When an AI Agent Buys the Bag: What It Can Check

An AI agent can now hold a payment credential and complete a checkout. What it cannot do is pick up the bag, smell the leather or weigh the clasp, so before it pays, its job is to run every check a machine can run and to surface clearly the ones it cannot.

The rail widened again this week. On 17 September 2026, Alchemy announced that AgentCard will support Mastercard payment credentials through an integration with Mastercard Agent Pay, giving AI agents one-time-use Mastercard credentials the company says will work anywhere Mastercard is accepted online. AgentCard itself is not new: it launched on 18 June 2026 built on Visa Intelligent Commerce, and the September announcement extends it to Mastercard's rails. Users and issuers can set "purchase limits, merchant categories, and where transactions are allowed," and Mastercard's Agent Pay framework adds what it calls Verifiable Intent: a record of who authorized the agent, what it was told to do and the transaction that followed. Meta launched its Muse personal agent in the United States on 8 September, and says Muse "checks with the person before sensitive actions like sending an email or making a purchase"; on 17 September it added a Mac app that works across files, messages, calendar and notes, reported by The Verge. The direction is clear enough that the question is no longer whether agents will buy things, but what they can check before they do.

What a paying agent can actually verify

An agent buying a pre-owned Hermès Kelly cannot inspect it. Its universe is documents, and documents are only useful if they are machine-verifiable rather than machine-readable. A PDF scan of a receipt is machine-readable: any agent can parse it, and any forger can produce one. A signed verifiable credential is different: it can be checked without trusting the party presenting it.

For a credential built on the W3C Verifiable Credentials model, the checks a buyer's agent can run are mechanical:

Each of these steps exists today in credential-based systems. Resolving the issuer's identifier returns the keys that should have signed the credential; verifying the signature confirms the claims were issued by that party and not altered since; the status list answers whether the issuer has since revoked or suspended the attestation; schema validation answers whether the credential carries the claims this kind of object requires. The W3C credential model itself does not mandate DIDs: resolving the issuer DID is how Galileo's documentation anchors the issuer's keys, in the published verification sequence parse, resolve the issuer DID, verify the signature, check the credential status, validate against the schema. None of it requires a human in the loop, and none of it trusts the seller's word.

There is a second, quieter check agents are well suited to: consistency across the custody trail. Invoices, auction lots, service records and prior transfers each carry dates and parties. An agent can flag that the "original 2019 invoice" references a model discontinued in 2017, or that two documents name different sellers for the same period. That is not proof of anything; it is a list of questions priced into the offer.

What the signature cannot settle

Here is the part the payment announcements do not cover. A valid credential proves that an identified issuer signed a set of claims and has not revoked them. It says nothing about whether those claims were true when made, and nothing about whether the object that arrives is the object described. The three gaps worth naming:

Issuance truth. A credential attests what the issuer recorded at a point in time. If the authentication behind it was sloppy, rushed or wrong, the signature is still valid. Cryptography certifies the claim's origin, not its accuracy; that is why who issued the credential, and under what process, remains a judgment.

Physical-digital binding. A credential describes an item: serial, model, materials, condition. Whether the physical bag carries that identity, rather than a borrowed or transplanted one, is a physical question. Our piece on supplier binding trials covered how fragile that link is even when the binding is engineered; a document check alone never re-establishes it.

Status versus condition. A credential that has not been revoked says nothing about the bag today: wear, replaced parts, undocumented repairs. Revocation registries answer "is this attestation still standing," not "is this bag still as described." The revocation guide goes deeper on what a live status does and does not mean.

A fictional example: the approved ceiling

A fictional collector, "Nadia", configures her agent with a simple rule: spend up to $8,000 on a pre-owned Kelly, only from sellers whose items carry an issuer-signed product credential. The agent finds a listing, resolves the credential, verifies the signature, confirms the status list shows no revocation, and checks that the schema includes the fields a handbag passport should carry. All five checks pass in seconds. Then the agent does the part that is not a signature check: it notes that the credential was issued by a reseller rather than the maison, that the custody trail has a four-year gap, and that the seller's condition claim is asserted but not attested. It reports the item as verifiable-in-records and unresolved-in-object, and holds the payment pending her answer.

What this cannot tell you

Two honest limits. First, this particular rail is days old: the Alchemy announcement is an announced integration, not observed buyer behaviour at scale, and "anywhere Mastercard is accepted online" describes reach, not adoption. Second, credential coverage in luxury remains partial. An agent told to require verifiable credentials will simply find fewer items to bid on; a missing credential is a filter, not a verdict, and plenty of genuine objects carry no digital record at all.

Galileo's take: agents are the reader credentials were written for

The interesting shift in the AgentCard news is not that software can pay; it is that the buyer's side of the transaction now runs on machine-readable evidence. Issuer-signed, status-listed credentials were designed for exactly this reader: a party that cannot touch the object and must decide from proof alone. That is the layer Galileo's specifications standardize, and the part that will still be human is the part that was always human: deciding how much uncertainty a purchase is worth.

Frequently asked questions

Can an AI agent already pay for a luxury purchase?

The payment rails are being built. On 17 September 2026, Alchemy announced that AgentCard will support Mastercard payment credentials through an integration with Mastercard Agent Pay, with user authorization and issuer controls such as purchase limits, merchant categories and where transactions are allowed. Whether an agent should pay is a separate question from whether it can.

What can an agent verify about a product before paying?

The checks that are machine-verifiable, not merely machine-readable: the issuer's signature on a verifiable credential, the credential's status (revoked or still valid), its conformance to the expected schema, and the consistency of a documented custody trail. What it cannot run is the comparison between the credential and the physical object in the box.

Does a valid credential prove the item is authentic?

No. A valid credential proves that an issuer signed a set of claims and has not revoked them. It does not prove the claims were true when made, nor that the object shipped is the object described. That binding between record and item remains the hardest problem in luxury verification.

What is Verifiable Intent in agent payments?

Mastercard's Agent Pay design includes a record of who authorized an agent, what it was instructed to buy, and the transaction that followed, intended as an audit trail when a purchase is disputed. It documents the buyer's side of the deal, not the object's side.

What should stay a human decision in agentic luxury purchases?

The physical-digital match (does this bag carry the identity its credential describes), the condition judgment (does 'excellent' mean the same thing to this seller), and the dispute risk a buyer is willing to carry. An agent can surface all three as open questions; answering them is not a signature check.

Sources

• Alchemy, AgentCard integrates Mastercard Agent Pay, 17 September 2026: one-time-use Mastercard credentials, spending controls, "anywhere Mastercard is accepted online".
• Alchemy, AgentCard launch on Visa Intelligent Commerce, 18 June 2026: the product's original launch and identity stack.
• Mastercard, Verifiable Intent, 2026: the authorization-record concept behind Agent Pay, vendor-stated.
• Meta, Introducing Muse, 8 September 2026: the personal agent's US launch.
• The Verge, Meta's Muse AI agent now has a Mac app, 17 September 2026: Mac app coverage.
• Galileo documentation, verifiable credentials: the verification sequence described in the article (parse, resolve issuer, verify signature, check status, validate schema).
• W3C, Verifiable Credentials Data Model: the credential model the mechanical checks refer to.

See the Galileo documentation for how issuer-signed credentials are structured, and the authentication coverage piece for why the object itself still resists pure document checks.