Agentic commerce in B2B procurement: how AI agents can buy for businesses

AI agents can buy for businesses by raising requisitions, shopping approved catalogs, comparing quotes and paying suppliers, but only inside the controls procurement already runs: approval policies, budgets, approved suppliers and payment instruments that enforce limits when the payment is authorized. The workable pattern is an agent that acts through the procurement system and pays with a virtual card or tokenized credential scoped to each purchase, with every step written to an audit trail. People stay in the loop for new suppliers, out-of-policy spend and exceptions.

How is B2B agentic commerce different from consumer shopping?

A consumer agent acts for one person's preferences. A procurement agent acts for an organization, so its authority comes from policy, and every purchase has to survive finance review months later.

The B2B version is harder to get right but easier to bound, because companies already write down who may buy what, from whom and up to which amount. The job is to make those rules machine-checkable and enforce them in more than one place.

Which approval policies should a procurement agent follow?

Start with the delegation of authority you already have and turn each rule into a check the agent cannot skip. Rules typically combine amount, category, supplier status and contract coverage. A simple illustrative tiering:

Three design rules matter most:

• Separation of duties. The agent never approves its own requisition, and the identity that requests is not the identity that pays.
• Versioned policy. Store which policy version the agent applied, so a later audit can replay the decision.
• Fail closed. If the agent cannot map a request to a rule, it stops and asks. An agent can find the product, but may it buy it? explains why authority, not capability, is the control.

How do budgets and spend controls keep an agent inside its limits?

Check the budget twice: when the requisition is raised and when the payment is authorized. The second check holds even if the agent or an integration misbehaves.

Card issuing platforms already expose these controls. Stripe Issuing, for example, lets a program allow or block merchant categories and set spending limits per authorization or per day, week, month, year or all time; Stripe notes that limits alone do not block categories and should be paired with category rules. Stripe: Issuing spending controls With real-time authorizations, Stripe sends an authorization request webhook and expects an approve or decline within 2 seconds, after which it falls back to the program's timeout settings. Stripe: real-time authorizations That webhook is where you check that a charge matches an approved purchase order.

Stripe also documents Issuing for agents, in private preview, covering single-use virtual cards for browser checkout, scoped Shared Payment Tokens created from an Issuing card for programmatic checkout, and agentic network tokens from Visa or Mastercard. Stripe: Issuing for agents

On the network side, Visa says its Commercial Payment Controls let businesses set transaction-level controls on spend, merchant category, location and timing, available to eligible issuers in supported countries. Visa: enhanced capabilities for business payments Ask your issuer which of these your program actually supports.

Where do catalogs and punchout fit?

The safest place for an agent to shop is where policy already lives: contracted catalogs and punchout. In cXML punchout, the procurement system sends a PunchOutSetupRequest with an operation of create, edit or inspect; the supplier responds with a start page URL; and when shopping ends, the supplier returns the basket as a PunchOutOrderMessage to the procurement system. cXML Reference Guide

Punchout returns a cart, not a payment, so approval and the purchase order still happen in the procurement system, and an agent working through punchout inherits those controls. It was designed around a person's browser session, so test whether each supplier's site tolerates automated sessions, and keep the agent's credentials separate from employees'.

For tail spend outside contracted catalogs, suppliers may expose agent checkouts through protocols such as the Agentic Commerce Protocol. Route those purchases through the same requisition and approval logic rather than letting the agent buy directly.

How should a procurement agent pay suppliers?

Networks are piloting agent-initiated business payments. Visa, BILL and Billtrust describe a live pilot in which AI agents complete already-approved invoice payments through supplier portals using tokenized credentials instead of shared portal logins. Visa: BILL and Billtrust pilot Mastercard says it is working with partners in Australia and New Zealand on AI-driven procurement: sourcing from approved suppliers, placing orders and initiating payments. Mastercard: vision for trusted agentic commerce Its Agent Pay for Machines has the agent create a digitally signed payment voucher within a business-set spending limit, built on the x402 protocol. Mastercard: Agent Pay for Machines Stablecoin options are covered in how agent stablecoin payments work.

Virtual card accounts explains why the card number is really a control object.

What should the audit trail record?

Finance and auditors will ask why a purchase happened, who allowed it and whether what was paid matches what was received. Record these for every agent purchase:

Keep these in the procurement and finance systems, not only in agent logs. Three-way reconciliation at scale covers the matching.

Where should humans stay in the loop?

Keep people on the decisions where judgment or liability sits:

• Onboarding a new supplier or changing supplier bank details, a common invoice-fraud entry point.
• Any purchase above the agent's tier or outside its categories.
• Contract terms, negotiated prices and anything that commits future spend.
• Price changes beyond an agreed tolerance between quote and invoice.
• Disputes, returns and partial deliveries.
• Any instruction the agent cannot map to a policy rule.

Monitoring needs an owner: someone who can freeze the agent's card or token quickly and see every open order it touched.

Regional notes. In the EU and UK, whether strong customer authentication applies to a corporate card payment depends on narrow exemptions, so check with your issuer rather than assuming a B2B exemption; see PSD2 SCA exemptions. For Gulf buyers, see agentic commerce in the UAE and Saudi Arabia.

FAQ

Can AI agents make purchases for a business?

Yes, within limits the business sets. Card programs, network pilots and agent checkout protocols already support agent-initiated business purchases, but policy, budgets and approvals still have to be enforced around them.

What is the safest way for an AI agent to pay suppliers?

A credential scoped to one approved purchase, such as a single-use virtual card or token with category and amount limits, checked against the purchase order at authorization.

How do you stop a procurement agent from overspending?

Check the budget at requisition and again at payment authorization, using issuer spend controls so the limit holds even if the agent fails.

Does punchout work with AI agents?

It can. Punchout returns a cart to the procurement system rather than paying the supplier, so approvals still apply, but test each supplier's site with automated sessions first.

Who approves purchases made by an AI agent?

The same people who approve them today, under the same delegation of authority. The agent prepares and executes; it should never approve its own requests.