AgentCore Payments, announced at AWS Summit New York on June 17, 2026, is the capability that makes a lot of enterprise security teams reach for the antacids. Autonomous AI agents that can spend real money. And yet — when you look at the actual architecture, the controls are more rigorous than most human approval workflows. This is a technical deep dive into how the Coinbase and Stripe integration works at the API level, how to configure spending limits and approval gates, what the audit trail looks like in CloudTrail, and when autonomous payments are the right architectural choice versus keeping a human in the loop.
How the Coinbase + Stripe Integration Works at the API Level
The partnership architecture here is worth understanding precisely, because “built in partnership with Coinbase and Stripe” could mean a lot of things ranging from “we send them an email sometimes” to “deeply integrated payment rails.” In this case, it’s meaningfully integrated.
AgentCore Payments creates what AWS calls a Payment Identity — a cryptographically scoped, IAM-bound identity that represents the agent’s authorization to make payments. This is not a shared credit card number. It’s an isolated payment principal that can only transact within its defined policy scope.
The two payment rails operate differently:
- Stripe integration: Handles fiat currency transactions — purchasing API credits, paying for web content subscriptions, buying access to SaaS-based MCP servers. The agent’s payment identity maps to a Stripe customer object. Charges run through AWS’s master account relationship with Stripe and appear on your AWS bill as AgentCore Payment charges, not as direct Stripe charges. This is significant for procurement: your finance team sees AWS charges, not a proliferation of individual SaaS subscriptions.
- Coinbase integration: Handles crypto-native transactions — primarily for purchasing access to blockchain-native MCP servers, decentralized API marketplaces, and AI agent-to-agent payments where the receiving agent is operating on a crypto payment rail. This is the piece that enables the emerging agent economy where agents transact with other agents without human intermediaries.
At the transport layer, when an agent’s reasoning determines it needs to purchase something, it invokes the Payments tool in the AgentCore harness. The harness checks the purchase against the spending policy, routes to the appropriate payment rail (Stripe or Coinbase), executes the transaction if approved, and returns the access credential (API key, session token, content URL) to the agent’s context. The whole flow happens within the AWS security boundary — your agent never directly handles payment credentials.
Configuring Spending Limits and Approval Gates
This is where you establish actual control over what your agent can spend. The payment policy is a JSON document attached to the agent’s payment tool configuration. Here’s a complete payment tool configuration with tiered spending controls:
{
"agentName": "market-research-agent",
"foundationModel": "anthropic.claude-sonnet-4-5",
"instruction": "You are a market research agent. You may purchase access to premium data sources and specialized APIs when needed to answer research queries. Always purchase the minimum necessary access tier. Log the rationale for each purchase in your reasoning.",
"agentResourceRoleArn": "arn:aws:iam::123456789012:role/AgentCorePaymentsRole",
"tools": [
{
"toolSpec": {
"managedToolType": "BEDROCK_PAYMENTS",
"paymentsToolConfiguration": {
"paymentIdentityArn": "arn:aws:bedrock:us-east-1:123456789012:payment-identity/mkt-research-agent-pi",
"spendingPolicy": {
"currency": "USD",
"perTransactionLimit": {
"amount": "25.00",
"action": "REQUIRE_APPROVAL"
},
"dailySpendingLimit": {
"amount": "200.00",
"action": "BLOCK"
},
"monthlySpendingLimit": {
"amount": "2000.00",
"action": "BLOCK"
},
"allowedMerchantCategories": [
"API_CREDITS",
"DATA_SUBSCRIPTIONS",
"MCP_SERVER_ACCESS",
"WEB_CONTENT_ACCESS"
],
"blockedMerchantCategories": [
"PHYSICAL_GOODS",
"FINANCIAL_INSTRUMENTS",
"CRYPTO_EXCHANGE"
],
"requireApprovalAbove": {
"amount": "10.00",
"approvalArn": "arn:aws:sns:us-east-1:123456789012:agent-payment-approvals",
"approvalTimeoutSeconds": 300,
"onTimeout": "BLOCK"
}
},
"allowedPaymentRails": ["STRIPE", "COINBASE"],
"auditConfiguration": {
"cloudTrailLogging": true,
"detailedReceiptLogging": true,
"notificationArn": "arn:aws:sns:us-east-1:123456789012:payment-audit-alerts"
}
}
}
}
]
}
The tiered control structure here is worth calling out. Transactions under $10 are auto-approved. Transactions between $10–$25 trigger an SNS notification to a human approver with a 5-minute timeout — after which the transaction is blocked if no approval comes. Transactions over $25 are always blocked regardless of daily budget headroom. Daily and monthly caps are hard stops. The merchant category allowlist prevents the agent from purchasing anything outside its defined scope — no financial instruments, no physical goods, no crypto exchange activity.
Creating a Payment Identity
Before you can attach the Payments tool, you need a Payment Identity. This is the isolated principal that gets scoped payment authorization:
aws bedrock create-payment-identity \
--payment-identity-name "mkt-research-agent-pi" \
--associated-agent-role-arn "arn:aws:iam::123456789012:role/AgentCorePaymentsRole" \
--payment-rails '["STRIPE", "COINBASE"]' \
--description "Payment identity for market research agent - scoped to data and API purchases only"
The IAM role associated with the Payment Identity needs a specific permissions policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AgentCorePaymentsAccess",
"Effect": "Allow",
"Action": [
"bedrock:ExecutePayment",
"bedrock:GetPaymentIdentity",
"bedrock:ListPaymentTransactions"
],
"Resource": [
"arn:aws:bedrock:us-east-1:123456789012:payment-identity/mkt-research-agent-pi"
]
},
{
"Sid": "ApprovalGatePublish",
"Effect": "Allow",
"Action": ["sns:Publish"],
"Resource": "arn:aws:sns:us-east-1:123456789012:agent-payment-approvals"
}
]
}
The Payment Identity is scoped to specific agent roles — an agent can only use a Payment Identity that was created for its associated role ARN. This prevents lateral movement between agents in a multi-agent environment.
The Audit Trail: CloudTrail Events for Agent Purchases
Every payment action generates structured CloudTrail events. Here’s what a typical autonomous purchase event looks like — in this case, an agent purchasing MCP server access:
{
"eventVersion": "1.09",
"eventSource": "bedrock.amazonaws.com",
"eventName": "ExecuteAgentPayment",
"eventTime": "2026-07-03T14:23:47Z",
"userIdentity": {
"type": "AssumedRole",
"principalId": "AROAEXAMPLEID:AgentCoreSession",
"arn": "arn:aws:sts::123456789012:assumed-role/AgentCorePaymentsRole/AgentCoreSession",
"accountId": "123456789012"
},
"requestParameters": {
"agentId": "AGENT_ID_HERE",
"agentAliasId": "ALIAS_ID_HERE",
"sessionId": "session-8a7f3c2d",
"paymentIdentityArn": "arn:aws:bedrock:us-east-1:123456789012:payment-identity/mkt-research-agent-pi",
"paymentDetails": {
"merchantId": "mcp-server-alphavantage-v3",
"merchantCategory": "MCP_SERVER_ACCESS",
"amount": "4.99",
"currency": "USD",
"paymentRail": "STRIPE",
"purchaseDescription": "AlphaVantage Financial Data MCP Server - 100 API credit bundle",
"agentRationale": "User query requires real-time equity data. Internal KB does not contain current pricing. Minimum bundle required."
}
},
"responseElements": {
"transactionId": "txn_3Rd8aF2eZvKYlo",
"status": "COMPLETED",
"accessCredential": {
"type": "API_KEY",
"expiresAt": "2026-07-10T14:23:47Z"
}
},
"approvalDetails": {
"required": false,
"reason": "Transaction amount $4.99 below auto-approval threshold of $10.00"
}
}
A few things in that payload worth highlighting. The agentRationale field is populated by the model’s reasoning trace — your agent actually explains why it’s making the purchase, and that explanation is persisted in the audit record. This is non-trivial for compliance reporting: you have a documented chain of reasoning for every autonomous expenditure. The approvalDetails block records whether approval was required and why, making it straightforward to audit which transactions were auto-approved versus human-reviewed.
You can query these events in CloudWatch Logs Insights or ship them to your SIEM of choice. A useful query for payment transaction monitoring:
fields @timestamp, requestParameters.paymentDetails.amount,
requestParameters.paymentDetails.merchantCategory,
requestParameters.paymentDetails.agentRationale,
responseElements.status,
responseElements.transactionId
| filter eventName = "ExecuteAgentPayment"
| sort @timestamp desc
| limit 100
Building Agents That Purchase MCP Server Access Autonomously
The most common production pattern for AgentCore Payments right now is agents that discover they need a specialized capability (real-time market data, legal document analysis, domain-specific embeddings) and purchase access to the MCP server that provides it — within their spending policy — rather than returning a “cannot complete this task” response.
The architectural pattern looks like this: your agent has a base set of tools (Web Search, Knowledge Base, maybe a few Lambda-backed actions). When it encounters a query that requires data it can’t retrieve with its current tools, instead of hallucinating or failing, it uses the Payments tool to purchase access to a registered MCP server, receives the access credential, attaches the MCP server to its current session context, and completes the query. All of this happens within a single agent invocation from the user’s perspective.
The MCP server registry integration with AgentCore Payments means agents can discover available MCP servers by category and price point, compare options, and purchase the minimum necessary access tier — not the most expensive one. If your spending policy is correctly configured, your agent is actually incentivized to be cost-efficient.
When Autonomous Payments Are Appropriate vs. Human-in-the-Loop
Not every use case should have autonomous payments enabled. The decision tree is fairly clear once you frame it correctly:
Autonomous payments are appropriate when:
- The purchase amounts are small and well-bounded (API credits, pay-per-use data access)
- The transaction is reversible or time-limited (access keys that expire)
- The agent’s task is time-sensitive and human approval latency would break the workflow
- Your audit and monitoring infrastructure is in place before you flip the switch
Human-in-the-loop is the right call when:
- Purchases involve ongoing subscription commitments (not one-time access)
- Transaction amounts are in the hundreds of dollars or more
- The purchase creates contractual obligations (terms of service acceptance)
- You’re in a heavily regulated environment where autonomous financial transactions require documented human authorization
The tiered approval gate in the spending policy configuration handles the middle ground gracefully — auto-approve the small stuff, require human sign-off on anything significant, and hard-block anything that exceeds your risk threshold. That’s not AI replacing human judgment; that’s AI handling the trivial cases so human judgment is reserved for decisions that actually require it.
The security model here is sound. IAM-scoped payment identities, hard spending caps, merchant category allowlists, full CloudTrail coverage, and approval gates for high-cost actions. It’s more auditable than most human expense approval workflows, which should say something about how we’ve historically approached expense governance. The agents aren’t the problem. The governance infrastructure around them is what matters — and AWS has given you the tools to build it correctly.
At Enkompass (enkompass.net), this is our home turf. We’ve shipped production Bedrock and SageMaker workloads that actually move the needle, not just demo well. If you’d rather have seasoned cloud people handle it instead of learning the hard way at 2 AM, let’s talk. Reach out through our contact page or call us directly at +1-828-436-5667 — we’ll help you turn this from a someday-project into a done-deal.