Issuing for Agents
Equip autonomous AI agents, LLM worker swarms, and robotic process automation (RPA) pipelines with programmable financial agency. Provision ephemeral single-task virtual cards on the fly, enforce hard per-task budget limits, constrain merchant endpoints, and terminate cards automatically upon task completion.
System Architecture & Flow
Agent receives prompt to purchase server infrastructure or external API credits.
Rook API issues single-task card with exact max budget and single-authorization rule.
Transaction permitted only if merchant matches approved vendor (e.g. AWS or GitHub).
Card terminates instantly after execution, logging cryptographic audit trace.
1Generate Ephemeral Single-Task Virtual Card
Create an ephemeral card scoped to the AI agent runtime. Set a rigid budget ceiling, single transaction limit, and strict merchant domain allowlist.
curl -X POST "https://api.sandbox.rookpayments.com/v1/agent-cards" \
-H "Authorization: Bearer rk_test_..." \
-H "X-Program-ID: 7c9e6679-7425-40de-944b-e07fc1f90ae7" \
-H "Content-Type: application/json" \
-d '{
"account_id": "acc_agent_fleet_01",
"agent_identifier": "agent_devops_deployer_v4",
"spending_limits": [
{ "amount": 2500, "interval": "per_authorization" }
],
"controls": {
"max_authorizations": 1,
"allowed_merchants": ["Amazon Web Services", "Anthropic", "Cloudflare"],
"allowed_mccs": ["5734", "7372"],
"ttl_seconds": 600
},
"metadata": {
"prompt_hash": "sha256_e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"workflow_id": "wf_build_server_8812"
}
}'2Evaluate Real-Time Guardrail Webhook
When the agent triggers checkout, Rook verifies that the agent's task state is still running and that merchant name and MCC correspond with prompt context.
{
"event_id": "evt_agent_99182",
"type": "agent.authorization.request",
"data": {
"card_id": "crd_agnt_8812",
"agent_identifier": "agent_devops_deployer_v4",
"amount": 1850,
"currency": "USD",
"merchant": {
"name": "CLOUDFLARE INC",
"mcc": "7372",
"country": "USA"
},
"guardrails_evaluated": {
"within_budget": true,
"merchant_approved": true,
"ttl_valid": true
}
}
}3Terminate Card & Record Cryptographic Audit Trail
The moment authorization succeeds or the agent completes the prompt task, the card is destroyed. Zero residual card details can be exfiltrated or abused.
curl -X POST "https://api.sandbox.rookpayments.com/v1/agent-cards/crd_agnt_8812/terminate" \
-H "Authorization: Bearer rk_test_..." \
-H "Content-Type: application/json" \
-d '{
"reason": "task_completed",
"task_result": "success",
"audit_signature": "sig_ed25519_88f91a0c..."
}'