AI Agent Payments: Visa's Live Pilot Pays Approved Invoices End-to-End

On Tuesday, October 20, 2026, Visa, BILL and Billtrust launched a live pilot in which an authenticated AI agent initiates and completes buyer-approved card payments for specific invoices through supplier portals. The companies describe it as the first live pilot of its kind between buyer and supplier platforms, and say it is already processing end-to-end transactions with participating customers. The agent does not decide which invoices to pay. It executes payments the buyer has already approved, within controls the buyer set. The narrow scope is the point: this separates payment execution from payment judgment.

Key takeaways

• The pilot is live, with a narrow job. The companies say the pilot is processing end-to-end transactions between participating BILL buyers and Billtrust suppliers: the agent completes an approved invoice payment; it does not select the invoice or set the amount, per Visa, BILL and Billtrust Launch First Live Pilot for Trusted AI Agent Payments Between Buyer and Supplier Platforms.
• Authentication was a central barrier. Supplier portals relied on human authentication and bot-blocking checks that stopped approved payments from being automated, per Visa Launches Agentic Payments Pilot With BILL and Billtrust.
• The pilot's approach is identity plus tokenized credentials, not shared logins. The BILL Payment Agent is registered through Visa's Trusted Agent Protocol and Agentic Directory and pays with tokenized credentials tied to the buyer's approved instructions, per Visa, BILL and Billtrust Launch First Live Pilot for Trusted AI Agent Payments Between Buyer and Supplier Platforms.
• A second network is testing a different entry point. Mastercard opened early developer access to Agent Pay for Machines on October 20, with spending limits set in advance and a demo agent making nine payments to two merchants from one approved budget, per Mastercard opens early access to AI agent payments at Cloudflare Connect.

Why accounts payable automation stops at the portal

In many accounts payable workflows, the automation stops one step early. An invoice is reviewed and approved — and then a person opens a supplier portal, logs in, and keys in payment details by hand. That final step survived automation because portals were built to keep bots out: human logins, CAPTCHA checks, and other bot-blocking mechanisms treat an automated payer as a threat, not a customer, per Visa, BILL and Billtrust Launch AI Agent Pilot for B2B Invoice Payments.

The result is a split inside finance teams. The judgment work — deciding whether an invoice is valid and should be paid — is already governed by approvals and controls. The mechanical work that follows still consumes staff time, portal by portal, because the receiving system has no reliable way to tell an authorized agent from an unknown bot. Visa frames the pilot directly against that problem: businesses should not have to choose between automation and control when making payments, per Visa, BILL and Billtrust Launch First Live Pilot for Trusted AI Agent Payments Between Buyer and Supplier Platforms.

BILL brings the buyer side: nearly 500,000 businesses use its platform — that is platform scale, not pilot participation, per the same announcement. Billtrust brings the supplier side, describing a buyer network of more than 20 million buyers and $1 trillion in annual trade credit volume, per Visa, BILL and Billtrust Launch First Live Pilot for Trusted AI Agent Payments Between Buyer and Supplier Platforms. The pilot itself names participating buyers and suppliers without publishing transaction counts, completion rates, or error rates — so treat the scale figures as context, not evidence about the pilot.

How the trusted agent flow works

The sequence is deliberately narrow. The flow starts with the buyer's approved payment instruction. The BILL Payment Agent — registered using Visa's Trusted Agent Protocol and Agentic Directory — uses tokenized payment credentials, with controls aligned to that instruction, to initiate a card payment for that specific invoice, supported by the Visa Intelligent Commerce portfolio, per Visa Launches Agentic Payments Pilot With BILL and Billtrust. The announcement documents the approved instruction and the agent's execution of it; it does not document the buyer's internal approval interface or configuration steps.

On the receiving side, Billtrust uses the same protocol to recognize, authenticate, and grant access to the authorized agent, so the payment can be completed inside the supplier portal. In this flow, that authentication can satisfy site protections historically provided by CAPTCHA and other bot-blocking mechanisms, without requiring an additional agent login, and buyers do not need to share supplier-portal logins at all, per Visa, BILL and Billtrust Launch AI Agent Pilot for B2B Invoice Payments. That is a claim about this authenticated flow between these platforms — not evidence that portals generally will accept agent authentication in place of their existing checks.

Five properties define the design, per the launch announcement: a recognized agent acting for an identified buyer; tokenized credentials instead of shared portal logins; payment controls tied to the approved instruction; a payment path tied to the specific invoice; and visibility into authorization and completion, per Visa, BILL and Billtrust Launch First Live Pilot for Trusted AI Agent Payments Between Buyer and Supplier Platforms. For suppliers, the payment still arrives under their existing acceptance policy, with the information needed to process and reconcile it — a condition for supplier acceptance, since no supplier benefits from a payment it cannot match to an invoice.

Note the limit on the agent's authority. The companies are explicit: the agent only executes eligible payments that have already been approved by the buyer — it does not select invoices or set amounts, per Visa, BILL and Billtrust Launch AI Agent Pilot for B2B Invoice Payments. The announcement does not specify how payment scheduling or exceptions are handled, so do not read more discretion — or less — into the design than that. A payment system earns trust by limiting the agent to a bounded execution step whose authorization can be checked afterwards.

Mastercard is testing a different entry point

Visa's pilot did not land in isolation. On the same day, Mastercard opened early developer access to Agent Pay for Machines, offering buyer-side and seller-side APIs, a developer toolkit, and a testing sandbox, per Mastercard opens early access to AI agent payments at Cloudflare Connect. Early developer access is not production usage, and the report publishes no usage volume, pricing, or merchant acceptance figures. Its demo was narrow by design: an agent running a campaign made nine payments to two merchants, all drawn from a single budget approved up front; separately, the program supports cards, bank accounts, and stablecoins, each with built-in spending controls, per the same report.

The two approaches also delegate different amounts of authority — and the difference deserves attention. Visa's flow executes a specific invoice payment the buyer already approved. Mastercard's demo lets an agent initiate purchases inside a preapproved task budget, which delegates more in-the-moment choice to the agent. Both set the mandate in advance and keep the transaction visible, but they are not the same risk shape, and they should not be evaluated as if they were. Mastercard describes its program as still in pilot phase, collecting developer feedback before any wider rollout, per Mastercard opens early access to AI agent payments at Cloudflare Connect. Two networks testing agent-payment infrastructure on the same day suggests the competition is intensifying — it does not yet show how much real payment volume either system will carry.

What this means for your business

1. Find your own last manual steps — and pick the right shape of task. Audit workflows that are automated until the final click: portal payments, form submissions behind logins, status checks that require a person to sign in. Then filter for the tasks this pattern fits: approval exists before the agent acts; the amount, recipient, and purpose are fixed; the transaction is observable and reconcilable; exceptions route to a person; and the mandate can be revoked. A payment that meets those five tests is a candidate. One that needs judgment mid-flight is not.

2. Keep approval and execution separate. The working pattern in both launches is strict: humans approve and set limits; agents execute only what was approved, tied to a specific invoice or budget. If a vendor pitches an agent that decides what to pay, when, or how much beyond a preset mandate, that is a different risk class. Ask where the approval record lives, how limits are enforced in the payment path itself — not just in a prompt — and how an instruction is revoked.

3. Stop sharing portal credentials. Passing supplier-portal logins to staff, scripts, or automation tools creates an untracked credential trail. The tokenized model here is the standard to demand: scoped credentials, tied to one purpose, with no reusable login to leak. Inventory where your team shares portal logins today; that inventory is your exposure list if any one of them is compromised.

4. Require an audit trail an accountant would accept — and answers for the failure cases. Both sides in the pilot retain visibility into authorization and completion, and suppliers keep the data needed to reconcile. Any agent payment flow you adopt should answer, for every transaction: who approved it, what instruction the agent carried, what it actually paid, and where the confirmation is stored. Then ask the questions launch coverage leaves open: What happens when authentication fails midway? What prevents a duplicate submission? How are partial payments, rejected invoices, and a mismatch with the supplier's acceptance policy handled? How are agent credentials revoked, and in what format does reconciliation evidence arrive? If reconciliation depends on the agent's own summary, the control is decorative.

5. Pilot narrow, verify coverage, and measure the boring numbers. This is a live pilot with participating customers, not a general release with published performance data, and no broader supplier compatibility is established — the announced flow runs between BILL buyers and participating Billtrust suppliers. Start with one payment type, one platform pair, and a small set of suppliers. Measure manual touches removed, failed or rejected payments, reconciliation exceptions, and time from approval to supplier receipt — and compare the total cost per payment, including card acceptance economics, against the rails you use today. Those numbers — not a launch announcement — tell you whether agent payments save work in your operation.

The broader shift is plain. Agents have been able to draft, summarize, and recommend for some time. Paying an approved invoice is different: it moves money, across two companies' systems, under both sides' controls. The teams that benefit first will not be the ones that give agents the most freedom. They will be the ones that define the mandate, the limits, and the evidence trail most precisely — and then let the agent do the keying-in work nobody should have been doing by hand.

Want an independent review of where trusted agents, payment controls, and automation belong in your operation? Get a free AI audit — we'll map your highest-leverage automation opportunities in one session.