Nothing Refunds a Sentence

Stripe published purchase protection for AI agents on Tuesday. On Monday, Simon Willison had quoted an agent whose mistake no purchase protection will ever reach. I read them back to back, and the gap between the two is the part of agent design I have paid for twice.

The short version

Stripe says the most popular personal agents, Muse among them, now pay through Link's wallet for agents, that agentic purchases on Link grew 38x in a month, and that eligible purchases get free protection if the agent makes a mistake: accidental damage, lost items, price drops, no-fee returns, and return guarantees. One day earlier, Simon Willison quoted a Muse agent telling its user that its auto-reply had said "Yep I'm here!" to someone waiting for a pickup when nobody was home, and that the visitor left a negative rating. No money moved wrongly, so nothing on Stripe's list applies. Agent actions sort into three classes: refundable, which you insure; bounded, which you budget; and said in someone's name, which you verify or do not say. My expense agent cost about $2,400 and a quarter of trust. The second number was the real one.

What Stripe shipped

Three things, and all three are good product work.

Incremental authorization. Checkout prices move after approval, so Link now lets the agent request a higher approved amount. Stripe's example is a checked bag added after the fare was approved: the agent updates the amount instead of restarting the purchase and placing a second hold on the card. When the agent hits a payment obstacle, Link returns specific guidance, such as a URL the consumer can open to finish a 3D Secure challenge.

Spending insights. With the consumer's permission, the agent can read purchase history through Financial Connections, which Stripe says reaches more than 12,000 financial institutions, and use it to set a budget and recommend a store.

Purchase protection. If an agent uses Link for an eligible purchase and gets it wrong, the consumer may be covered for accidental damage, lost items, price drops, no-fee returns, and return guarantees. Muse is first. Builders get it without running a claims program.

Then the line about what is next: spending controls that let a consumer set a budget so the agent finishes a task without approval of each transaction. Stripe's example is a limited-release pair of shoes that goes on sale at 1 a.m.

What the Muse agent did

Simon Willison collects quotations, and this one is a Muse agent reporting to the person it works for. Someone showed up at the user's building around 9:15 for a keyboard pickup and waited. Nobody came down. At 9:27 the agent's auto-reply told him "Yep I'm here!" He left angry at 9:38 and left a negative rating.

The agent owned it. It sent an apology from the user's account and offered to try another day. And then it proposed its own fix: stop the auto-replies from claiming the user is home when it cannot verify that.

Run that against Stripe's list. Nothing was damaged. Nothing was lost. No price dropped. There is nothing to return. The cost is a rating on a person's account and one annoyed stranger, produced by a sentence the agent had no way to check.

The two bills I have paid

Both are in 10 AI Agents I Built That Failed. The Honest Retrospective.

The expense agent auto-approved anything under $500 with a matching receipt. It worked for two weeks. Then a vague "dinner with customer" passed every time, and about $2,400 went out that should not have. That was the refundable part. The part that was not refundable was three hours with the CFO and a trust cost that took a quarter to rebuild. The rule I kept: an agent that touches money gets a human review layer you cannot remove.

The onboarding agent watched a new user's first session and offered help where they got stuck. It was right about the stuck points. Users read it as surveillance, and activation for the people it helped came in below the control group. Three of my ten failures had that shape. The agent was correct, and correct was not what anyone was grading.

Put those next to this week's news. Stripe has built the mechanism for my first bill, and its next step, a budget in place of per-transaction approval, is a fair trade for purchases because a purchase can be capped before and reversed after. My second bill has no mechanism, and the Muse quote is the second bill.

Three classes

This is how I sort an agent's actions now.

Refundable. There is a price, a counterparty, and a reversal path. Insure it. Stripe just did, and you should not build your own.

Bounded. The damage can be capped before the agent starts. Budget it. Stripe's spending controls are this, and so are the lists OpenAI's dots ship with, which, per swyx's AINews recap of DevDay, let a user set what the agent can do on its own, what needs approval, and what it must never do.

Said in someone's name. A statement of fact to a third party. It cannot be refunded and a budget does not describe it. Verify it or do not say it.

The third class is the one product teams skip, because it does not show up in the payment threat model. It is also the cheapest to fix. "Yep I'm here!" becomes "Let me check and get right back to you" and the failure is gone. The Receipt Gate is the same rule pointed inward, at what the agent says about its own work. This is the rule pointed outward. And The Stop Rule covers the loop case, where the agent keeps acting with no cap at all.

What to do this week

Pull fifty outbound messages your agent sent on a customer's behalf. Mark every sentence that asserts a fact about the world: someone is there, something shipped, a slot is free. For each one, write down the signal the agent read before it said so. Where there is no signal, rewrite the sentence.

It belongs to the argument on Enterprise AI Agents: what matters is how many deployed agents still complete production work after ninety days, and what each successful outcome costs. An unverified sentence is a cost that never reaches the invoice. It lands on the person the agent was speaking for.

Related answer: What agent mistakes does purchase protection not cover?

Sources: Helping personal agents shop more intelligently and reliably with Link, Stripe, September 29, 2026. Quoting Muse AI Agent, Simon Willison, September 28, 2026. [AINews] OpenAI DevDay 2026, swyx, Latent Space, September 30, 2026, free portion only. 10 AI Agents I Built That Failed. The Honest Retrospective., falkster.com, May 4, 2026.