Google's NEW Agent Money Protocol

Google is rolling out an “Agent Payments Protocol” designed to let AI agents handle money—making purchases, paying merchants, and managing financial interactions—while keeping identity, intent, and liability clear. The move matters because agent-to-agent and model-to-model protocols are already gaining traction, but payments are where real-world risk concentrates: fraud, impersonation, and uncertainty over who authorized what.

The protocol is positioned as an extension built on top of two existing standards: Agent2Agent (A2A), for coordinating between agents that aren’t necessarily under the same control, and MCP (Model Context Protocol), for tool and data interoperability. Google’s Agent Payments Protocol (described as A2P) adds a trust layer between an agent and merchants/payment systems. It aims to provide visibility into when agents initiate payments, manage payment credentials and identity, and—most importantly—make the user’s intent explicit rather than inferred from an LLM’s output.

Google frames the problem as a multi-party “game” with competing incentives. Merchants want control over the customer experience: showing offers, enrolling users in loyalty programs, and driving upsells. Payment ecosystems worry about impersonation and agent fraud. There’s also the legal and operational question of liability when something goes wrong. The protocol’s goal is to let merchants still interact with an agent (for example, by presenting offers or loyalty discounts) while tying the agent’s identity back to the user and enforcing rules about how credentials are used.

A2P defines roles and responsibilities for agents, including how they obtain an identity from credential providers, which identity gets presented to merchants, and how merchants pass that identity to payment processors for verification. Google currently provisions two modes. In “human present,” the agent does the research and cart-building, then the human confirms the purchase by clicking the final button. In “human not present,” the system relies on cryptographically signed intent mandates—so the agent can execute a specific transaction only when the user has empowered it to do that exact kind of purchase from a specific merchant.

Google also emphasizes “verifiable intent, not inferred action.” Trust can’t rest on ambiguous model responses; transactions should be deterministic and anchored with cryptographic proof of intent from the relevant parties. That distinction is likely to determine how hard fully autonomous purchasing will be in practice—straightforward for last-step confirmation, much more complex when agents act while the user is offline.

The protocol is being released as open and non-proprietary, with privacy-by-design and defined liability as core principles. Google has published it openly (with references to A2A being donated to the Linux Foundation) and provides an onboarding path via an AP2 website plus documentation and sample examples on GitHub, including Python-based implementations. The rollout is described as an early “0.1” release, with a roadmap and an invitation for feedback—especially on how the standard could expand beyond e-commerce toward broader agent marketplaces and task-farming scenarios where agents negotiate prices and complete work on the user’s behalf.