Course · Free

Anatomy of an Agentic Payment

One transaction, from mandate to delivery: ten steps, six layers, and the question at each one of who decided, on what authority, and who carries the risk.

13 modules·Modules 1 to 4 live: 13 lessons, about 90 minutes. Six modules when complete.·In progress

Most explanations of agentic payments start with a protocol map. This course starts with a single transaction and follows it from the moment a person hands authority to a software agent to the moment the goods arrive. Ten numbered steps, six technical layers, one payment.

The reference flow is the Deutsche Bundesbank's September 2026 Monthly Report article on agentic payments, which lays out a stylized instant credit transfer executed by a fully autonomous AI agent. I use the Bundesbank's numbering throughout so you can cross-reference the original, and I report its assessments of the protocol landscape as its own. At each layer I name the protocols in play (MCP, A2A, AP2, TAP, Agent Pay, ACP, UCP and x402), describe what each does, and do not rank them.

Modules 1 to 4 are live in 13 lessons: The Mandate, Communication, Decision, and Authorization and Identity. Modules 5 and 6 follow: Execution and Settlement, and The Paradox. The course is free.

Disclosure: Charlie Major is a Product Development Manager at Mastercard. The views and opinions expressed in Major Matters are his own and do not represent those of Mastercard. Mastercard's Agent Pay is covered on the same factual basis as every other protocol in this course, with no ratings, rankings or comparative positioning.

Who this is for

Product managers and architects specifying what an agent may pay for, and how a provider checks it
Payments, risk and compliance people who need the Bundesbank flow in operational terms
Anyone evaluating AP2, TAP or Agent Pay and wanting the mechanism before the marketing

What you will learn

Explain why an agentic payment begins at step 0, before any purchase exists, and why that makes decision-making a technical layer for the first time
Place a product on the autonomy dial (low, bounded, high) and know which regulatory questions each setting inherits
Specify a payment mandate with the five fields a machine-readable mandate has to carry: principal, agent, scope, limits, lifecycle
Explain why the communication layer is the gatekeeper, what MCP and A2A do for a payment, and who controls the integration point
Turn a probabilistic decision about product and payment method into a deterministic instruction a provider can verify
Describe how AP2, TAP and Agent Pay each anchor identity and authority at step 6, factually and without ranking them
Map the SCA exemptions onto the mandate and write the check a payment service provider runs before it moves money

Prerequisites

Working knowledge of how a card payment or credit transfer moves today (Payments Architecture 101 or equivalent)

Syllabus

01Step 0: The Payment That Starts Before the Purchase7 min
Agentic payments put a new step in front of everything else: the grant of authority. This lesson sets up the course, introduces the Bundesbank's reference flow, and places the mandate on the autonomy dial.
02The Five Fields of a Mandate5 min
Whatever protocol carries it, a mandate a payment service provider can use has five fields: principal, agent, scope, limits and lifecycle. This lesson defines each one and sets the agent mandate against direct debit and card-on-file.
03Where the Mandate Sits, and Who Carries It7 min
The mandate lives in the authorization layer of the Bundesbank's six-layer architecture and touches three others directly. Three protocols carry mandates today: AP2, TAP and Agent Pay. Described, not ranked.
04What Goes Wrong at Step 08 min
Three failure modes originate at the mandate before a single product is chosen, and PSD2 asks two questions of it that have no settled answer yet. The lesson closes with the exercise: write a mandate and stress-test it.
05Steps 1 to 3: The Order, the Product and the Delegated Checkout6 min
Module 2 opens with the three steps that follow the mandate. The customer gives the agent a purchase order, the agent picks a product from a merchant, and the merchant hands checkout to a gateway. None of it happens unless the communication layer exposes it.
06MCP and A2A: How an Agent Reaches a Merchant and a Gateway7 min
The Bundesbank names two protocols at the communication layer. MCP connects an agent to tools and data. A2A connects an agent to other agents. Neither is a payment protocol, and that is the point.
07The Gatekeeper Problem: Who Controls the Integration Point7 min
The actors the Bundesbank places at the communication layer are technology corporations, AI providers and cloud providers, not payment companies. This lesson follows that placement to its market-structure conclusion, then closes Module 2 with an exercise.
08Steps 2 and 4: What the Agent Chooses6 min
Module 3 opens on the two steps the Bundesbank colors as decision-making: product selection and payment method selection. This lesson lays out what is decided at each, what the agent optimizes for, and why the Bundesbank calls decision-making a technical layer with no standards yet.
09Probabilistic Decisions in a Deterministic System8 min
The agent decides by probability. The payment system needs certainty. This lesson covers the ways an agent's decision goes wrong, the two the Bundesbank treats as systemic, and the governance rule that resolves the mismatch: translate the decision into a deterministic process before execution.
10Who Steers the Choice: Models, Merchants and the Routing Fight7 min
If an agent can switch merchant, provider and rail at almost no cost, lock-in stops working and whoever influences the choice wins. This lesson follows the Bundesbank's market-structure argument through the decision layer, uses the end of Instant Checkout as the case, and closes Module 3 with an exercise.
11Steps 5 and 6: Initiation, Then Proof7 min
Module 4 opens where the money is about to move. The agent initiates an instant credit transfer with the payer's bank, and the bank answers with a demand: prove who you are and prove what you may do. This lesson sets out what the payment service provider has to see at step 6, and why the Bundesbank calls identity the heart of the system.
12Three Anchors: Credentials, Signed Requests and Tokens8 min
AP2, TAP and Agent Pay all answer step 6, and they anchor the answer in different places. This lesson takes each anchor apart: what it proves, what infrastructure it needs, and what a payment service provider has to be able to verify. Described, not ranked.
13Making the Proof Hold: SCA, Exemptions and the Verifiable Mandate8 min
Strong customer authentication assumes a person. The Bundesbank asks whether an autonomous agent can meet it at all, and points to three exemptions that may carry the load. This lesson works through that question, then closes Module 4 with the step 6 check as something a provider could actually run.