Travel, dining, gifts —
no card share, no leaks.

Modern concierge services — for HNW individuals, executive assistants-as-a-service, AI travel agents — face one structural problem: the customer's primary card cannot live on the booking site or in the agent's memory. The blast radius of a single LLM jailbreak or one malicious OpenTable confirmation page is the customer's entire card limit. The historical workaround is a master corporate card the concierge agency holds; the cost is finance complexity, dispute friction, and frequent statement reconciliation pain.

AgentWallet eliminates this by issuing one Visa per customer, per trip, scoped to the trip's merchant categories, daily cap, geography, and lifetime. The agent never holds the customer's primary card. If a booking site is compromised, the blast radius is whatever's left on that one trip-scoped card — typically under $1,000 — and the card auto-voids when the trip ends.

When a concierge agent charges a $620 dinner at Le Bernardin, the customer sees the charge in their phone's notification tray within 2 seconds. Not the next morning, not the next statement — 2 seconds. This is the trust loop that makes agent-driven concierge work; without it, every customer is anxious about what the agent is doing on their behalf.

The receipts include the merchant's display name (decoded from the MCC + acquirer name, so 'L BRNARDIN NY' becomes 'Le Bernardin, NYC'), the amount, the trip context, and a one-tap dispute button. Disputes route through the agent's card-refund flow automatically — no human in the loop unless the merchant refuses.

Customers expect their Marriott Bonvoy, Delta SkyMiles, and OpenTable numbers to be used. Putting these into the LLM's prompt context is a data-leak risk and a token-cost waste. AgentWallet stores loyalty numbers encrypted on the customer record (AES-256-GCM, scoped to that customer's principal) and injects them into the booking at the point of the API call — never into the model context.

The agent calls a tool: book_hotel({chain: 'Marriott', city: 'NYC', dates: …}). The tool resolves the customer's Marriott number from the encrypted store and forwards it to the booking API. The LLM never sees the number; the model can't accidentally leak it in a response.

A concierge that asks the customer to approve every $40 dinner is a worse customer experience than calling a human concierge. AgentWallet uses AP2's IntentMandate to make this asymmetric: customer signs once at the start of a trip (e.g., 'NYC, Sept 14–17, $3,000, travel + dining + gifts'), and the agent transacts freely within that scope. Anything outside the scope — $50 over the cap, an Uber to Boston instead of NYC, a Best Buy purchase outside the MCC allowlist — is refused at the network level by the card's policy guard.

If the customer wants to extend mid-trip, they bump the mandate by tapping a one-time confirmation in their app. The new mandate version supersedes; the old version is retained for audit. Every charge on the trip is bound by a signature chain back to the customer's IntentMandate.