The hardest question for any AI money advisor is not what it says. It is whether it should ever pay for something without asking first. Today the answer, under the rules most banks work to, is no: a digital payment needs a second factor of authentication each time, with a short list of exemptions.

We think there is a narrow, useful case where that could change: small, known, repeat payments, such as a regular bill or a merchant the customer pays every week. The agent card is how Tuvel does it safely, and it runs in Tuvel today as Tuvel Agent Card Available now.

What the card is

A prepaid card that only the advisor pays from. The customer loads it, after authenticating. It never draws on their savings account. If something goes wrong, the most that can be spent is what is on the card.

  • It holds ₹10,000 by default, and never more than ₹2,00,000.
  • Payments to people are capped at ₹10,000 a month, and each one waits for the customer’s tap.
  • It freezes in one tap. Unfreezing it, or loosening a limit, needs authentication.
  • Every time the card details are revealed, that is logged.

These limits sit inside the published limits for full-KYC prepaid payment instruments in India.

How it fits the two keys

The card does not replace the two keys; it sits under them. The customer’s level and the bank’s ceiling for their segment still decide what may run, and the bank’s caps per payment and per day still apply. Commitments, payments to people and new merchants still wait for the tap.

What we are proposing

We see four controls that together could stand in for a per-payment second factor, only for small, known, repeat payments:

  1. An agent-bound instrument: the card, loaded by the customer and never drawn from savings.
  2. Graded autonomy as the risk control: the customer’s level, the bank’s ceiling and the caps.
  3. Action-bound consent: each confirmation tied to an exact amount and payee.
  4. A replayable record: every turn, tool call and gate decision recorded, so anyone reviewing it can see why a payment happened.

Where it stands

The card runs in Tuvel today. A bank chooses whether the customer’s level decides when it pays on its own, or whether every card payment waits for a PIN. It is issued on each bank’s own full-KYC prepaid programme in its pilot, and we are discussing the four controls above with banks and policy bodies.

If you work at a bank, a payments network or a policy body and want to test the idea against your own rules, we would like to hear from you.