AI Can Decide What to Buy. It Should Not Decide That Money Moves.

Most of the agentic commerce conversation has been about whether an AI agent can be trusted. A payments official in Mumbai drew a different line last week, and it is a more useful one.

Ajay Kumar Choudhary, non-executive chairman and independent director at the National Payments Corporation of India, told the Global Fintech Fest on September 10 that an AI agent may work out what a user wants but should not be the thing that approves the payment.

The sentence that matters is this one. "Decision making and execution must remain separate. AI may recommend, but authentication and final settlement must follow deterministic auditable rules."

That is not a warning about AI. It is a statement about which parts of a system are allowed to be uncertain.

The mismatch he is describing

LLM-based agent reasoning can be probabilistic. The same situation can produce different interpretations, and that flexibility is part of what makes these systems useful for understanding what someone actually wants.

Payment infrastructure is the opposite by design. It has to be deterministic, auditable and final. A settled transaction cannot be probably settled. A spending limit cannot be approximately enforced. An audit trail that reconstructs differently on a second reading is not an audit trail.

So the interesting boundary in agentic commerce may not be the one everybody is drawing between humans and software. It may be between the part of the system that is allowed to interpret and the part that is required to be certain.

Choudhary put the same idea in institutional terms. NPCI, he said, "is also examining the protocols that may be required to identify and authorise digital agents within the Unified Payments Interface ecosystem while preserving interoperability, auditability and settlement finality." The objective, in his words, is autonomy that is bounded and accountable rather than unlimited machine autonomy.

Why the venue changes the argument

UPI is not a product. In August 2026 it carried 24,508.96 million transactions worth 29,82,355.95 crore rupees across 752 banks, according to NPCI's own published statistics. Roughly 24.5 billion payments in a month, on infrastructure that most of a country depends on.

That scale changes what a design constraint means. When a card network sets a rule, it governs its own participants. When national retail payment infrastructure sets one, the rule is the floor for everyone who touches the rail, including every bank, wallet and app built on top of it.

It is a different governance model from the one I looked at earlier this week, when Visa, Mastercard and Ant International began work on recognising each other's agents while each network explicitly kept its own verification and decisioning. That is coordination between private parties who remain free to disagree. This is a shared utility deciding what software is permitted to do to money.

The primitive already exists

Here is my own reading rather than anything NPCI claimed.

UPI already separates the act of granting authority from the act of using it. Its published statistics carry mandate creation and mandate execution as distinct measures, which means the rail already understands a world where a user authorises something in advance and a system executes it later within those terms.

That gives UPI an existing primitive that maps unusually well onto the agentic-payment problem. The user grants a mandate with limits and conditions. The agent works out what to buy. The rail checks identity, mandate, limits and consent, then executes and settles.

Read that sequence and notice how little of it the agent is doing. It selects. It does not authorise, it does not enforce a limit, and it does not settle. The clever part of the system is deliberately kept out of the part that must be certain, which is the same pattern showing up wherever software is given real authority. When an agent can act on a business system, the useful question stops being what it can do and becomes what it was allowed to do, and whether anyone can reconstruct that afterward.

What has not been decided

Almost everything, and this is where the coverage tends to get ahead of the record.

NPCI has published no specification. Choudhary described examining protocols, which is a live process rather than a shipped design. Business Standard reported in July, and Reuters in September, that NPCI is building a Unified Agent Protocol to register and verify AI agents, each citing unnamed people familiar with the work rather than an NPCI document. Reporting also indicates any launch would need approval from the Reserve Bank of India. Treat all of that as reported, not confirmed.

The unresolved parts are the ones that decide whether this works. Nobody has said where liability sits when an agent transacts inside its mandate but against the user's interest, which is a genuinely hard case because no rule was broken. Per-transaction and cumulative limits for agent-initiated payments have not been published. Whether registration would be open to any developer or restricted to regulated entities is unknown. Whether the specification gets published for public comment before going live is unknown.

India also does not yet have binding rules here. The Reserve Bank's FREE-AI committee recommendations are not binding, and CERT-In has proposed human checks above certain financial thresholds rather than imposed them. Choudhary was setting a design constraint in advance of a rule, which is a reasonable thing for a chairman to do and is not the same as a rule existing.

The objections

A keynote is not policy. Choudhary is a non-executive chairman speaking at a conference, and the distance between that and a published specification with a rollout date is considerable.

The separation he describes may also prove harder than it sounds. If an agent selects the merchant, the amount and the timing, and the rail only checks that those fall inside a mandate the user granted months earlier, then the agent has shaped the outcome even though it never approved anything. Determinism at the authorisation step does not make the decision behind it any less probabilistic.

There is a commercial tension too. At the same event, Amazon Pay launched a consent-based wallet for agentic UPI payments without saying whether third-party agents can be authorised on it. Choudhary said interoperability must remain non-negotiable and warned against new walled gardens. Those two things are not obviously compatible, and the gap between them is where this actually gets decided.

What I would watch

Not the protocol announcement. The limits.

Whatever specification eventually appears, the substantive content will be the ceiling on what an agent can commit without a human, how a mandate can be revoked, and who absorbs the loss when an agent stays inside its authority and still produces a bad outcome. Those numbers and rules are the actual policy. Everything else is framing.

If an agent can decide what to buy but never decide that money moves, how much authority has it really been given?