Stored credentials don't hold up for agent payments

I'm working on putting an agent into production for routine purchasing and the credential model is where everything keeps breaking. Giving the agent access to a stored card means the credential persists across sessions which creates exposure if the agent gets manipulated or compromised at any point and adding human approval at checkout works in testing but defeats the point of autonomous purchasing. Also trusting the agent to make the payments/judgements on it's own doesn't seem like an option since they're most likely to bypass restricitons even with the best prompts out there so this issue is the only thing stopping me every time I try to move from a controlled test to anything resembling production traffic.