AI agents can act for users, but payments still require clear answers on identity, authorization, compliance, revocation, and liability.