Wise says its existing payment software, not the AI model, will keep agents in bounds

Emil Chetty, who runs data and AI product at Wise, described a design on the AI Engineer show. A customer agrees to a whole job once, and Wise's long-established payment software holds the agent to that deal. He presented it as Wise's approach, not as a tested result.

What was said

Chetty put Wise's cross-border volume last year at over $243 billion, for close to 19 million active customers, under more than 80 licenses. Regulators, he said, expect Wise to know what a customer authorized and to explain the outcome. He compared approving every agent step to early coding agents, where engineers clicked approve all day. "We ultimately made the human the API," he said.

First, the agent gathers information with read-only access, which gives it no power to pay anyone. Wise's trusted software, not the agent, looks up the suppliers, bank details and amounts from account records. The customer sees a proposal listing the suppliers and the total, and confirms it. That confirmation becomes an immutable job record, meaning one the agent cannot rewrite.

The agent then chooses its own steps. Before each payment, Wise's payment services check the recipient and terms against the record.

Chetty gave a hypothetical. Suppose the agent is hit by a prompt injection, meaning hidden text that tricks it, and it believes a supplier's details changed. Its belief cannot alter the confirmed job, so the new payee fails the service check. "So the boundary doesn't actually depend on the model spotting the scam," he said.

Why it matters

Our reading: this applies to systems that can enforce a fixed agreement, not to older software in general. Chetty said Wise will keep relying on the software stack it has built over the years. In his design, that existing layer is what makes a one-time approval workable.

What matters is whether services can check each action against an agreement. For anyone buying or building agent features, three questions follow. Are the payee and amount fixed outside the agent's reach? Is each action checked against a record the agent cannot rewrite? Do existing services actually enforce that record?

The other side

The excerpts include no outside test of how well it works, and no failure rates. The prompt-injection case was a hypothetical, not an observed incident.

Chetty did not say old software is enough on its own. He said the boundary depends on downstream services that can check and enforce what was agreed. The excerpts do not say what a company without such services should do.

The customer must still approve the job, and the lock is only as good as the proposal shown. Chetty said different terms need a revised proposal and a customer decision.