• PYMNTS reports that Paymentology CTO Tim Joslyn frames agent autonomy as earned through evidence, in the manner of an underwriting process.
• The interview describes reversibility, not complexity, as the test for how much to automate; hard-to-reverse actions are likelier to keep a human approver.
• Shadow mode, where an agent records decisions without executing them, lets firms compare agent and human outcomes before widening authority.
• Joslyn sees liability for a bad agent payment as unsettled and estimated roughly six to 12 months to work it through; that is his estimate, not a rule.
• Google's AP2 protocol describes cryptographically signed, tamper-evident mandates as one way to record what an agent was authorized to do.

Paymentology says AI agents should earn the right to move money in stages, according to an October 13, 2026 PYMNTS interview with its chief technology officer, Tim Joslyn. The framing adds a question to payments infrastructure: even when the machine is legitimate, was it allowed to make this payment? Liability for bad agent payments, the interview indicates, remains open.

Autonomy is earned like credit

PYMNTS reports Joslyn framing agent autonomy as something built on evidence, in the manner of an underwriting process, rather than granted because a model appears accurate. The practical tool described is shadow mode, in which an agent records the decisions it would make without executing them, so they can be compared with human outcomes before authority widens. That turns trust from a vendor claim into measured performance.

Reversibility draws the human line

The interview describes reversibility, rather than complexity, as the test for how much to automate. Errors that can be unwound, such as in fraud decisions, are easier to hand to machines; large or hard-to-reverse actions are likelier to keep a human approver. For operators, the implication is that the harder money is to recall, the later an agent should earn unattended authority. That is our reading of the principle, not a quoted rule.

Vague instructions are where disputes start

Joslyn contrasts a clear instruction, sending someone $100, with a vague one such as buying a red jumper, where details like price, size and merchant are left open. The agent must then ask questions or infer intent. Each inferred parameter is a possible point of dispute, so the quality of the captured instruction matters alongside the agent's accuracy. This is our analysis of the contrast he draws.

Liability has no settled owner

PYMNTS reports that Joslyn sees technology moving faster than the frameworks for assigning liability, with no settled answer on whether the programmer, the instructing person, the agent deployer or another party is responsible for a bad payment. He estimated the question would take roughly six to 12 months to work through. That is his estimate, not a regulatory timetable, and no rule is cited.

Signed mandates are one emerging approach

Google's AP2, the Agent Payments Protocol, is one public attempt to record what an agent was authorized to do. Its site describes cryptographically signed, tamper-evident mandates, including a Checkout Mandate and a Payment Mandate, each with open and closed stages. We have not seen Paymentology tie its approach to AP2; the link here is ours, offered as an example of mandate evidence.

What to watch, in our analysis: whether issuers and processors begin logging mandate evidence alongside authorization data, and whether dispute rules assign agent-initiated liability explicitly. Teams piloting agents could start in shadow mode and keep the captured instruction as the record of what was allowed.