creating the connection; it does not change later. Pair the spend mandate with the matching identity and credential owner.

Revoke or let the clock expire. After revoke, the agent still exists but the payment capability stops. Rotate or revoke Connections in the workspace without shipping a new PAN to the agent.

A spend rail can sit inside login. OpenAI DevDay (29 Sep 2026) added plan usage for third-party apps via the OAuth scope `chatgpt.tokens.use.direct` (ChatGPT Plus/Pro only), as documented by WorkOS (1 Oct 2026). Consent mixes identity scopes with draw-down on a personal subscription balance; per-app weekly percent caps apply; Plus shares a five-hour window across apps. OpenAI does not notify apps on disconnect — the app learns via a failed refresh or request. HTTP 429 `subscription_sharing_usage_limit_exceeded` does not say which limit was hit. Credits after included usage need a separate user opt-in and a 100% app cap. Docs are aimed at open-source and locally hosted apps; remote paid SaaS is pointed to an interest form. Host ID (`ext_agent_host_id`) identifies a host but does not prove key possession. Model plan-funded inference as a session attribute with health states `granted`, `capped_or_exhausted`, `not_eligible`, and `revoked`. Revoke refresh tokens on logout. Never treat the grant as the sole billing source. Employers cannot see personal-Plus funding of work agents.