Terry Angelos on Payment Credentials for AI Agents

Andreessen Horowitz partner Alex Rampell speaks with Terry Angelos, chief strategy officer and board member of Very Good Security (VGS), about AI agents making purchases. Rampell says he invested in VGS and sits on its board; the two previously founded TrialPay together.

Angelos describes VGS as payment infrastructure that stores credentials for merchants, neobanks and AI companies. He says the company also helps move credentials among wallets, agents and merchants; his figures about the company’s reach are its own claims.

A large online merchant may want to accept cards without directly handling and storing the raw card number. Angelos says a secure vault can capture the credential and supply it to a payment processor when needed.

They explain network tokenization: instead of exposing a primary account number everywhere, a card network can provide a substitute credential associated with a particular merchant or domain. The payment processor can use the token under the network’s rules.

Rampell notes that large merchants may use several processors to optimize cost, authorization rates or geographic coverage. An independent vault can make it easier to route credentials across them instead of keeping each processor’s store separately.

Card replacement also creates maintenance work. The speakers discuss account updater services and the complications that can arise when a card changes networks; Angelos says a vault can help keep stored credentials current.

An agent asked to buy flowers needs a way to pay the merchant. Rather than placing a raw card number in a chat, the speakers discuss infrastructure that can pass an appropriate credential between the customer, wallet and merchant.

They discuss payment-card security rules and the value of outsourcing sensitive credential handling. A service provider can reduce a merchant’s exposure and compliance scope, although outsourcing does not automatically eliminate all of the merchant’s obligations.

Angelos says agents become more useful when they can act, not merely recommend. He describes asking an agent to find and book a piano lesson while accounting for his family’s schedule and preferences.

He calls the competition to connect wallets with agents the “wallet wars.” In his view, agents benefit from wallets that already have many consumers’ credentials and broad merchant acceptance.

Rampell says the competition for a default payment method predates AI. Card issuers and networks sought to become the preferred card within digital wallets, while wallets competed to be the preferred checkout button.

The speakers distinguish consumer wallets that hand a credential to a merchant from wallets that also handle the transaction and remit funds. Agent commerce can combine elements of both arrangements.

Angelos likens Stripe’s early approach to an AOL-style closed ecosystem: convenient when it works, but limited by where the wallet is connected. He recounts asking an agent to buy lights from Walmart when his wallet did not have a direct merchant connection.

According to his account, Stripe used a one-time virtual card to purchase the item and separately charged him. The purchase succeeded, but he says the intermediary structure could complicate a later dispute because the customer’s bank sees the intermediary rather than the underlying merchant.

Rampell emphasizes the role of card-network dispute and chargeback rules in consumer trust. These mechanisms can make a customer more willing to buy from an unfamiliar merchant, although outcomes depend on the circumstances and applicable rules.

Angelos says card networks have introduced agentic token standards intended to let an authorized agent pass a constrained credential to a merchant. He presents this as a route toward retaining the customer’s card relationship and existing payment protections.

He gives another example from the purchase: Walmart offered to credit the delivery fee toward a subscription, but the follow-on transaction failed because the card used for the original order was single-use. This is his account of one transaction.

In his proposed flow, a verified agent receives a token with transaction context and a spending limit, then provides it to the merchant. Angelos says the merchant can process the customer’s card through the token, potentially allowing ordinary payment rules to apply.

Angelos says VGS was provisioning millions of agentic tokens per week at the time of recording. The company executive expects open standards to gain ground; neither the figure nor that forecast is independently established in the discussion.

Rampell describes a vault as holding credentials and supporting operations on them, such as retrieving a token for a payment. Angelos says the same infrastructure increasingly has to serve multiple processors, agents and other parties.

A model provider might already store a credential to charge a subscription. In the scenario Angelos describes, an authorized agent could also use an appropriately provisioned token for a purchase, subject to the relevant rules.

Rampell breaks payment trust into questions: is the card valid, is the person or agent authorized to use it, and is the transaction actually what the customer intended? A valid card number alone does not establish authorization.

He compares identity checks in an in-person purchase with the harder online problem of identifying a delegated agent. The speakers then consider an additional failure: an authorized agent could still misunderstand the user and buy the wrong thing.

Angelos describes an agent booking a hotel under a stated spending limit. He says networks can validate the credential and agent and carry transaction context, but they cannot necessarily tell whether the agent selected the correct dates.

Who bears the loss when an authorized agent makes a mistake remains unresolved in his view. Rampell suggests that agents might compete by accepting some responsibility, while merchants also need confidence that a legitimate transaction will not be reversed unfairly.

Rampell turns to merchants that restrict automated shopping, citing Amazon’s blocking of Muse. He suggests advertising economics may shape a retailer’s incentives, but acknowledges that different businesses can have reasons to welcome or resist agents.

Angelos expects a range of approaches: some retailers may welcome agents, others may restrict them, and smaller merchants may see them as a new distribution channel. He compares the negotiations to open banking, where access often shifted toward controlled APIs.

A merchant could also deploy its own agent with its own commercial incentives, like a salesperson recommending products. The customer’s agent may have different preferences, leaving open how those systems will negotiate and whose interests they will serve.

Asked about hype, Angelos doubts agents will cause an immediate run on savings deposits by constantly chasing yield. Existing relationships, payment integrations and other friction may limit how quickly people move money.

He thinks unmet consumer demand may be underestimated. An agent that notices a cycling recommendation in a group chat could make a purchase someone otherwise postpones, though this is a speculative example rather than evidence of a measured effect.

At the same time, he says agents might save money by identifying forgotten subscriptions or better deals. He expects both additional purchases and savings, with the overall impact still uncertain.

Rampell warns that some early agent advantages arise because only a few people use the tools and the other side has not adapted. A restaurant reservation advantage, for example, may erode when many customers automate the same request.

They imagine merchants and service providers developing their own responses to automated customers. Angelos points to agents reading complicated terms and finding opportunities that people overlook.

Credit-card rewards are one example: if an agent always chooses the card with the best reward for each purchase, issuers may change terms that relied on less optimized behavior. The speakers do not claim to know whether the resulting terms will be better or worse.

On VGS’s future, Angelos describes three overlapping areas: credential storage, keeping credentials and network tokens up to date, and brokering authorized transfers among ecosystem participants.

He argues that serving more merchants, issuers and agents could increase the value of that network. This is the strategy of the company represented by both speakers, not an independent assessment of its position.