The Machine Drafts, the Human Signs

This week in one sentence: AI took over work in shopping, lending and disputes this week, but every figure we have is the institutions' own statement and none measures customer outcomes independently. Evidence maturity: EARLY SIGNAL.

Three questions make this week easier to read. What is actually happening beneath the headlines? Why are so many institutions releasing the same kind of figure in the same week? And when work speeds up and something goes wrong, who pays?

IThe authority you give your agent

The development that touches consumers most directly came from Walmart. Walmart opened a service called Agent Gateway. The service lets approved AI agents search and buy on a user's behalf. TechCrunch reported it from Walmart CEO John Furner's remarks at the Masters of Scale summit.

For consumers, the real change comes in about a month. Each agent will have its own profile in the customer's account. The user will either require approval for every purchase or give the agent a spending limit they set themselves. Walmart compares this to adding an authorized user to a credit card. Under the reported rules, the agent cannot access payment details, cannot go beyond the user's request, and will be blocked if it breaks the rules. Walmart's returns process will apply even when an agent does not act as intended.

In September Amazon blocked agents from shopping on its site. Walmart is opening the door, but with approvals and spending limits. So the real question in agentic shopping is not whether the technology is ready. It is who draws the limits of the agent's authority. For now we have an announcement, not usage data. Walmart has not said how many people use the gateway, or whether users approve every order or set a limit and step back.

IIYour dispute closes in three days. What about the outcome?

For a customer disputing an unfamiliar charge on a card statement, Bank of Ireland's statement is concrete. By the bank's own account, more than four in five disputes now close within three days. The bank gave two more figures. One tool identified €55 million in potential tax refunds for customers. Fraud detection screens about 2.9 million transactions a day.

Two distinctions matter when reading these figures. The €55 million is not an amount paid out; it is an identified possibility. The bank also did not say how many of the disputes closed in three days were resolved in the customer's favour. Speed may be good news for the customer. But no data shows that a case closed quickly was closed correctly.

IIIAt the credit desk, the machine drafts

The most striking figure for business owners came from TD. The bank said it now prepares the first draft of a commercial credit analysis in "under 30 minutes". This used to take "up to three business days". The tool doing the work is TD Credit Assist.

People still review the draft. TD has more than 300 credit specialists, and this team writes more than 10,000 credit memos a year. In the segments assessed, 95 per cent of drafts passed expert review. This is not an accuracy rate; it is a review pass rate. The measurement is also the bank's own.

Customers Bank said it closed selected commercial loans in seven days. The typical time is 30 to 60 days. The bank also said its staff saved an estimated 76,000 hours and that more than $15 million a year in capacity was created. This is not a saving; it is a capacity estimate.

Two more announcements point the same way. Santander cut the cost per interaction from about €5 to €0.03 in experimental uses. Emirates NBD announced that it will run OpenAI models on in-country infrastructure in the United Arab Emirates. It will be the first bank in the MENA region to do so.

In TD's case the work is clearly split: the machine prepares the draft and the human makes the decision. This arrangement has a risk too. If 95 per cent of drafts pass review, specialists may start reading them less carefully over time. This is our hypothesis. None of the figures released this week measures how carefully a specialist reviews a draft.

IVWhen an agent makes the payment

In business-to-business payments, this week's most concrete step came from Visa, BILL and Billtrust. The three companies launched the first live pilot. In the pilot, a payment agent pays a supplier invoice that the buyer has approved. The payment is made with tokenized card credentials. The agent does not need to log in to the supplier portal with a password. The number of transactions was not disclosed.

Asia is preparing in a similar way. The central banks of Malaysia and Thailand joined the Monetary Authority of Singapore's BLOOM initiative. The initiative will develop common approaches for tokenized deposits and regulated stablecoins. Agentic payments are also in scope. So money is not yet moving between the three countries through these channels. For now they are working together on how to do it.

VThe rule for the money layer is written; it takes effect in January

In the money layer that agents and banks will use, the United States took a decisive step. The OCC, which supervises US national banks, published the final rule under the GENIUS Act. Under the rule, companies issuing payment stablecoins must hold one dollar in reserve for every one-dollar token in circulation. When a user asks for their money back, the company must pay it within two business days. The rule is final, but it takes effect on 18 January 2027; it is not in force today. For an individual holding stablecoins, this means that from that date the reserve and redemption standard gains legal backing.

The products, meanwhile, are live before the rule. J.P. Morgan opened JPM Coin, its USD deposit token, to institutional clients on Ethereum. The token was previously used on Base. J.P. Morgan Asset Management also offered tokenized money market funds on Solana to qualified investors. Neither is open to individuals, and both are the bank's own statements. The $7 billion a day that J.P. Morgan cites is the average for the whole Kinexys platform, not for JPM Coin.

VISpeed and supervision: a $350 million reminder

The American Express penalty we covered in W41 appeared again on the OCC's list this week. On 8 October the OCC fined American Express National Bank $350 million. The reason was deficiencies in its anti-money laundering programme.

This penalty has nothing to do with AI. Nor is the penalized bank one of the banks mentioned above.

So why put this news in the same piece? Because both stories look at the same question. Banks say they are speeding up their work, but speed does not show that controls are good. Supervision reveals how well a bank runs its controls. The bank's own statement does not. We are the ones drawing this connection; it is a CalibrateAtlas interpretation.

VIIWhat the evidence says, and what is missing

CalibrateAtlas's payments infrastructure thesis neither strengthened nor weakened this week. JPM Coin's move to Ethereum is an important step. But the usage data the thesis needs is missing; we only know the product went live. The GENIUS rule and the BLOOM expansion were recorded as candidate evidence on the standards side.

What is missing is a longer list. None of the efficiency figures was independently verified. Customer outcomes such as approval rates, dispute results or errors were not disclosed. There is no transaction count for the agent pilot. We could not verify claims that banks had detected unauthorized AI agents in customer accounts; so we do not report them.

In the coming weeks we will watch three questions. Will TD or Customers Bank disclose errors or customer outcomes next quarter? Will the Visa–BILL pilot release its first transaction count? When Walmart's agent profiles go live, will users choose approvals or spending limits? The only firm date on the calendar is 18 January 2027, when the GENIUS rule takes effect. The machine drafts, the human signs. The real question is how carefully the person signing draws the limit. Evidence maturity: EARLY SIGNAL.