Thredd CEO says agentic enterprise payments need governance first

Thredd Chief Executive Jim McCarthy said agentic enterprise payments will be shaped by governance, proof of authority and liability controls rather than by how much discretion companies give artificial intelligence systems. In a PYMNTS eBook, Building the Agent-Ready Payments Enterprise, he argued that issuers, program managers and payments firms face a practical test: whether automated agents can act within limits that can be verified in the brief window of a payment authorization.

McCarthy said AI agents are already being applied at Thredd across areas including fraud, credit, sales, billing automation and client service. The more consequential opportunity, he wrote, is in payments, where an agent moves from recommending a purchase to initiating and completing a transaction on behalf of a customer.

That shift turns a technology question into a control question. According to McCarthy, enterprises need to know who gave the agent authority, what limits apply, how those permissions are monitored and how they can be withdrawn if the agent’s behavior changes.

What are agentic enterprise payments?

Agentic enterprise payments refer to transactions or money movement initiated by AI agents under rules set by a customer or business. The system must be able to prove that the agent acted within an authorized mandate, rather than treating the transaction as if a human directly initiated it at the moment of purchase.

McCarthy said the payments industry already has some of the infrastructure needed for that model. He pointed to tokenization, card network rules, dispute processes, chargeback rights and issuers’ role in underwriting risk as existing controls that could be adapted to agent-led commerce.

A network token can already carry restrictions tied to a merchant or transaction category and can be revoked, McCarthy wrote. He said the remaining work is to connect that credential to a verifiable mandate, which would show what a consumer allowed an agent to do, and to send a signal during authorization that the transaction came from an agent rather than directly from a person.

Visa and Mastercard are standardizing approaches through Intelligent Commerce and Agent Pay, respectively, McCarthy said. He added that Thredd monitors and, in some cases, builds around those frameworks while staying neutral on merchant-side protocols that remain unsettled.

McCarthy distinguished those payment controls from connection standards such as MCP, which he said can help agents connect to systems but do not settle authorization, intent, abnormal behavior or liability. Those questions, in his view, sit closer to the issuer layer because they determine whether a transaction should be approved and who carries risk if it is later challenged.

Liability remains unresolved, McCarthy said. Fraud systems are being adjusted for automated behavior, but he argued that the harder case is a transaction where the agent follows its instructions and the cardholder still disputes the charge. Existing chargeback rules, he wrote, were not designed for a third party acting under standing instructions.

McCarthy also said agentic systems could affect back-office card issuing work, including settlement reconciliation, customer onboarding, dispute evidence, cardholder servicing and regulatory reporting. In those settings, agents could handle repetitive tasks and escalate exceptions, provided companies impose audit trails, review thresholds and revocation rights.

His central argument is that payments governance will determine how far agentic commerce can scale. Companies that can prove intent at authorization and apply the same permission structure across operations will be better placed to use agents without replacing labor costs with unmanaged risk, according to McCarthy.

This story draws on original reporting from PYMNTS.