kbarbel640-del Agent Card Provisioning
Provision virtual payment cards for AI agents with built-in spending controls.
How It Works
- Agent requests card via payment intent
- Policy evaluates the request (amount, merchant, limits)
- Card issued if within policy OR approval required if over threshold
- Agent uses card for the specific purchase
- Transaction tracked and matched to intent
Creating a Card (Intent-Based)
Cards are provisioned through payment intents, not created directly:
proxy.intents.create
├── merchant: "Amazon"
├── amount: 49.99
├── description: "Office supplies"
└── category: "office_supplies" (optional)
If approved (auto or manual), a card is issued:
Response:
├── id: "int_abc123"
├── status: "pending" or "card_issued"
├── cardId: "card_xyz789"
└── message: "Card issued successfully"
Getting Card Details
Masked (for display)
proxy.cards.get { cardId: "card_xyz789" }
→ { last4: "4242", brand: "Visa", status: "active" }
Full Details (for payment)
proxy.cards.get_sensitive { cardId: "card_xyz789" }
→ {
pan: "4532015112830366",
cvv: "847",
expiryMonth: "03",
expiryYear: "2027",
billingAddress: {
line1: "123 Main St",
city: "New York",
state: "NY",
postalCode: "10001",
country: "US"
}
}
Card Controls (via Policy)
Policies define what cards can be used for:
| Control | Description |
|---|---|
| Spending limit | Max per transaction |
| Daily/monthly limits | Cumulative caps |
| Merchant categories | Allowed/blocked MCCs |
| Auto-approve threshold | Below = instant, above = human approval |
| Expiration | Card validity period |
Card Lifecycle
Intent Created
│
▼
┌─────────────┐
│ Policy │
│ Evaluation │
└──────┬──────┘
│
┌────┴────┐
▼ ▼
Auto Needs
Approve Approval
│ │
▼ ▼
Card [Human]
Issued │
│ │
◀─────────┘
│
▼
Card Used
│
▼
Transaction
Matched
│
▼
Card
Expired
Best Practices
- One intent per purchase - Creates audit trail
- Descriptive intent names - Helps reconciliation
- Set reasonable policies - Balance autonomy vs control
- Monitor transactions - Use
proxy.transactions.list_for_card
Security
- Cards are single-purpose (one intent = one card)
- Unused cards auto-expire
- Full PAN only via
get_sensitive(requires auth) - All transactions logged and reconciled