The Card Has a Commitment Layer. The Rest of the Stack Doesn't.
On August 11, Mercury launched Spend.
The headline everyone ran with: AI agents got their own company credit cards.
That is not the interesting sentence. Read the mechanic instead.
An agent card at Mercury can only be created by a human. It is trackable, auditable, and cancellable. It can be restricted to a specific merchant or to a merchant category code. It sits inside an intelligent budget — travel, software, procurement — with a hard limit that the network enforces at swipe time. A transaction that exceeds the budget is declined at the point of sale. If a receipt or a memo is missing after the swipe, the card automatically freezes until the record is filled in. The agent can transact inside the defined limits. It cannot bypass them, and it cannot change them.
Read that again.
What Mercury shipped is not “a card for agents.” What Mercury shipped is a scoped commitment substrate — for one action primitive.
Every property of that card is a commitment property.
Only a human can create it — the authority is signed, and the record of who authorized what lives with the artifact.
Budget, merchant, category — the scope is bounded before the agent acts, and the enforcement is at the network, not at the model.
Declined at point of sale — the substrate can block an action that falls outside the commitment set, in the same instant the action is attempted.
Auto-freeze on missing memo — the ledger of what happened is required for the artifact to keep working. If the record is not there, the primitive stops.
Trackable, auditable, cancellable — every action carries a per-event record back to the authority that issued the card.
That is what “unsanctioned” needs in order to be a meaningful word. That is what “governed” is supposed to mean. Mercury built it, in production, for money.
The story nobody is telling
The industry framing is: agents can now spend. That is what makes the headline. That is what fintech Twitter is reacting to.
The story underneath the framing is a different sentence.
Mercury just demonstrated what a coordination layer looks like at the boundary of one action primitive — money movement. Authority, scope, and record are not layered on after the fact by a separate governance product. They are the same object as the primitive itself. You cannot separate the swipe from the commitment record, because the commitment record is what the network uses to decide whether the swipe happens.
That is not compliance. That is not observability. That is not a dashboard on top of an existing rail.
That is the substrate.
The primitives without a substrate
Now walk down the list of every other thing an agent does on your behalf.
An agent sends an email. Who authorized the outbound? What scope was it bound to — this recipient, this subject class, this timeframe? Was the message inside that scope? Is there a per-action record on the message itself that says: this was the commitment before the send? In most stacks the answer is no. The send happens. The provider logs the SMTP event. If the message was a bad idea, the artifact does not carry the record of who allowed it.
An agent deletes data. Who authorized the deletion? Was the row inside the deletion scope? Was there a scope at all, or did the agent infer permission from access? Most deployments cannot answer this from the log. The delete succeeded. The audit trail says the service account did it. The service account is not accountable to anything.
An agent books a resource — a meeting, a room, a compute cluster, a contract slot. Who authorized the booking? Was it inside the scope of what the agent was told to do? Was the counterparty a permitted counterparty? Was the resource a permitted resource? At most this is guarded by a rate limit and a role. Neither is a commitment substrate.
An agent signs — a NDA, a data-processing agreement, a click-through, a webhook subscription. Who authorized the signature? On whose behalf did the signature bind an entity? What was the scope of the delegated authority? At the point the signature is registered, the artifact carries no per-action commitment record. The signature is durable. The authority behind it is not.
An agent modifies configuration — an IAM policy, a DNS record, a feature flag, a firewall rule. Who authorized the change? Was it inside the scope of what was permitted to change today? Was the diff reviewed against a commitment set? For most operators, the answer is a log line and a hope.
Five primitives. Five artifacts that carry no commitment layer. Every one of them is what Mercury just closed for money.
The pattern nobody is naming
The accountability gap is not one gap.
It is N gaps, one per primitive.
The industry keeps talking about “agent governance” as if it is a single control plane you add on top. It is not. Governance is not a plane. Governance is a property of each action primitive — of the send, of the delete, of the booking, of the signature, of the config change, of the swipe. Either the primitive itself carries authority, scope, and record, or it doesn’t. If it doesn’t, no dashboard above it can invent them.
Mercury got there for money first because money is regulated and because a card network already had the enforcement point built. The rail was there. Mercury made the substrate.
For every other primitive, the rail is a general-purpose API — SMTP, S3, Google Calendar, DocuSign, Kubernetes, your CRM. The enforcement point does not exist. The commitment set does not exist. The per-action record does not exist. The auto-freeze does not exist.
That is where the substrate is missing.
Why this matters at agent speed
At human speed, the missing substrate was tolerable. A human sends one email at a time. A human deletes one row at a time. A human signs one document at a time. The commitment is in the human’s head, and if a mistake happens, one artifact is affected.
At agent speed, the missing substrate becomes the failure mode.
An agent runs in a loop. In a single execution, it may send fifty emails, delete two hundred rows, modify a dozen configuration values, sign three agreements, and swipe a card. If four of those primitives have no substrate, the loop can produce hundreds of artifacts with no per-action authority, no per-action scope, and no per-action record. Every one of those is an open loop, at scale, from the moment it was created.
The Anthropic and OpenAI incidents at AISI last month were pictures of this. So was the Hugging Face breach in July. In both cases, the model executed inside a general-purpose interface that had no commitment substrate. There was a log of what happened. There was no ledger of what was promised.
Mercury just made the counter-example visible — in production, with a real financial rail behind it. The pattern is possible. The pattern is legible. The pattern is buyable.
The pattern is also, so far, only shipped for one primitive.
What has to be true next
The next step is not “someone builds the same thing for email.” Or the same thing for calendar. Or the same thing for storage.
The next step is that the primitives stop being modeled as general-purpose APIs the agent calls, and start being modeled as scoped commitments the agent can hold. The commitment is the object. The action is what the substrate does with the commitment. The record is what the substrate produces from the action. All three live together, as one artifact, tied to the human authority that issued the scope.
Mercury did this for money because there was no other way to ship it — a card network will not run without authority, scope, and record, all bound to one object. There is no other way.
Every other agent-facing primitive should be shipped the same way. It won’t be, for a while. But the standard is now on the table. A regulated primitive with a scoped commitment substrate exists, in production, at a US fintech, as of Monday. It is going to be a lot harder for the rest of the stack to keep pretending that a log line and a role are the same thing as accountability.
The card has a commitment layer.
The rest of the stack doesn’t.
That is the gap, named, in one sentence.
Eliran Keren — Founder of Deeplica, building the coordination layer for the person at the center.
Sources: Mercury Launches Spend with Agent Cards and Intelligent Budgets — Business Wire, Aug 11, 2026 · Introducing Mercury Spend — Mercury Blog · Mercury puts AI agents on the company spending line — Fintech Global, Aug 12, 2026 · AI Agents Just Got Their Own Company Credit Cards — PYMNTS · Incident Report: unsanctioned agent behaviour during cyber testing — UK AISI, Aug 5, 2026
