AmEx Just Made the Card Network the Gatekeeper for AI-Agent Commerce — And Its Closed-Loop Stack Is Why Visa and Mastercard Can't Match It Yet

Every prior agent-commerce launch — Visa's Trusted Agent Protocol (Oct. 2025), Mastercard's Agent Pay and Verifiable Intent (March–June 2026), the cross-network agent trust framework with Ant International (Sept. 2026) — focused on rails, identity, or merchant acceptance. American Express's Intent Intelligence Framework puts authorization at the front of the transaction, not the back, by forcing the AI agent to fetch a scoped payment credential that expires the moment the customer's intent stops matching.

American Express's pitch — articulated by VP of Agentic Partnerships Hannah Bozian to TechCrunch — is that the company can deliver end-to-end guarantees because it runs a largely closed-loop network: American Express typically issues the card, processes the transaction, and often acquires the merchant. Visa and Mastercard sit on a four-party model (issuer-acquirer-merchant-cardholder), which makes a single intent-aware credential harder to bind to a specific authorization rule. The Agent Purchase Protection launched in April 2026 — AmEx covers eligible Card Members and merchants for errors by registered agents — operationalizes that advantage by underwriting the liability, not just routing it.

The Intent Intelligence Framework was published the same week American Express surfaced in the Linux Foundation's x402 Foundation as a Premier Member (alongside Cloudflare, Coinbase, Fiserv, Mastercard, Google, AWS, Adyen, and Circle, per the July 14, 2026 operational launch). That double positioning — a proprietary card-network spec on top, an open HTTP-402 standard underneath — gives the framework two distinct moats. EMVCo published the card-based agentic-payments framework draft on Sept. 1, 2026, with a comment period that closed Sept. 30; American Express's spec aligns with that direction, raising the odds it becomes the reference implementation when EMVCo moves from draft to standard.

The five capabilities counted above: Agent Registration, Intent Intelligence, Scoped Payment Credentials, Cart Context, and Account Enablement. Mastercard covers four (Agent Pay + Verifiable Intent + Agent Pay for Machines + tokenized credentials), Visa covers three (TAP + Intelligent Commerce + acquirer-side tokenization), and standalone wallets like PayPal and Block cover two (account-level enablement and checkout) — which is the gap the OpenAI/Stripe/Cloudflare agent-commerce ecosystem is racing to fill.

For American Express, agent commerce is a defensive question more than a growth one: if AI agents start routing a rising share of consumer purchases to the lowest-cost acceptance rail, the closed-loop premium that has supported a forward P/E of ~15x (vs. Visa at ~24x and Mastercard at ~24x) gets compressed. The Intent Intelligence Framework is the answer that holds that premium in place — by ensuring 'intent authenticity' is something only American Express's rails can cryptographically prove, the network stays in the middle of the agent's decision loop rather than being reduced to a dumb pipe.

The framework's pilot-ecosystem partners — disclosed in the April 2026 ACE Developer Kit launch (reaffirmed by the Oct. 6 Business Playbook) — give a precise read on the value chain. Payment infrastructure (Fiserv, Global Payments, Adyen), identity and risk ([Forter]), agent-execution layers (Cloudflare, Crossmint), and merchant integrators (Delta, Expedia) are listed as the reference implementation set.

Three adoption vectors decide whether the framework compounds or gets stranded. First, the EMVCo draft — comment period closed Sept. 30, 2026 — needs to ratify a v1 that aligns with American Express's spec rather than fragmenting into a different control surface; the company is well-positioned there because its Hannah Bozian team has been visibly embedded in EMVCo through 2026. Second, the AI-agent platforms have to actually adopt the Intent API; OpenAI's ChatGPT, Google's Gemini, and Anthropic's Claude all need a credential-fetch step in their purchase flow. Third, consumers — particularly on big-ticket categories where only 15% trust bots today — have to believe the protected-purchase pathway meaningfully reduces their dispute risk.