American Express is developing an agentic commerce system that permits AI agents to make purchases and process payments on behalf of users, though the initial implementation remains confined to Amex's own payment ecosystem. The company's Agentic Commerce Experiences (ACE) developer kit introduces transaction controls at the payment layer, distinguishing it from other agentic commerce protocols.
ACE employs intent contracts and single-use tokens to govern AI transactions. Intent contracts define the boundaries of what an agent can purchase—setting spending limits, acceptable merchant categories, and transaction types. Single-use tokens ensure each payment authorization applies to one transaction only, preventing token reuse and reducing fraud exposure.
The system also uses what Amex describes as validation logic, though the exact mechanisms remain opaque. This lack of transparency presents a notable limitation. Users cannot easily audit what their AI agents are actually doing, creating a trust gap between the consumer and the autonomous system spending their money.
Amex already participates in broader agentic commerce standards like Google's Agent Pay Protocol (AP2), which emphasizes interoperability across networks and merchants. ACE diverges by prioritizing payment-layer control rather than cross-network compatibility. This positions Amex's approach as more comprehensive for transaction governance but potentially less interoperable.
The distinction matters because most agentic commerce protocols focus on communication between agents and merchants, leaving payment logic loosely defined. ACE attempts to solve that by embedding transaction rules directly into the payment infrastructure. However, the closed-loop validation creates friction with the transparency and auditability users expect from autonomous financial systems.
For now, merchants and agents integrating with ACE operate within Amex's walled garden. Broader adoption depends on whether Amex opens this infrastructure to third-party protocols and whether the company commits to exposing its validation logic for independent verification. The company faces pressure to balance security (which opacity can