圖解如何安全地為 AI 智能體提供虛擬卡
Giving AI agents a wallet, safely: virtual cards explained in pictures
AI 智能體可透過專屬虛擬卡完成付款，毋須交出公司的卡。付款依次經過政策檢查、付款、批准及結算，之後卡片失效；每筆付款須通過五項檢查。智能體取得的 token 只適用於指定智能體、商戶及時段，並可透過 API 或 MCP 工具呼叫付款功能。
AI agents can find the best cloud server or SaaS plan. Then they get stuck, because they can't pay. Here's the safe way to fix that, mostly in pictures.
1. Don't hand over the company card
An agent card is a virtual card made for one agent and one job.
2. How it works
Ask → check policy → pay → approve → settle. Then the card dies.
3. For developers, it's one tool call
The agent can call this through an API or an MCP tool, like any other tool.
4. Every payment passes five checks
The rules live on the card, not in the prompt. A confused or prompt-injected agent still can't break them.
5. The agent never sees your real card number
It gets a token that only works for that agent, that merchant and that time window.
6. Five layers of safety
7. Two ways to build it
8. Where to start
An agent with no card can only make suggestions. An agent with the company card is a risk. A scoped, short-lived, tokenized card lets agents finish the job while finance stays in control.
Further reading
- Virtual cards for AI agents (Ramp)
- Visa Intelligent Commerce (Visa Developer)
- Mastercard Agent Pay discussion (Checkout.com)
Building agents that need to pay for things? I'd love to hear how you're handling it in the comments.
來源：DEV Community · dev.to