When an AI agent exceeds its scope, 38% of IT and security professionals say the action requires a person's approval, and 11% say it is blocked automatically. The figures come from a Cloud Security Alliance survey of 418 respondents conducted in January 2026 and commissioned by Token Security. Sixty-five percent of respondents had at least one AI agent incident in the previous 12 months.
Giving an AI agent a company card puts the same choice in front of the finance team. Text in a web page or an email the agent reads can change its instructions, so a spending rule written into its prompt is only a request. Only the controls the card provider enforces hold, both when the agent calls the provider and when the card is authorized at checkout.
Card and banking platforms spent 2026 publishing rules for agents, and the rules differ on three controls.
An agent's reach comes down to who sets and changes its card limit, who can read the full card number, and which actions wait for a person.
Mercury lets only a person create an agent card or change its limit, in the Mercury app, and the agent then retrieves the full card number to check out.
On Slash, an agent connected with a read-only API key can request a card or a payment, and each request waits until a team member approves it.
A Ramp agent can do what the person who connected it can do, and Brex lists its AI assistant card tools as working without card numbers.
The limit belongs on the card, as a cap per transaction and a cap per day, week or month. A merchant lock goes with it, allowing or blocking specific merchants, merchant category codes or countries.
The harder question is whether the agent can change either one. An agent that can create cards adds each new card's limit to its exposure, so a budget over a group of cards matters as much as the limit on each.
An agent completing a browser checkout needs the card number, expiry date and security code. Once those details reach the agent, they are stored wherever the agent runs, which can include the systems of the LLM provider behind it.
Providers release the full number to the agent, encrypt it to a key the business holds, issue a one-time credential per purchase, or return no number at all.
An approval can be held by the card provider until someone accepts it in its dashboard, written into the approval policy on the funds the agent draws from, or left to the AI client, which asks before acting. The provider enforces the first two, and the third depends on how the client is configured.
Approving every charge removes the reason to give an agent a card. A finance team can put the approval on creating cards, changing limits and moving money, and let charges inside the limit run.
Slash runs an MCP server for AI agents at mcp.slash.com, and any MCP client connects to it with a Slash API key. Slash is a financial technology company, not a bank, and its business banking is provided by Column N.A., Member FDIC. Its accounts serve US-registered LLCs, C-Corps and S-Corps, and not sole proprietors.
Limits and locks. Every virtual card created through the API can have a spending limit that resets daily, weekly, monthly or yearly, or a lifetime cap that never resets. A separate per-transaction limit sets the most any single purchase can cost. Cards can also be restricted to specific merchants, merchant categories and countries, or blocked from them. A single-use card closes after its first authorization attempt.
Approvals. An agent with a read-only key can’t create a card or send a payment by itself. Slash holds the request as an Agent Request with an approval link, and nothing goes through until an authorized user approves it. Keys that can create cards or move money carry more risk: Slash’s API key guide warns that an AI client holding one may use those permissions when asked, and recommends giving each AI client its own key.
The card number. When an agent looks up a card through Slash’s MCP server, the response leaves out the full card number and CVV unless the agent specifically requests them. If it does, and the business has added its RSA public key to the connection, Slash’s MCP documentation says the details arrive encrypted with RSA-OAEP. The agent can pass the encrypted details along but can’t read them, since only the business’s private key can decrypt them.
Agent cards arrived in August as part of Mercury Spend. Mercury's help center describes an agent card as a virtual debit or credit card that a person creates in the web or mobile app, with a daily, weekly or monthly limit. Mercury's API and CLI block an agent from creating an agent card, changing its limit or unfreezing it, and the agent reaches only the cards it was handed.
The agent retrieves the full card number, expiry date and CVC through Mercury's Vault API or CLI, so it can check out without a person in the loop. Mercury's changelog says that retrieval is not currently available over MCP, and its help center says that once retrieved, the details "live in your setup".
Through Mercury's MCP server, an AI tool can request a payment or an internal transfer, and Mercury's documentation says the tool cannot approve the request or move money on its own.
Brex's MCP server, in beta, connects AI assistants such as Claude and ChatGPT to a Brex account. Brex's support page lists its card tools under the heading "Cards (without card numbers)".
An account or card admin has to accept Brex's Developer API agreement first, and each user's existing Brex permissions then carry over to the AI assistant. Brex's developer documentation tells customers to configure the assistant to require approval before it executes actions.
Ramp's agent documentation says an agent connected through Ramp MCP, Ramp CLI or the Ramp connector in ChatGPT or Claude acts with the signed-in user's existing Ramp permissions, using the cards and funds already available to that user.
For a browser checkout, the agent requests an Agent Card credential, which Ramp's tool list describes as a one-time payment token for a fund. The purchase follows that fund's spend limit, merchant rules, approval policies and accounting defaults. The same tool list includes a tool that increases the limit on a fund or card, subject to the connected user's permissions. Standalone agent identities with their own role are in limited early access.
Start each agent on the narrowest access the provider offers, and add write access only for actions the business would let run unattended.
Give each agent its own credential and its own card or group of cards, so one can be revoked without affecting the others.
Size the cap to the job. A $50 maximum per transaction and a $500 monthly limit stop a looping agent after 10 full-size charges in a month.
Read the provider's terms on whether a charge the agent makes outside its instructions still counts as authorized by the business.
For a browser checkout, yes. Mercury releases the full details for agent cards, Ramp issues a one-time payment token per purchase, and Slash's MCP server returns the number encrypted when the business adds its own RSA public key, or as plaintext without one.
A limit declines any charge above the cap at authorization, with no person involved. An approval holds an action until a person accepts it. On Slash, a write request from a read-only API key waits as an Agent Request, and on Mercury, a payment requested through its MCP server waits for approval in Mercury.
By cutting the agent's access or freezing the card. Slash's help center says revoking an API key removes that key's access, and its API can pause a card so every transaction declines. Mercury's help center says an agent card can be frozen or canceled from the Cards page, and the agent cannot reverse it.