Give the agent restricted gateway credentials covering only the actions you approve: look up payments, send payment links from templates, void uncaptured authorisations, and refund to the original payment method within limits. Hold larger refunds for a named person. Keep payout settings, keys and webhook configuration out of reach, and log every call with its idempotency key and verdict.
What does the connection involve, and who owns it?
A payment gateway takes card and account payments for a business: it authorises, captures, refunds and settles, and reports disputes. Connecting an agent lets customer service resolve payment questions and refunds without waiting for a finance team. It also gives the agent a direct line to money leaving the business.
The head of payments owns the connection. Finance owns refund limits. Fraud owns the rules that hold refunds. The integration team owns keys and the route. For banks and fintechs, our guide to AI agents in banking sets the wider limits.
Which permissions should you grant, and at what depth?
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Look up a payment | Reads status, amount, method, last four digits | 1 | Nothing |
| Send a payment link | Sends from approved templates, for an amount already owed | 3 | Links for amounts not on an invoice or order |
| Void an uncaptured authorisation | Releases a hold the customer should not carry | 3 | Nothing within bounds |
| Refund to original method | Refunds within per-refund and daily limits | 4 | Refunds above limits |
| Refund elsewhere | Not available | refused | Finance, after verification |
| Respond to a dispute | Drafts evidence for the response | 2 | Payments team submits |
| Change payout settings, keys or webhooks | Not available | withheld | Administrators only |
Refunds get their own playbook: letting an AI agent issue refunds through your payment gateway.
How do you connect it, step by step?
- Person, head of payments: approves the capability list. Evidence: approved list with depths.
- Integration team: creates a restricted key. Most gateways allow keys limited to certain operations. Use one with only the approved operations, kept behind your own gateway or policy layer so the agent never holds it. Evidence: key scope and storage location.
- Person, finance: sets refund limits. Per refund, per customer per period, per day across the agent. Evidence: limits as versioned bounds.
- Person, fraud: sets hold rules. Refunds on payments disputed or flagged; refunds shortly after a change of email or address; several refunds to one customer in a short period. Evidence: rules as bounds.
- Platform, on each call: checks the minimum chain. Capability in scope, certificate, sources, limits including running totals, platform guardrails. Evidence: verdict per call.
- Integration team: requires an idempotency key on every write. A retried refund must not pay twice. Evidence: key on each write.
- Integration team: treats gateway webhooks as sources. A webhook whose signature is verified is signed; one that is not verified is external and cannot trigger a refund. Evidence: signature check result per event.
- Integration team: wires revocation. Disable the key or one capability in one step. Evidence: drill results.
Which controls matter, and what is recorded?
Refunds to the original method only. A request to refund to a different card or account is a payee change and goes to finance. Evidence: refused verdicts on attempts.
Running totals. Limits count refunds already made that day, by people too. Evidence: totals on each verdict.
Idempotency. Evidence: no duplicate refunds for one key.
Refunds are not reversals. A refund sends new money back; a reversal undoes the original transaction, often only before settlement. The difference is explained in what a payment reversal is, and whether an agent should attempt one in whether an AI agent can reverse a payment. Evidence: separate capabilities for each.
Policy layer in front of the gateway. The payment gateway processes what it is sent; it does not judge whether a refund is justified. That judgement sits with the bounds checked before the call. The distinction is the same one drawn in whether an agentic operating system is the same as an AI gateway. Evidence: every gateway write carries a verdict reference.
Full log. Call, key, amount, payment reference, verdict, gateway response. Evidence: the record.
What should you measure?
- Refunds by value and count per day, against limits.
- Held refunds, by rule, and how many a person approved.
- Duplicate attempts blocked by idempotency. Many attempts suggest timeouts or loops.
- Disputes on payments the agent refunded. A customer who gets a refund and also wins a dispute has been paid twice.
- Payment links sent and paid.
- Refunds by reason code, to see whether goodwill is crowding out error correction.
Where does it usually go wrong?
The agent gets the full secret key. It can do anything the business can, including changing where payouts go.
Refunds and disputes collide. The agent refunds a payment already under dispute. Check dispute status before every refund.
Webhooks are trusted blindly. A forged "payment failed" event triggers a re-send or refund. Verify signatures.
Partial refunds add up. Several small refunds on one order exceed the original amount. Cap total refunds per payment at the captured amount.
Refund reasons are free text. Without a reason code on each refund, finance cannot tell goodwill from error from fraud, and limits cannot differ by reason. Make the reason a required field the platform checks.
Collections and gateway rights are mixed. An agent chasing arrears should send payment links, not take card details or refund. The collections side is covered in connecting an agent to your collections system.
Questions people ask
Can the agent capture a payment?
Where your process authorises first and captures later, capture can be a depth 3 capability for amounts matching a confirmed order. Capturing more than the order is refused.
Should the agent handle card details?
No. Payment links and hosted pages keep card data with the gateway. The agent should see only references and the last four digits.
Who approves a refund above the limit?
A named person in finance or customer service with their own refund authority, set in advance. The platform checks that authority when they approve.