Agentic Authority: China's AI Commerce

China's agentic AI is moving real money right now, at a scale most of the West is still announcing. Alipay processed more than 120 million AI Pay transactions in a single week in February 2026, and by late May that had crossed 300 million agent payments, across 95 percent of the mainstream agent frameworks (Xinhua, 26 May 2026). So capability is settled. The thing that isn't settled is authority: who lets an AI agent spend, up to what amount, and what happens when it gets the order wrong.

So that's a design problem, and it's why agentic payments gets measured in years. Most of what looks like an AI agent paying is a model making a suggestion and a person tapping approve. A few thin slices are genuinely hands-off. And full autonomy over real money is still a long way off, which is the part I'll come back to.

Capability isn't the hard part

The model, the API, the token. And capability is close to solved, getting cheaper by the quarter. JD.com built a whole protocol for AI agents that pay. Amazon's "Buy for Me" AI agent completes a purchase on an outside site while the buyer watches, which is a strange sentence to write in 2026. And what everyone races on is capability. What nobody races on is permission, because permission isn't a feature you ship. It's a decision about someone else's money.

The same ladder, built twice

I've been writing about the step-up in autonomy as the Agentic Authority Escalation Model: capability first, then permission, and permission escalates in steps. A higher step only works if the design gets more explicit about who is accountable. And it sits alongside the Seven Dimensions framework I build on.

So in June 2026, when JD.com shipped the Agent Autonomous Payment Protocol, I read the L0 to L5 scale twice. It's taken from autonomous driving. L0 is a person confirming every payment; L5 is the AI agent paying on its own. But the run that matters is L3 and L4, where an agent can initiate inside a boundary a person set.

And that's the strongest kind of validation there is, the kind you can't write your way to. A framework landing on the same shape when someone builds it independently, with real money on the line, beats anything a framework can say about itself.

Why escrow rails got there first

It's structural. Two things about how the rails were built explain it, and neither one is about trust or culture.

Chinese marketplaces were built on escrow-style settlement, so money goes to a middle account, the seller ships, the buyer confirms the goods, and only then does the money release. So there's a built-in step where a second party authorizes the final move. Add a delegated AI agent and the step already has a slot for it. The AI agent can act. And the cash stays held until a condition clears.

The card rails run the other way. They capture, then settle. The money moves, and a dispute becomes a chargeback after the fact. There's no built-in hold where a conditional authorizer sits, which leaves two options once you add an AI agent to a card rail: build that hold in, or let the agent act on a standing mandate and hope the limits hold.

And that's the mechanical reason the agent-payment slice widened in one place first. The trust sits in the settlement design, not in the machine. So if you want an AI agent moving money, the work is on the release condition, the second key, and the human signature on the move that matters.

The sober part

Autonomy over other people's money is the part that's years away, and pretending otherwise undercuts the whole point. Well, let me be exact about it, because "a long way off" hides the interesting part. Finextra's 2026 review of agentic payments found most of what runs today is human-in-the-loop, a support layer where a person still makes the final call, and the mandate-based flows from the big card networks are still early pilots.

That's a smaller version of the future. It's also the version where the design gets tested first, which is the only reason I trust any of it.

Who lets an agent spend?

So if you're a leader deciding whether to push agentic AI into an operation, or an investor sizing the risk, three things.

1. 1You design a boundary, and no model hands it to you. Set it, log it, make the budget a hard stop.
2. 2Expect the failures to come from integration and legacy systems. The model is the part that works.
3. 3When a move is consequential and irreversible, keep a hold, a reversal window, and a human sign-off.

And the vendor question is the short version of all three. Ask what the AI agent is allowed to do and who answers when it gets that wrong. Gartner's 2027 number is the tell here, and a leader's job is to make the AI agent finish the work the infrastructure already produces, instead of building a parallel stack next to it. The AI agent is the last mile, and the last mile is the part that breaks. And if you're evaluating a marketplace that lets an AI agent auto-buy, ask how it bounds the spend and who signs for the other side.

Authority, systems, reversibility. Those three are the test for whether an agentic deployment holds up or ships a headline and quietly stalls.

Creator commerce, same question

And this isn't really a payments story. It's the authority question wherever a system makes a consequential call. In creator commerce, that call is which creator to back, and how much to commit.

I built a decision engine for that. TikSense measures a creator's ability to convert sales on a specific product. The number buyers assume matters, engagement, wasn't the number that mattered. A creator at 2 percent engagement on entertainment content is a different instrument from a creator at 2 percent on product content. Same number, opposite meaning. So the engine had to judge them on something else, and the decision that cost money, whether to back the creator, stayed with the operator.

Same shape. The system decides, and the person authorizes the move that spends.

And it's the same thing the Seven Dimensions of Enterprise AI names. Governance & Containment is drawing the boundary. Human Judgment is the checkpoint. Calibration is knowing when the system is confident enough to act, and when it should hand back to a person. So payments makes that visible because the step is irreversible, and creator commerce makes it visible because the step is expensive. Same design, two lenses.

The AI agent can pay, and the capability was never the hard part. What's hard is deciding how much an AI agent is allowed to move, on what authority, and who answers when it moves it wrong. So the deployments that hold up will be the ones that designed permission in from the start.

This lives wherever you already are, Substack, X, or LinkedIn, drawn from building TikSense.