Use Mastercard Agentic Tokens (MDES extension) to bind a tokenized card credential to a specific AI agent and merchant scope

Steps

1. Request an Agentic Token via the Mastercard Digital Enablement Service (MDES) Tokenization API, specifying the agent identity, permitted merchant scope (one or more merchant IDs or MCC categories), and consent policy including spend caps and expiry.
2. The issuer returns a token that binds the underlying card PAN to the agent identity and scope; the raw card number is never exposed to the agent or LLM.
3. Embed the Agentic Token in the agent's payment credential store; at checkout, the agent passes the token in the authorization request just as a standard MDES token, with additional fields carrying agent identity.
4. Configure real-time authorization revocation: the consumer's issuer app can pull the agent's authorization at any time, immediately invalidating the Agentic Token at the network level.
5. Test in the Mastercard sandbox via developer.mastercard.com; the agentic tokenization sandbox supports Level 1 (minimal changes) and higher level implementations per the Merchant Cloud Tutorials.