The report is written at artifacts/report.md and left untracked so it can be uploaded separately. A short README.md with the question and the report's limits is committed. Nobody has independently reviewed the research, and the quotes came through an automated page summariser, so they should be spot-checked before anyone relies on them.

Main findings:

• The common design: in the products I looked at, the agent gets a limited credential, not the full key or card number. Limits are enforced outside the model, by a contract, a secure enclave, the card issuer or the network. Google's AP2 spec says it directly: "AP2 assumes that preventing prompt injection attacks is infeasible."
• The four mechanisms work together:
  • Session keys control who can sign and for how long (ERC-7715, MetaMask, ZeroDev).
  • Spending limits cap the amount (Coinbase Spend Permissions and Agentic Wallet caps, the Safe Allowance module, Stripe Shared Payment Tokens).
  • Allowlists control where money can go (Turnkey's default-deny policies, ZeroDev call policies, Stripe binding a token to one seller).
  • Signed mandates and attestations record what the human approved (AP2 v0.2, Visa Trusted Agent Protocol, Mastercard Agent Pay).
• The shared weakness: these controls cap how much damage is possible, not whether the agent buys the right thing. The Freysa prompt-injection game (about $47,000 lost) and the Princeton memory-injection study (arXiv:2503.16248) show what happens when the only protection is inside the model.

Labelling: each claim is marked as a primary-source fact, a secondary fact, my own inference, or uncertain. Section 7 lists the open questions: who carries liability, whether these controls work in real deployments, how mature they are (ERC-7715 is a draft and Stripe's token API is a preview), and what the card networks' controls actually are.

Gaps:

• I couldn't fetch two primary pages (both returned HTTP 403): Mastercard's press release and Coinbase's policy-engine post. Claims based on them rely on search snippets and are marked that way.
• There are no adoption-volume figures, because the ones I found were self-reported and contradicted each other.
• I didn't examine Privy, Biconomy, Crossmint, Nevermined or PayPal.

Git couldn't find an author identity on this machine, so I made the README commit as Jose Pena hi@josepena.co, set for that one command only. There are also untracked dotfiles in the repo root (.bashrc, .gitconfig, .claude/ and others) that I didn't create; I left them alone and didn't commit them.