American Express Has the Booking. Who Approves the Bill?

In June 2026, American Express agreed to buy restaurant-booking platform TheFork for $700 million in cash. U.S. banks are reportedly restricting some third-party agents from customer accounts after agents appeared to act independently of users’ instructions. A table could be booked before the bank will let the agent near the customer’s account.

Fortune’s October account of Chainalysis data put agentic-commerce transactions on Coinbase’s Base at about 1,500 in Q2 2025 and more than 138 million in Q3 2026. Machines can initiate payments at scale. That number says little about whether a merchant, bank, or customer can explain and contest each one.

Checkout was built to complete a purchase a shopper had already decided to make. An agent may discover the merchant, choose the item, and initiate payment under authority granted earlier and elsewhere. That leaves the merchant and bank to determine who authorized the agent, what it could buy, and who answers if the charge goes wrong.

Walmart put a gate between shopping access and permission to buy

OpenAI and Visa are enabling purchases after users give agents permission; Coinbase’s Agentic Wallets let agents make autonomous crypto transactions through the x402 protocol. A merchant may first encounter an agent after it has selected a product and a means of payment.

Walmart has split those functions explicitly. Its Agent Gateway gives agents a way to shop through an MCP server, while separate Agent Profiles authorize agents and track their purchases. The gateway lets a machine interact with Walmart’s shopping system. The profile identifies which machine has permission to act and leaves a record of what it bought.

Walmart can check an agent at the entrance to its own store; a network may see only the resulting payment. A valid credential does not oblige a merchant to accept every agent carrying it.

Banks need boundaries that remain visible after approval

A customer who asks an agent to “find a suitable dinner” has given it no spending limit. A permission record would have to distinguish the agent from the customer, specify eligible merchants and transaction ceilings, preserve the purpose of the purchase, and show when authority was granted or revoked. A human approval checkpoint for a consequential charge would also establish who accepted responsibility.

Microsoft’s Agent Control Specification addresses the broader developer problem of giving agents granular, consistent limits on what they can do. The FIDO Alliance has formed working groups on securing agent transactions, with Google contributing an Agent Payments Protocol. A bank handling a disputed dinner bill would still need the customer’s instruction.

Six major banks warned that more autonomous commerce chatbots could increase scams, fraud, and disputes. U.S. banks are reportedly restricting third-party agents’ account access after instances in which agents appeared to act independently of user instructions. Even if a payment moves, the bank may have to answer for an instruction it cannot reconstruct.

American Express bought booking context, not proof of consent

American Express owns Resy, acquired restaurant-reservation service Tock for $400 million, and agreed in June 2026 to acquire TheFork for $700 million in cash. Restaurant bookings were valuable as dining access and cardmember benefits. They also describe a decision before a payment exists: which restaurant a customer chose and when the customer intended to go.

Consider a customer who authorizes an agent to arrange one dinner at a particular restaurant within a stated budget. A booking platform could provide the merchant and reservation record against which a later payment instruction is checked. The card credential alone cannot establish that the charge belongs to that dinner. The customer would need to authorize payment separately. American Express has not shown that its booking platforms, delegated spending controls, and dispute handling operate as one system. It would have to join the restaurant’s booking record, the payment flow, and the evidence available when a customer disputes the bill.

Visa is building for permission that crosses rival networks

Visa chose a different boundary for Intelligent Commerce Connect: its agent-payment platform facilitates transactions across multiple card networks, including competitors’ networks. That design does not require Visa to own the shopping agent or every merchant surface. It requires an agent’s permission and credential to remain intelligible as the purchase passes between them.

Ant International, Visa, and Mastercard plan a standard for AI-agent payments, while the FIDO working groups address transaction security. Those plans have yet to establish who bears liability for a disputed agent payment. They mark the points where a proprietary permission system meets another institution: the merchant must recognize the agent, the network must recognize the credential, and the bank must know what it has agreed to honor.

The smallest charges are the easiest ones to leave unexplained

Fortune’s account of the Chainalysis data also found that more than 87% of Base’s Q3 2026 agentic-commerce payments were under $0.10. That volume demonstrates a working path for cheap machine-initiated transactions, not mature demand for substantial retail or enterprise purchases. An individual charge below a dime rarely justifies a costly dispute. A restaurant bill, or a series of purchases made under a company’s authority, puts more at stake.

Merchants can still refuse a card network’s terms. In 2024, eBay dropped American Express, citing what it called unacceptably high fees. A restaurant could likewise value a richer authorization record and still reject its price or the work of connecting it to checkout.

The old checkout could end with a receipt because the shopper had made the decision in front of it. At an agent-booked table, the receipt can show what was charged. The reservation is where someone must be able to show why the machine was there.