The Deutsche Bundesbank returns to one idea more than any other in its article: AI agents make probabilistic decisions, and payments depend on deterministic ones. This lesson is that idea applied to steps 2 and 4.
What probabilistic means here
Agents are built on large language models. A rules-based system produces the same output for the same input every time. A model produces a likely output given the input and the context, and a different run can produce a different answer. The Bundesbank's phrase is that this allows flexible and adaptive responses but poses challenges for the consistency and auditability of decisions.
Hold that against the two decisions from the last lesson. Asked to pick a product and a payment method under the same mandate on two different days, the agent can legitimately choose differently. That is sometimes the point: prices moved, stock changed. It is also the problem: the customer, the merchant and the payment service provider cannot reproduce why.
The ways a decision goes wrong
The Bundesbank lists the sources of flawed decision-making without ranking them: model distortions, misinterpretation of user preferences, software errors, hallucinations. It adds the black box problem, the lack of transparency intrinsic to complex algorithms, which hampers diagnosis and produces results that are hard to audit. Module 1 covered the mandate-level version of this, the misread mandate. Here the same failure appears at the product and the instrument: the right scope, the right limits, the wrong choice.
For the customer, the Bundesbank names three exposures: reduced control over their own spending, the possibility of unintended purchases, and erroneous transactions noticed only later. The proposed mitigations are specific. Build in checkpoints before final execution. Make human review mandatory for large transactions.
The two failures that are systemic
Two failure modes get their own treatment because they do not stay inside one customer's account.
Herd behavior. If many agents run on homogeneous models, identical data sources or similar objectives, they can make similar decisions at the same time even when the people behind them want different things. The Bundesbank's worry is procyclical: individual efficiency gains turning into collective stability risks. Unexpectedly high settlement volumes, system-wide liquidity needs, overloaded capacity. In the retail flow, picture every household agent switching to the same rail on the same morning because the same price feed moved.
Implicit algorithmic collusion. When agents repeatedly interact with other agents, they can develop collusive patterns of behavior without anyone designing them. For a competition authority that is a new kind of problem, and the Bundesbank flags it as such.
Both are decision-layer failures. Neither is visible from inside a single transaction.
The governance rule
The Bundesbank's resolution of the mismatch is one sentence, and it is the most practical sentence in the report for anyone building at this layer. Providers of AI agents, payment service providers and financial market infrastructures could agree on a governance framework that translates probabilistic decisions into binding, deterministic processes prior to execution.
The agent may decide by probability. What reaches the rail has to be a deterministic instruction that someone can verify.
Read that against the flow. The agent decides at step 2 and step 4. Before step 5, initiation, the decision has to become an instruction: this amount, this instrument, this payee, checked against this mandate. The check is deterministic even though the choice was not. That is where the five fields from Module 1 earn their keep: scope, limits and lifecycle are tests the instruction either passes or fails, in code, with no model in the loop.
The Bundesbank reinforces this from the institutional side. It judges the use of agents to run settlement mechanisms inside financial market infrastructures as unpromising, because transaction settlement must be deterministically predictable and participants rely on predictable settlement even during disruption. The same logic that keeps agents out of the heart of a payment system is the logic that puts a deterministic check between an agent's choice and the rail.
A runtime design that does it
The clearest worked example of the rule comes from a different supervisor. The Monetary Authority of Singapore published Safeguards for Agentic Finance at Runtime in July 2026, developed with financial institutions under its BuildFin.ai program. The paper is explicit that it is not regulatory guidance. Its design is a set of runtime checkpoints placed between an agent's decision and its execution: the agent's identity, a repository of controls, and a disposition engine that decides whether a proposed action proceeds, held together by a record of what the agent intends to do, why, and on what evidence.
Map that onto the Bundesbank's sentence and they are the same shape. The agent proposes. A deterministic layer disposes. The record is what an auditor reads afterwards.
I have argued the same point from the test side in The Air Gap Is an Admission: isolating the agent is not the control, the signed record of what it was allowed to do and what it did is. And the five questions a checkout has to answer before any of this works, including who pays when the deterministic check was wrong, are in Waller Asked Who Pays When an Agent Buys Wrong.
What this asks of a product
Three design consequences, each traceable to a line in the report.
Checkpoints are a feature, not friction. A checkpoint before execution is the Bundesbank's named mitigation. A product that removes every pause in the name of autonomy has removed the control the central bank expects to see.
Large means human. Mandatory human review above a threshold is also named. The threshold belongs in the mandate's limits field, and the review belongs in the lifecycle field's reporting.
Diversity is a stability property. Herd behavior comes from homogeneous models and data. A provider running every customer's agent on one model with one price feed has built a correlated book. That is a risk question before it is a product question.
Next lesson: who steers the agent's choice, and what the end of Instant Checkout taught about discovery and checkout.