Stripe engineer Steve Kaliski reveals deterministic guardrails for robot spending

Steve Kaliski, a principal software engineer at Stripe, argues that while the power of LLM lies in their non-deterministic ability to predict and explore, the act of transacting money requires absolute determinism. In the autonomous economy, an agent must operate within rigid constraints to avoid purchasing the wrong item or accidentally depleting a user's bank account. This separation of concerns—allowing discovery to be fluid while forcing checkout to be programmatic—forms the foundation of Stripe's emerging infrastructure for AI agents.

Prerequisites and technical landscape

To implement these patterns, developers should be familiar with REST API, JSON data structures, and the basic mechanics of Stripe integration objects like Payment Intent. You will need a Stripe account to test these implementations and a basic understanding of how agents use tools via HTTP requests.

Shared payment tokens and usage mandates

The primary tool for controlling autonomous spend is the Shared Payment Token. Unlike a raw credit card number, these tokens act as a smart contract between the buyer, the agent, and the seller. They encode specific mandates directly into the credential, enforced by Stripe at the network level.

// Provisioning a shared payment token with a mandate
const sharedToken = await stripe.sharedPaymentTokens.create({
  payment_method: 'pm_visa_card',
  amount_limit: 2500, // Limit to $25.00
  currency: 'usd',
  expires_at: Math.floor(Date.now() / 1000) + (30 * 24 * 60 * 60),
  merchant_restriction: 'acct_seller_123' 
});

This approach ensures that even if an agent is "duped" by a malicious domain or miscalculates a price, the transaction will fail if it exceeds the pre-defined $25 limit or targets an unauthorized merchant.

Implementing the Machine Payments Protocol

For ephemeral tool calls, Steve Kaliski introduced a protocol developed with Tempo that utilizes the 402 Payment Required HTTP status code. When an agent hits a protected endpoint, the server responds with a 402 and an encoded payload detailing the cost.

# Agent attempts to call a paid tool
curl -X POST https://api.toolprovider.com/execute \
     -H "Authorization: Bearer <token>"

# Server responds with 402 and payment metadata
# { "amount": 1, "currency": "usd", "network": "tempo" }

The Agent-to-Commerce Protocol (ACP)

To move beyond simple API calls and into complex e-commerce, the Agent-to-Commerce Protocol (Agent-to-Commerce Protocol)—a collaboration with OpenAI—standardizes how agents interact with checkout pages. Instead of a robot "stumbling" through a human-centric web UI, the seller provides a JSON-based product catalog and a structured back-and-forth for updating quantities, shipping options, and taxes.

Syntax Notes and Tips

• Status 402: Always use the 402 status code to signal that a programmatic payment is required; it is the semantic standard for this interaction.
• Scope to Seller: Always restrict shared tokens to a specific merchant_restriction to minimize the "blast radius" if an agent's credentials are intercepted.
• Auditability: Every shared token remains fully auditable in the Stripe dashboard, allowing humans to review robot spend history without digging through logs.