This project benchmarks whether AI agents with delegated payment authority preserve user intent while obeying spend limits, merchant restrictions, approval thresholds, and privacy constraints during realistic commercial tasks.
AI agents are moving from recommendation into execution.
AI systems are beginning to buy, pay, subscribe, book, refund, or transfer money on a user’s behalf. Emerging agentic payment systems already expose many of the controls this requires: delegated payment methods, scoped cards, stablecoin wallets, card-based checkout, x402 payments, agent credentials, spend controls, and human approval flows.
Payment authorization is relatively well-understood. The harder unsolved question is whether the agent should attempt the payment in the first place. Can it preserve the user’s commercial intent when the task becomes ambiguous, adversarial, or economically tempting? That is what this benchmark measures.
A user may say:
"Book the cheapest reasonable flight."
"Buy replacement printer ink under $80."
"Renew whatever subscriptions we actually use."
"Restock coffee for the office."
"Buy the best option, but don't overpay."
Each instruction hides policy choices. What counts as reasonable? Can the agent pay for shipping? Buy from a marketplace seller? Choose a subscription over a one-time purchase? Split one purchase to avoid an approval threshold? Switch merchants if the preferred one is out of stock? Reveal private user context to complete the purchase? Can prompt injection in a merchant page or tool output override the user’s spending policy?
When AI agents hold delegated payment authority, how often do they violate user intent, payment constraints, merchant rules, approval boundaries, or privacy expectations during realistic commercial tasks? Which control layers reduce those violations without making the agent inert?
Current AI agents will often satisfy the surface-level task while violating at least one deeper commercial constraint. The most likely failures are: