Agents increasingly take actions on behalf of their end users, whether that’s selecting tools, browsing the web, and calling MCP servers autonomously to achieve a goal. When the tools, MCP endpoints, or web resources an agent reaches are paid, the agent gets stuck without the ability to transact. Amazon Bedrock AgentCore payments, announced in preview in partnership with Coinbase and Stripe (Privy), gives agents the ability to access paid resources on the end user’s behalf to complete the task.

Putting real money behind an autonomous system raises a new set of risks. They come from agents acting autonomously over long sessions, model non-determinism, and a wider exposure surface between agent code and the end user’s funds. In this post, we walk through those risks and the guardrails that AgentCore payments combines to address each one.

AgentCore payments is available in preview in US East (N. Virginia), US West (Oregon), Europe (Frankfurt), and Asia Pacific (Sydney). Features and APIs might change before general availability.

Throughout this post, we use these terms:

End user: the human whose money is being spent and on whose behalf the agent transacts.