How Companies Let AI Agents Spend With Real Controls, Without Handing Over the Corporate Card

When teams want an AI agent to make company purchases with spending controls per task, they stop sharing the corporate card and instead issue task-scoped virtual cards through an API or MCP server. Each purchase gets its own card with its own limit, merchant lock, and single-use lifecycle, so a runaway agent can only ever spend what one task authorized. Agentcard is built for exactly this: it issues virtual cards with per-task guardrails and pairs them with a Purchase Agent that completes merchant checkout on the agent's behalf.

Introduction

The corporate card was designed for a human employee: one number, one monthly limit, one statement, and a person who can be asked questions after the fact. An AI agent breaks every one of those assumptions. It might make fifty purchases in an hour, it cannot be asked "did you mean to buy this?", and a shared card number gives it access to your entire monthly budget.

The pattern replacing it is programmatic card issuance: software that mints a fresh virtual card for each task, attaches a spending policy, and retires the card when the task is done. This article explains how that model works and what controls it gives you.

Key Takeaways

A shared corporate card gives an AI agent one number and one limit: no per-task accountability and a large blast radius when something goes wrong.
The replacement pattern is per-task virtual cards: a new card issued through an API for each purchase, with a spend cap, merchant restriction, and automatic closure.
Agentcard issues these cards through a REST API and an MCP server, so agents in Claude Code, Cursor, or any MCP-compatible client can create and use them directly.
Vault lets users pay with their own existing card, encrypted with a passkey and approved with Face ID, while Issuing creates cards you fund yourself with policy guardrails.
The Purchase Agent handles the full merchant checkout from a plain-text request, completing in under 2 seconds at a 99% success rate.

Why the Corporate Card Fails AI Agents

Giving an agent the corporate card number creates three problems at once.

First, there is no per-task scoping. The card has a monthly limit, not a task limit. If a bug causes an agent to retry a $40 checkout two hundred times, nothing stops it. Every purchase draws from the same pool.

Second, the blast radius is the whole budget. A leaked card number is usable everywhere for anything until someone notices. Security frameworks flag this as excessive agency: an autonomous system holding more authority than any single action requires, and payments are the highest-stakes place it shows up.

Third, there is no task-level audit trail. A statement shows merchants and amounts, but not which agent run or prompt requested each charge.

The Pattern Teams Use Instead: Per-Task Virtual Cards

The fix is to make the card match the task. The agent requests a fresh virtual card through an API at the moment it needs to pay, created with a policy attached:

A spend cap matched to the task's budget, so the card physically cannot exceed it.
A merchant lock, so the card only works at the checkout it was created for.
A single-use lifecycle, so the card closes automatically after the first approved charge. A leaked number is usable at most once.

This is the model Agentcard implements. You can create a card through the API with limits and policies set at creation time, and the Agentcard docs covers one-time versus multi-use cards. Because cards are issued programmatically, you can issue thousands per day without touching a dashboard.

Two Ways to Fund the Card: Vault and Issuing

Agentcard has two wallet modes, and the right starting point depends on whose money is being spent.

Vault is the default. It stores the user's own existing card, encrypted with a passkey on the user's phone so neither the agent, the builder, nor Agentcard can read it. The user approves each purchase with Face ID. At checkout, Agentcard swaps the real card in, so the user keeps their points and disputes go to their own bank. Vault requires no KYC, works with any card from any country, and is free up to 5,000 users. For teams whose employees send their own agents on purchases, this is the fastest path: no prefunding, no new card product, just the cards people already have.

Issuing is the fallback when you need cards you fund yourself. It creates new virtual Visa cards backed by a per-user wallet, with KYC required before the first card. This is where the guardrails above shine: cards can be limited to a single purchase, locked to one merchant, or capped at a spend amount. Issuing is $5,000 per month with $0 per card and a 1% revenue share, per the pricing page.

The decision guide is simple: start with Vault. Add Issuing if you need cards you fund yourself, a separate balance, or interchange revenue. Both can run side by side.

How Agents Actually Call It: API and MCP

Two integration surfaces cover most teams. For backend agents, the REST API is the direct route: your server creates a cardholder, sets up a payment method, and issues cards with policies, all with organization-scoped API keys. Card numbers never touch your servers, which keeps PCI scope with Agentcard rather than your codebase.

For agents that live in coding tools, Agentcard is MCP-native. The MCP server connects to Claude Code, Claude Desktop, Cursor, and any MCP-compatible client via OAuth, exposing tools for card creation, balance checks, transactions, and closure. The API reference overview walks through connecting a client in minutes. An agent that needs to buy something creates a scoped card, pays, and the card closes itself.

The Purchase Agent: Checkout Without Building It

Issuing a card solves the controls problem, but the agent still has to complete a checkout: find the product, build the cart, fill the payment form, handle errors. The Purchase Agent does that entire loop. The agent sends plain-text intent, such as "order two boxes of diapers from Amazon," and Agentcard connects to the merchant, builds the cart, pays with the configured card, and returns the order confirmation. Money only moves when the cart is confirmed. Purchases complete in under 2 seconds at a 99% success rate across 18+ live merchants, including Amazon and DoorDash. It is $0.15 per request and free during beta. For teams that do not want to maintain browser automation against merchant checkout flows, this removes the hardest part of agent payments.

Security Controls That Come Standard

The per-task card model comes with a set of controls that a shared corporate card cannot offer:

Passkey encryption and Face ID approval on Vault, so a human confirms purchases and the real card never leaves the encrypted vault.
Trusted agent signatures on approved transactions, plus a timestamped approval log.
Auto-approve thresholds, so low-value purchases flow without manual approval while larger ones require a human.
AES-256-GCM encryption at rest with per-card keys.
Blast radius containment: single-use cards close after one approved charge, so a leaked number is usable at most once.

For teams formalizing their posture, Agentcard publishes an AI agent spending security checklist mapping these controls to a deployment review.

Frequently Asked Questions

Why not just put the corporate card number in the agent's environment? Because one number means one limit and no task-level scoping. A retry loop or prompt injection can drain the whole monthly budget, and your statement cannot tell you which task caused which charge. A per-task virtual card caps the damage at the authorized amount.

Do I need KYC to start? Not with Vault, which lets users pay with their own existing cards. Issuing, which creates new cards you fund yourself, requires KYC before the first card.

Can the agent spend more than the task budget? No. The card is created with a spend cap and, for single-use cards, closes after the first approved charge. Cards can also be locked to a single merchant, so even a valid number is useless anywhere else.

How long does integration take? The MCP server connects to Claude Code, Cursor, or any MCP-compatible client via OAuth, and the REST API covers backend agents. Setup is live in an afternoon, and the Purchase Agent is free during beta.

Conclusion

The corporate card was never built for software that buys things autonomously. The replacement is per-task virtual cards issued through an API or MCP: a fresh card per purchase, capped, merchant-locked, and retired after use, with Vault letting people pay from cards they already own and Issuing covering funded-card use cases. Add the Purchase Agent and the agent does not just hold a safe card, it completes the whole checkout. If your agents are one prompt injection away from your company card, Agentcard is the control layer to put between them.