The PCI Security Standards Council, which sets security rules for companies that handle payment card data, has published guidance recommending that AI agents with access to cleartext cardholder data get explicit human approval before acting on it, Help Net Security reported Friday. The document, titled "Security Considerations for AI Systems," is advisory and does not change existing PCI requirements.

What Happened

The guidance sets out two ways to control what AI systems can do in payment environments. In the first, a person approves each action explicitly. In the second, which the council calls monitored autonomy, an AI system carries out authorized actions without per-action sign-off while being watched, provided the organization has defined the permitted actions, when approval is still required, what triggers a shutdown and how changes are rolled back. A responsible person remains accountable in either model.

For agents that can see cleartext cardholder data, the council recommends the first model: explicit human approval for any action involving that data.

RelatedJPMorgan Bars Outside AI Agents From Customer Accounts as Dimon Warns of 'Rogue Agents'

The document also asks organizations to define each AI system's purpose, permissions and data access before deployment and to apply a least-agency principle, giving a system only the access and capabilities its task requires. That access should be enforced by independent controls such as identity management and network isolation rather than by the AI system itself.

Other recommendations include:

  • Naming a suitable person who formally accepts responsibility for an AI system's output.
  • Keeping an AI inventory covering models, versions, hosting, integrations, data policies and intended users, and setting acceptable-use policies to curb unsanctioned "shadow AI."
  • Running adversarial testing before functional testing, and monitoring behavior continuously after launch.
  • Keeping credentials out of AI systems' reach by storing them in dedicated secrets-management tools, separate from code, prompts and logs.
  • Using encrypted or tokenized payment data where possible, with independent data-loss prevention controls.

External AI providers that touch sensitive data should be assessed under the existing third-party service provider requirements, and contracts should explicitly bar them from using the organization's data to train models. Incident response plans should account for prompt injection and model poisoning.

Why It Matters

Payment companies are testing AI agents for customer support, fraud review and back-office work, and some of those agents need access to systems that store or process card data. The guidance describes how such systems fit within PCI rules, including how AI deployments affect the scope of a PCI assessment.

The human approval recommendation is the most concrete limit in the document. It effectively steers organizations away from letting autonomous agents act on raw card numbers unless they have built the monitoring, shutdown and rollback controls the council describes.

Executive Director Gina Gobeyn said the growing use of AI in payments creates an obligation for all parties to use the technology responsibly, calling the guidance "a practical starting point" for secure implementation.

Context

The document also addresses how AI changes the threat side. It notes that AI can speed up vulnerability discovery and social engineering, and it recommends ongoing vulnerability monitoring, patch prioritization and security testing of AI-generated code and patches. One example deployment splits vulnerability management tasks across several separate agents.

What to Watch

The council gave no timeline for turning any of the recommendations into mandatory PCI DSS requirements. Assessors and card brands may still begin asking merchants and processors how their AI deployments map to the guidance, particularly where agents sit inside the cardholder data environment.