--- id: PRG-0119 title: The Agent Now Carries A Receipt For The Request kicker: the assurance desk, on proof of intent captured: 2026-10-17T12:00:00Z status: open author: Marlowe Quist source: https://www.americanexpress.com/en-us/newsroom/articles/innovation/intent-intelligence-framework-agentic-commerce.html summary: American Express published a framework that turns what a customer asked an AI agent to buy into a signed token before the purchase happens, and Google gave workplace agents their own email addresses and audit trails. The record of agent work is moving upstream, from what the agent did to what the person asked for. tags: [the record, custody, ai, agents, permission] --- A receipt records what was bought. For a century that was enough, because the person who bought it was the person who asked for it, standing at the counter. An AI agent splits those two people apart. Someone asks. Something else buys. American Express has now published a way to put the asking on file. Its [Intent Intelligence framework](https://www.americanexpress.com/en-us/newsroom/articles/innovation/intent-intelligence-framework-agentic-commerce.html), part of the ACE Developer Kit, works in four steps. The agent captures the request with its constraints: merchant, budget, preferences. The customer verifies their identity and approves it. The approval produces an Intent ID and a Proof of Intent Token. The token is used to issue a payment credential limited to what was approved, so the agent never sees the real card number. Amex's example is plain. A customer asks for white Nikes in a size 9; if the agent tries to buy Adidas, the purchase can be stopped. In [one summary](https://trewknowledge.com/2026/10/16/ai-this-week-agents-get-an-identity/) of the launch, the issuer sees the approved intent "before the agent buys anything, not after." The receipt now has a twin, and the twin is written first. ## where the record used to start Every audit trail I have reviewed for an automated system begins at the action. The agent called this endpoint. The agent moved this money. The log is precise about what happened and silent about what was wanted. When the two diverge, which is the only time anyone reads the log, the investigator has to reconstruct the request from memory, from a chat transcript if one survived, or from the customer's account of it, which arrives angry and after the fact. The intent token fixes the order. The request is captured, constrained, approved and signed before anything spends. The purchase is then checked against it. That makes a dispute a comparison of two documents, and a comparison can be done by a machine at the moment of sale. > An agent that can show what it was asked for can be held to it. The same week, Google described the identity half of the arrangement. At Gemini at Work, it said a coworker agent [receives its own Workspace account](https://cloud.google.com/blog/products/ai-machine-learning/welcome-to-gemini-at-work-2026), with an address on an agents subdomain, a calendar and a Drive, and that "every action Gemini takes is written to an audit trail and attributed to the agent rather than to a person." Spend caps pause a project's agents when they are hit. An identity that is not yours, a log that names it, a hard limit on what it can spend. Put the Amex token in front of it and the ledger has both ends. ## the ledger, by line I keep a spend-against-impact ledger on every deployment this desk reviews. Here is what each piece moves. 1. **Intent token.** Moves the record of the request from the customer's memory into a document the issuer holds. Cost is one approval step for the person, at the point they are already paying attention. 2. **Agent identity.** Moves blame off the human whose credentials the agent used to borrow. Cost is administrative: one more account to provision and retire. 3. **Attributed audit trail.** Moves reconstruction work from after the incident to during the action. Cost is storage. 4. **Spend cap.** Moves the worst case from unbounded to known. Cost is the occasional paused job. Every line is cheap. Each one is paid by the system rather than by the person on the other end of the dispute. That is the trade I sign off on. ## the input everyone skips Adjective, the company that runs this press, has a name for the moment Amex just tokenized. Its founder, [Rob Murtha](https://www.linkedin.com/in/robmurthagrowth/), calls it [Input Zero](https://www.adjective.us/blog/we-dont-know-what-we-dont-know): the request a human types before an AI does anything, which bounds the quality of everything after it. His essay is about a different consequence, that the request is limited by what the asker has been exposed to. The mechanism is the same. Input Zero is the most consequential line in the transaction and, until this month, the least recorded. The token proves the customer approved a request. It does not prove the agent captured the request correctly before showing it for approval. The person still has to read the summary they are signing, which is the one step in the chain no framework can do for them. Adjective also [builds governed agentic systems](https://www.adjective.us/solutions/custom-agentic-builds) for companies, so read my interest as a disclosed one. I would hold any vendor's build to the same four lines. ## the position Capture the request before the action, in a form the person approved and the system can check. Every agent that spends money, sends mail or changes a record on someone's behalf should carry that document, and the person should be able to read it back. The receipt says what happened. The token says what you meant.