We are entering the era of Agentic AI. In 2024, we marveled that an AI could write a poem. In 2026, we expect it to book a flight, order groceries, and negotiate a refund.
But there is a dangerous architectural gap between an AI that talks and an AI that transacts.
Language models are probabilistic—they are designed to retry, iterate, and guess. Payment ledgers are deterministic—they require exactness, finality, and single execution.
When you connect a stochastic agent to a deterministic bank, you run into what I call the Idempotency Paradox: The smarter the agent, the more likely it is to accidentally drain a user’s wallet.
Here is why this happens, and the architectural pattern we need to solve it.
Disclaimer: The views, thoughts, and architectural patterns expressed in this article are my own and do not necessarily reflect the official policy, roadmap, or position of Google (Alphabet Inc.). All examples and concepts discussed are based on publicly available information and general engineering principles. This article was drafted with the assistance of AI tools for editing and structure.
The "Double-Click" Problem on Steroids
In the Web 2.0 world, we solved duplicate transactions with simple frontend logic. When a user clicked "Buy," we disabled the button. If the network timed out, the browser might send a retry, but the backend used a simple session_id or deduplication_key to reject the second request.
AI Agents do not have "buttons." They run in loops (e.g., ReAct loops: Reason, Act, Observe).
If an agent sends a payment request to an API and doesn't get a response in 200ms, it doesn't just wait. It "thinks." It might decide: "The API failed. I should retry." Or worse: "Maybe I used the wrong parameter. I will try again with a slightly different payload."
To a standard payment gateway, these look like two distinct valid requests. The result? The user gets charged twice for the same pair of shoes.
The Solution: Semantic Idempotency
Standard idempotency keys (usually random UUIDs) are insufficient for agents because the agent might generate a new key for the same intent.
To fix this, we need to move from Technical Idempotency to Semantic Idempotency.
Instead of relying on a random string passed by the client, the infrastructure itself must generate a lock based on the intent of the transaction. We can achieve this by hashing the core parameters of the user's goal.
The Formula: Intent Hashing
Before processing any transaction from an AI agent, the ledger should generate a hash:
Intent_Hash = SHA256(User_ID + Merchant_ID + Amount_Cap + Item_SKU + Time_Window_10min)
If the agent retries the request—even if it changes the phrasing or the API headers—the core intent parameters remain the same. The infrastructure sees the matching hash, realizes a transaction is already in flight, and returns the existing status instead of initiating a new charge.
The Protocol: Check-Lock-Act
For "Agentic Commerce" to be safe, we must abandon the "Fire and Forget" API model. We need a stateful Check-Lock-Act protocol:
- Propose (The Check): The Agent sends a "Proposal" to the Ledger (e.g., "I want to buy these shoes for $100").
- Lock (The Guardrail): The Ledger calculates the Intent_Hash. If it’s new, it creates a Pending State and locks the funds. It returns a Commit_Token to the Agent.
- Execute (The Act): The Agent must sign the Commit_Token to finalize the purchase.
If the Agent crashes, retries, or hallucinates in step 3, the Ledger simply checks the Intent_Hash. It sees the funds are already locked and returns the previous Commit_Token. The state machine prevents double-spending.
Conclusion: Dumb Pipes for Smart Agents
The excitement in AI right now is about making models "smarter." But in Fintech, our job is different.
To enable the Agentic future, we don't need smarter payments. We need stricter payments. We need infrastructure that acts as a "Stateful Firewall," protecting the user's bank account from the enthusiasm of their own AI assistant.
The future of commerce isn't just about the AI that asks for the product; it's about the infrastructure that knows when to say "You already bought that."