By Ivan Tsarynny, CEO / Co-founder, Feroot Security
An AI shopping assistant can recommend a product without being allowed to buy it. An agentic AI system may go further: access an account, select a payment method, interact with a checkout, and initiate a transaction. Each added permission changes the payment-security questions you need to answer.
Before adding an agent to a payment journey, draw its boundary. What can it read? What can it change? What can it authorize? What happens when it encounters content controlled by someone else?
PCI SSC has increasingly focused on AI in payment environments, including agentic AI systems that can facilitate or make payments on behalf of cardholders. Its 2026 North America Community Meeting in Vancouver included workshops on attack surfaces in agentic payment flows and whether PCI DSS requirements apply differently when AI agents perform functions traditionally handled by humans.
PCI SSC has also published guidance on securing AI in payment environments. The central principle is straightforward: using AI does not remove or bypass otherwise applicable PCI SSC requirements. The specific requirements that apply still depend on how the AI system is implemented and what payment data, systems, and functions it can access.
Define What the AI Agent Is Actually Authorized to Do
Start by defining the AI agent’s job in verbs. “Helps with shopping” is too vague. “Reads the catalog and adds an item to a cart” is clearer. “Selects a stored payment method and submits an order within an approved limit” introduces a very different level of access and responsibility.
For each verb, specify the allowed data, tools, account privileges, and conditions. Identify which steps require a person’s confirmation and which can run under an existing authorization. Make the boundary visible to the shopper and enforce it in the system.
PCI SSC’s AI guidance reinforces the importance of authorization and accountability. AI systems can provide input to approval decisions and perform actions after approval, but organizations still need to understand who or what is authorized to act, what limits apply, and how those actions can be traced and reviewed.
Map the AI Agent’s Path From Instruction to Payment
Trace the complete chain: user request, agent, external content, merchant interface, payment service, and transaction result. Mark each point where information crosses from one party’s control into another’s.
Then ask what evidence you retain at each decision. Can you connect the original authorization to the action taken? Can you distinguish a requested purchase from an agent’s interpretation? Can you identify which account, AI agent, and tool were involved without unnecessarily exposing payment data?
Logging and monitoring matter here. PCI SSC’s AI principles state that AI actions should be logged and monitored so they can be traced back to the system performing them and to a responsible human individual.
Minimize the payment data exposed to an AI system wherever the architecture allows, and avoid placing sensitive payment credentials in general-purpose prompts or logs. Review the actual handling of cardholder and account data with the teams responsible for security and PCI DSS scope.
PCI SSC notes that payment tokens or single-use PANs may help limit the scope and impact of AI systems that need access to payment data. But calling a value a “token” is not, by itself, enough to determine how a particular implementation affects PCI DSS scope or risk.
Know When the AI Agent Reaches the Payment Page
Not every agentic payment flow reaches checkout in the same way. Some AI agents interact through APIs. Others operate through a browser and interact with the merchant’s payment page. Hybrid designs may move between both.
That distinction matters because the security controls and visibility available at one layer do not automatically prove coverage at another.
If an AI agent uses your web checkout, examine the payment page it encounters and the scripts that execute there. A website release, tag change, or third-party dependency can alter that environment just as it can for a human shopper.
Test the supported agentic checkout journey under controlled conditions and verify what your payment-page security and monitoring controls actually observe.
If the agent completes payment through an API without a payment page, a browser-control demonstration does not prove coverage of that transaction path. Document which layer of the agentic payment flow each security control actually addresses.
Test AI Agent Permissions Before Expanding the Pilot
Use a non-production environment or another approved test arrangement. Try actions that should be denied as well as those that should succeed.
- Ask the agent to exceed an allowed purchase limit.
- Remove its account or tool permission and confirm access stops.
- Change an order detail after approval and check whether authorization is revisited.
- Introduce conflicting or untrusted instructions in approved test content and observe which instructions the AI agent follows.
- Interrupt the flow and confirm that a retry does not create an unintended duplicate transaction.
These are practical design tests, not PCI DSS assessment procedures or a certification checklist. Their value is in turning an abstract discussion about “AI risk” into evidence about the specific permissions, systems, and transaction paths involved in your implementation.
Keep AI, Payment, and Browser Security Boundaries Clear
Assign an owner to each part of the agentic payment flow and document the limits of the implementation. A successful demonstration is one observation; it is not evidence that every payment method, exception, integration, or AI agent behavior has been covered.
Where the journey includes a web payment page, bring that page into the same script inventory, authorization, and change-detection processes used to protect checkout for human shoppers. Keep AI agent authorization, payment processing, PCI DSS responsibilities, and browser security distinct, and make sure you know where each one begins and ends.
Frequently Asked Questions About Agentic AI and PCI DSS
Does PCI DSS apply to AI agents?
AI does not create a separate set of PCI DSS requirements. Organizations should evaluate how an AI agent is used, what payment data and systems it can access, and which existing PCI DSS requirements apply to that implementation.
Can an AI agent access cardholder data?
Whether an AI agent can access cardholder data depends on the architecture and controls of the specific implementation. Organizations should minimize unnecessary exposure of payment data and evaluate how any AI system that stores, processes, transmits, or can access cardholder data affects PCI DSS scope and security responsibilities.
What are the security risks of AI agents at checkout?
The risks depend on what the agent is authorized to do and how it interacts with the payment journey. Areas to evaluate include excessive permissions, untrusted instructions, unauthorized actions, payment-data exposure, logging, third-party interactions, and changes to the browser or payment-page environment.
Do AI agents change payment-page security requirements?
The use of an AI agent does not automatically replace existing payment-page security responsibilities. If an agent interacts with a web checkout, organizations should understand which scripts execute on the payment page, how changes are detected, and which controls apply to that browser-based portion of the transaction.
If AI agents interact with your web checkout, Request a Demo to see how Feroot PaymentGuard can provide visibility into payment-page scripts and changes across the browser-based portion of the transaction journey.
