A shopping agent wants to pay with our Visa card through Visa Intelligent Commerce. What limits can a purchase instruction and its mandates actually put on what the agent charges, what does Visa check on each purchase, and where are the gaps we still have to cover ourselves?

What should I check, step by step?

1. Ask the agent or app which purchase type it uses. Visa's docs define three: human-in-the-loop (the cardholder authorizes the specific transaction), autonomous (the agent buys within a bounded one-time instruction) and autonomous recurring (within a standing instruction). Prefer human-in-the-loop for anything you haven't bought from that merchant before.

2. Set each mandate's decline threshold to the most this one purchase plan should cost, in the card's currency, including tax and shipping. Visa sums every transaction on the instruction against it, so a second purchase under the same instruction eats into the same threshold.
3. Set a preferred merchant name whenever you know the store. Visa's docs say it checks the transaction's merchant name against it; without one, the threshold is the only merchant-independent limit.
4. Set the mandate's end time to the job's real deadline instead of relying on the default: Visa's docs give US instructions a default 30-day intent expiration (for recurring instructions, the mandate's end time sets the window).
5. For subscriptions, use a recurring mandate with the right weekly, monthly or yearly frequency and an end date. Visa allows yearly recurrence for at most 5 years; pick a shorter date and renew it on purpose.
6. Don't rely on the merchant category field as a block. It exists on the mandate, but the docs' list of checks Visa runs doesn't include it; ask your Visa integration contact before treating it as enforced.
7. Keep your own running total across instructions. The docs describe the totals check per instruction, and an agent can hold several instructions, so a monthly budget for everything an agent buys has to live in the agent app or your own records.
8. When a plan changes, cancel the old instruction rather than leaving it active alongside the new one. Visa has no endpoint to modify an instruction or mandate, so changes always mean cancel and recreate.
9. Keep the purchase instruction, mandate and the agent's order details with each charge. Visa's docs say instructions are required to evidence what was authorized if there's a dispute.

What is a Visa Intelligent Commerce purchase instruction and mandate?

Visa's VIC concepts page describes four building blocks. A token is the tokenized form of the card, and must exist first. A purchase instruction is the agreed purchase intent between the cardholder and the agent: the cardholder authorizes the agent to create it and signs that authorization with their authentication data. A mandate holds the cardholder's spending parameters inside one instruction. A credential is the network token, cryptogram and ECI that Visa returns for one purchase.

• The instruction API's mandate fields are a mandate ID assigned by the agent app (never reused), a decline threshold amount and ISO 4217 currency, an end time (effectiveUntilTime), and optionally a merchant category or category code, a preferred merchant name and a recurring frequency. The instruction can also carry an optional consumerPrompt, a recap of the prompts that led to the purchase.
• Cardholder authentication is recorded as assurance data and can be FIDO2 biometric or device-based, app-based, a one-time passcode, or a Visa Token Service step-up. VIC checks it's valid before it returns any credential. The docs also require agent-side verification of the cardholder through Visa Payment Passkeys or another approved method for every purchase type.

What does Visa check before an AI agent gets a payment credential under a mandate?

Each credential request names exactly one instruction and one mandate. Per the docs' controls list, Visa validates the request against that mandate's decline threshold in two ways: the transaction amount alone must not exceed it, and the sum of all transactions on the instruction, including earlier ones, must not exceed it. If the mandate has a preferred merchant name, the transaction's merchant name must match. For a recurring mandate, each retrieval must fit the stated frequency and end date.

• Further limits apply around that. Cryptograms are single-use with a 72-hour lifespan, and if a purchase fails, a fresh credential can be requested once Visa has been told through the confirmation API. A token can have at most 15 cryptograms retrieved in a rolling 24-hour window. Every transaction reference on an instruction must be unique. Restricted merchant category codes, listed in Visa's implementation guide, are declined automatically.
• Agents that are Trusted Agent Providers or wallet providers must sign every credential request afresh, and Visa checks the signature against its Visa Agent Registry Service, which gives a per-purchase record of which registered agent asked. Open-source agents use a fixed agent ID and don't sign.

What doesn't a Visa Intelligent Commerce mandate limit for an AI agent?

The threshold is per instruction. The docs don't describe a cap across all of one cardholder's instructions, and an agent can create several (up to 10 mandates each, up to 50 tokens per consumer), so a weekly or monthly ceiling on everything an agent buys isn't something a single mandate gives you.

• Merchant matching is by the merchant name you set as preferred. Merchant category and category code are fields on the mandate, but the controls list on the concepts page doesn't say Visa checks them, so treat them as information unless Visa confirms otherwise.
• Time limits are generous by default. US instructions have a default 30-day intent expiration, and the assurance data stays valid for the same window, so an autonomous instruction you forget about can still be drawn against for weeks unless its end time is shorter or you cancel it.
• Revocation is silent. Visa's docs say an issuer or the Visa Token Service can revoke a card token without changing the instruction's status or sending any notification; the first sign is usually a failed credential request. An agent app should treat an unexpected UNAUTHENTICATED or NOT_FOUND on a token that used to work as a possible revocation, not a glitch to retry.
• In the US, merchants that support 3-D Secure get a "Program Not Supported" response for agentic transactions, so don't expect a bank step-up challenge to catch a bad agent purchase there.