Google's Universal Cart can now buy things across Search, Gemini and Gmail. Perplexity's Instant Buy checks out inside a chat. Amazon is wiring the same capability into Rufus and into the AgentCore infrastructure other companies build agents on. OpenAI got there first, launching Instant Checkout in ChatGPT in September 2025 -- then quietly retired it six months later, after fewer than 15 of Shopify's millions of merchants ever went live with it. The lesson isn't that agentic shopping failed. It's that a brand name is not a safeguard -- and the actual safeguard is checkable in about two minutes.
The word to look for is "scoped"
Every serious version of this now runs on the same underlying idea, under different names. OpenAI built the Agentic Commerce Protocol with Stripe: the agent never touches your card number, only a single-use token restricted to one merchant, one maximum amount, and an expiry timestamp. Google's AP2 chains three cryptographically signed "mandates" -- Intent, Cart and Payment -- into a tamper-proof record of exactly what you approved and for how much. Amazon's AgentCore enforces the same idea at the infrastructure layer: a spend limit tied to a time-boxed session, reserved and released atomically so an agent cannot exceed it. None of that protects you if you never check whether it's actually switched on for the specific agent in front of you.
Check an AI shopping agent's safeguard before you approve anything
- Search that agent's own help center or settings for language like "one-time," "scoped," "mandate," or "vault token." That's the vocabulary of the Agentic Commerce Protocol and AP2, the two standards behind most of this.
- Amazon Pay's Smart Wallet already lets users set monthly and per-transaction limits on a specific agent in India; other platforms surface this less plainly, but most have some form of a limit or an approval-required threshold in settings.
- A real mandate or token is only as good as what it actually authorizes. If the on-screen approval just says something like "approve this purchase?" without naming those three things, the safeguard isn't doing its job for you specifically.
- The setting is usually under connected apps, payment methods, or agent permissions -- not always where you'd guess. Confirming it works now saves a panicked search later.
None of these checks take longer than reading a confirmation screen carefully. The order matters, though -- a spending cap set after your first purchase already missed the purchase it existed to catch.
Three ways this check gets skipped
Agentic checkout is still young enough that the safeguards vary more than the branding suggests -- India's Amazon Pay Smart Wallet already lets a user set monthly and per-transaction limits on a specific agent, a control most other markets don't yet surface as plainly. Check for the leash. Don't take the brand's word that one exists.
- Google, Perplexity, and Amazon are all wiring AI agents to buy things on your behalf.
- OpenAI's own Instant Checkout launched in 2025 and was quietly retired six months later.
- The real safeguard is a scoped, single-use payment token bound to merchant, amount, and expiry.
- Check for a spending cap and read every confirmation screen before you approve anything.
- Caveat: safeguards vary by platform today -- some markets already offer stricter limits than others.