Share

The Chargeback Lens

Who Pays to Unwind It

By Sevda Polat— July 23, 2026

Feature image for article: Who Pays to Unwind It

Visa's rules now define agentic transactions and hold cardholders responsible for what their agents do. Real agents are completing real purchases in European commerce. Real disputes will follow. But the existing reason codes have no category for "the agent interpreted my intent and got it wrong." Payments will absorb this; the institutional machinery there is already thick enough. The more revealing problem lives everywhere else agents act on delegated authority: code review, support resolution, content generation. None of these domains have what makes a chargeback structurally powerful. Not the ability to contest an outcome, but the part where someone pays.

The Chargeback Lens

Who Pays to Unwind It

By Sevda Polat— July 23, 2026

Visa's rules now define agentic transactions and hold cardholders responsible for what their agents do. Real agents are completing real purchases in European commerce. Real disputes will follow. But the existing reason codes have no category for "the agent interpreted my intent and got it wrong." Payments will absorb this; the institutional machinery there is already thick enough. The more revealing problem lives everywhere else agents act on delegated authority: code review, support resolution, content generation. None of these domains have what makes a chargeback structurally powerful. Not the ability to contest an outcome, but the part where someone pays.

What's the Chargeback?

Chargebacks. Git reverts. Escalation queues. Admin approvals. Analyst dismissals. Every domain deploying agents has borrowed some existing mechanism for pushing back when things go wrong. They're holding up better than you'd expect.

The harder problem is the one agents uniquely introduce: an action that was authorized, executed correctly, and still wrong. Someone delegated authority, the agent exercised it faithfully, and the result doesn't match what anyone actually wanted. Across six domains, the same gap keeps surfacing. Contestation infrastructure handles execution failures reasonably well. What nobody has built yet is a structured way to challenge the mandate itself.

What's the Chargeback?

Chargebacks. Git reverts. Escalation queues. Admin approvals. Analyst dismissals. Every domain deploying agents has borrowed some existing mechanism for pushing back when things go wrong. They're holding up better than you'd expect.

The harder problem is the one agents uniquely introduce: an action that was authorized, executed correctly, and still wrong. Someone delegated authority, the agent exercised it faithfully, and the result doesn't match what anyone actually wanted. Across six domains, the same gap keeps surfacing. Contestation infrastructure handles execution failures reasonably well. What nobody has built yet is a structured way to challenge the mandate itself.

Agentic Payments

Chargebacks Exist but Agent Dispute Categories Don't

Visa's Trusted Agent Protocol and Payment Passkeys authenticate agentic transactions across 30+ European issuers, with spending limits and approved-merchant controls. Chargebacks still work. But public dispute tables from neither Visa nor Mastercard yet contain agent-specific reason codes or mandate evidence schemas for challenging a delegated purchase decision.

AI Coding

Merged PRs Proxy Throughput, Not Alignment With Intent

A Microsoft study found coding-agent adopters merged 24% more pull requests over four months. Git revert, CI gates, and code review provide structural contestation. But merged-PR volume says nothing about whether commits matched developer intent, and the reviewer burden from multiplied agent output remains entirely unpriced.

Customer Support

Escalation Works Live but Breaks After Ticket Close

Nubank's production agents use audit trails, idempotent APIs, and human escalation as live contestation paths, reporting a 37-point NPS lift. Once a ticket closes, though, tracing which agent decision caused dissatisfaction gets murky fast. Feedback arrives long after the causal chain has collapsed into execution logs.

Web Access

Blocking Future Crawls Doesn't Undo Past Content Consumption

Cloudflare's purpose-based categories let site owners block or allow agent crawlers, with dashboards tracking crawl-to-referral ratios. Useful going forward. But no structured process exists for disputing content already consumed. Over a third of crawler traffic still comes from mixed-use bots that resist clean purpose classification.

Enterprise Tools

Approval Logs Record Permissions, Not the Agent's Mandate

Microsoft Agent 365 offers connector registries, admin approval workflows, tool-level blocking, and unified audit logs covering activations and invocations. Thorough stuff. But the records capture what was permitted at the server level, not what the agent was asked to do. Mandate and scope go unrecorded.

Security Operations

False Positive Costs Land on Analysts, Not Agents

Microsoft's threat detection agent reports 80.1% precision after 120 days of analyst feedback. Analyst dismissal is the contestation mechanism. Sounds reasonable until you do the math: one in five flagged alerts is wrong, and the investigation cost per false positive falls entirely on the SOC. Agent performance metrics don't account for it.

Records, Not Replays

Observability for Delegated Execution in Agentic AI Systems

Identical audit logs and execution traces can arise from incompatible delegation assignments. Current observability schemas carry no record of whose mandate an action served or what constraints accompanied it, leaving contestation structurally unsupported.

Where's the gap?

Not in logging volume. Current schemas simply don't encode delegation scope, so contestation has no semantic foundation to build on.

Who's behind this?

Researchers from Splunk and Cisco, practitioners working inside the observability infrastructure where this absence actually lives.

An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios

No tested agent achieved both fully correct and fully safe execution across 12 realistic, non-adversarial tasks. Successful completion routinely coincided with data-handling failures during ordinary operation, not under attack conditions.

Why should builders care?

Task success and data safety vary independently. An agent can finish the job while violating every constraint a mandate record would carry.

Who ran this evaluation?

The Singapore and Korea AI Safety Institutes jointly, lending the findings cross-jurisdictional institutional weight.

Records, Not Replays

Observability for Delegated Execution in Agentic AI Systems

Identical audit logs and execution traces can arise from incompatible delegation assignments. Current observability schemas carry no record of whose mandate an action served or what constraints accompanied it, leaving contestation structurally unsupported.

Where's the gap?

Not in logging volume. Current schemas simply don't encode delegation scope, so contestation has no semantic foundation to build on.

Who's behind this?

Researchers from Splunk and Cisco, practitioners working inside the observability infrastructure where this absence actually lives.

Records, Not Replays

An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios

No tested agent achieved both fully correct and fully safe execution across 12 realistic, non-adversarial tasks. Successful completion routinely coincided with data-handling failures during ordinary operation, not under attack conditions.

Why should builders care?

Task success and data safety vary independently. An agent can finish the job while violating every constraint a mandate record would carry.

Who ran this evaluation?

The Singapore and Korea AI Safety Institutes jointly, lending the findings cross-jurisdictional institutional weight.

First Disputes

When the First Agent Purchase Gets Disputed

Visa's July 2 announcement wasn't a pilot. AI agents completed purchases with independent European merchants, authenticated by Payment Passkeys, recognized through a Trusted Agent Protocol and Agent Directory. Over 30 issuers. Four merchants spanning travel, retail, and e-commerce. Live transactions, not controlled demos.

So the infrastructure for making agent purchases is arriving faster than the infrastructure for contesting them.

Today's chargeback process asks a binary question: did the cardholder authorize this transaction? Agentic commerce produces a harder case. The account was valid. The spending limit held. The merchant processed correctly. But the agent booked the wrong flight, interpreting "under $500 at travel merchants" in a way the user didn't intend. Both ends of the transaction look right, and something in the middle went wrong.

Resolving that requires evidence the dispute system doesn't yet collect: what the user actually asked for, how the agent interpreted the constraints, why it chose this option over that one. Visa's rules already require "cardholder-defined payment instructions" and 120-day order confirmation retention. Those preserve what was processed. They don't preserve the reasoning that got there. No public agent-specific dispute code exists in either major network's current guides.

Lastminute.com's CEO called it "early days." He's right, and the specifics of what comes next matter enormously. The mandate, the constraint interpretation, the decision trace: these are where contestability stops being an abstract design principle and starts costing someone real money.

First Disputes

When the First Agent Purchase Gets Disputed

Visa's July 2 announcement wasn't a pilot. AI agents completed purchases with independent European merchants, authenticated by Payment Passkeys, recognized through a Trusted Agent Protocol and Agent Directory. Over 30 issuers. Four merchants spanning travel, retail, and e-commerce. Live transactions, not controlled demos.

So the infrastructure for making agent purchases is arriving faster than the infrastructure for contesting them.

Today's chargeback process asks a binary question: did the cardholder authorize this transaction? Agentic commerce produces a harder case. The account was valid. The spending limit held. The merchant processed correctly. But the agent booked the wrong flight, interpreting "under $500 at travel merchants" in a way the user didn't intend. Both ends of the transaction look right, and something in the middle went wrong.

Resolving that requires evidence the dispute system doesn't yet collect: what the user actually asked for, how the agent interpreted the constraints, why it chose this option over that one. Visa's rules already require "cardholder-defined payment instructions" and 120-day order confirmation retention. Those preserve what was processed. They don't preserve the reasoning that got there. No public agent-specific dispute code exists in either major network's current guides.

Lastminute.com's CEO called it "early days." He's right, and the specifics of what comes next matter enormously. The mandate, the constraint interpretation, the decision trace: these are where contestability stops being an abstract design principle and starts costing someone real money.

What's live: 30+ European issuers (including Barclays, BBVA, ING, Revolut, Klarna, Lloyds) transacting with lastminute.com, Frasers, Cleverbridge, and BrickDepot

Authentication: Visa Payment Passkeys meeting EU Strong Customer Authentication requirements

Agent identity: Trusted Agent Protocol + Agent Directory give merchants a consistent signal to distinguish verified AI agents from unverified traffic

User controls (via OpenAI partnership): Spending limits, merchant categories, required approvals, tokenized credentials, real-time fraud monitoring

What Visa's rules require: Defined payment instructions, identity verification, cardholder responsibility acknowledgment, 120-day order confirmation retention

What's missing from public dispute guides:

No agent-specific reason code (Visa or Mastercard)
No mandate-content field in dispute files
No constraint-interpretation evidence category
No decision-trace representment standard

The liability clause to watch: Visa's rules state the cardholder is responsible for agent actions "as if the cardholder initiated the transaction," while simultaneously requiring defined instructions and controls

Market Pulse

Market Pulse

Who Pays to Unwind It

Who Pays to Unwind It

Observability for Delegated Execution in Agentic AI Systems

An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios

Observability for Delegated Execution in Agentic AI Systems

An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios