Mastercard has started a pilot program for AI-driven payments, and the CEO of tokenization platform Brickken is using the launch to push for tighter controls on what autonomous AI agents are allowed to do with money. The argument is straightforward: if software agents are going to move funds, they need clear permission boundaries and a record of who authorized what.
The Brickken CEO says stricter AI agent permissions are essential to stop unauthorized transactions and to keep financial operations accountable. The call comes as Mastercard tests a system where AI agents could initiate or complete payments on behalf of users or businesses.
What the Mastercard pilot actually involves
Mastercard's pilot puts AI agents into the payment flow. Details of the program are limited, but the concept is that software acting with some degree of autonomy can handle transactions that today require a human to click, confirm, or approve. That's a meaningful shift for a payments network that has spent decades building rules around human cardholders and merchant terminals.
The pilot matters because payment networks sit at the center of trust. A card transaction carries layers of authentication, fraud scoring, and chargeback rights. When an AI agent is the one initiating the payment, those layers have to be rethought. Who approved the agent? What limits were set? What happens when the agent goes outside them?
The permission problem Brickken's CEO is flagging
The Brickken CEO's concern is that AI agents can end up with broader access than they need. If an agent is authorized to pay a subscription, does it also have the ability to move funds to a new recipient? If it can top up a balance, can it drain one? Those are the kinds of questions that stricter permission models are meant to answer before a transaction happens, not after.
Unauthorized transactions are the first risk. The second is accountability. When something goes wrong, the trail has to show which agent acted, under what permission, and on whose behalf. Without that, disputes become a guessing game between the user, the platform, and the payment network.
The Brickken CEO argues that both problems are solvable with tighter permission design. That means scoped credentials for AI agents, explicit limits on what each agent can do, and logs that tie every action back to an authorization.
Why a tokenization CEO is weighing in
Brickken works on tokenized assets, a space where automated agents and smart contracts already handle movements of value. The overlap with AI payments is direct: both depend on software executing financial actions under rules that have to be enforced, not just documented.
For tokenized asset platforms, an AI agent with loose permissions is a liability. The same logic applies to card payments. The Brickken CEO's push is less about Mastercard specifically and more about the default settings the industry adopts as AI agents become routine participants in payment flows.
What comes next for AI payment permissions
Mastercard's pilot will generate real transaction data that regulators and payment firms can study. The question is whether permission standards get written before or after problems surface. Brickken's CEO is arguing for before.
There's no announced timeline for new rules, and Mastercard hasn't said how its pilot handles agent permissions. For now, the debate is moving faster than the standards. The next concrete step will be whatever Mastercard discloses about the pilot's safeguards — and whether other payment networks follow with permission models of their own.
