Mastercard, RAI Institute Set Guardrails for Autonomous Agent Commerce

The Future of Responsible AI: How Mastercard and RAI Institute Are Shaping Trustworthy Innovation — Ai4

Ai4

As regulators step back from prescriptive AI rules, independent third-party verification and tokenized payment layers must fill the governance vacuum before bot-to-bot commerce can safely scale.

AI-assisted summary of The Future of Responsible AI: How Mastercard and RAI Institute Are Shaping Trustworthy Innovation — original source. Check the original for full context.

Source published:

Detailed notes

## Background Published by the Ai4 channel on YouTube on August 27, 2025, this video captures a fireside chat between Manoj Saxena, Founder and Chairman of the Responsible AI Institute, and Andrew Reiskind, Chief Data Officer at Mastercard. According to the page description, the session explores strategies for balancing AI innovation with robust governance, mitigating bias, and establishing industry standards for evaluating and deploying trustworthy AI systems in financial services and beyond.

## TL;DR Saxena and Reiskind examine the shift from generative models to agentic commerce, where autonomous consumer and merchant bots transact directly. To support this paradigm, Mastercard is developing foundational trust mechanisms like Agent Pay tokenization, bot authentication, intent verification, and dispute management protocols. Facing a regulatory verification vacuum, the discussion stresses the urgent need for independent third-party auditing frameworks, including the RAI Institute's Agent Code of Conduct and agent trust scoring. To build sustainable trust, enterprises must move beyond legacy structured data to govern unstructured training assets through synthetic testing and rigorous data hygiene.

## Atmosphere & style The session has the tone of an engaging, collegial dialogue between two seasoned industry leaders bringing practical architectural insight to emerging AI challenges. Saxena guides the discussion with vivid analogies—framing third-party verification as a 'FICO score for agents'—while Reiskind offers measured, pragmatic perspectives grounded in Mastercard's multi-decade technological evolution. The atmosphere is forward-looking and constructive, balancing excitement over agentic workflows with clear-eyed realism regarding enterprise data governance and safety guardrails.

## Key takeaways - [00:04](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=4s) Independent third-party verification is essential for AI systems to prevent technology providers from self-grading their own proprietary models. - [01:35](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=95s) Enterprise data governance must evolve from basic privacy into comprehensive data and tech principles that address predictive models, generative AI, and autonomous agents. - [01:35](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=95s) Because foundation models are opaque and widely deployed, enterprise users must collaborate through independent bodies to establish shared metrics rather than relying solely on vendor guardrails. - [04:01](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=241s) Agentic commerce transitions e-commerce into an ecosystem where autonomous consumer bots and merchant bots interact directly to execute search, procurement, and transactions. - [04:01](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=241s) Mastercard introduced Agent Pay to apply payment card tokenization to agentic commerce, preventing raw card credentials from being exposed during bot-to-bot interactions. - [05:54](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=354s) Key governance hurdles in agentic commerce include verifying authentic consumer intent, authenticating bot legitimacy, and establishing liability rules for agent-driven chargebacks. - [05:54](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=354s) Agentic ecosystems must be designed to prevent third-party large language models from disintermediating merchants while preserving customer loyalty and reward programs. - [08:04](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=484s) Repetitive, high-volume B2B procurement will adopt fully autonomous agent workflows faster than consumer commerce, which currently remains strictly human-in-the-loop. - [09:36](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=576s) Model Context Protocol (MCP) represents the next evolutionary communication layer after HTTP and APIs, necessitating standard data formatting and security guardrails for agent developers. - [12:27](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=747s) A global verification vacuum has prompted the creation of machine- and human-readable Agent Codes of Conduct that serve as verifiable compliance credentials and trust scores. - [15:02](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=902s) AI governance requires extending enterprise data hygiene beyond structured databases to manage unstructured assets and applying third-party compliance auditing modeled on EMV and PCI DSS. - [15:02](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=902s) Critical and logical thinking remains the most durable and essential human skill for navigating AI-driven industry transformation.

## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=4s) The Origins of the Responsible AI Institute and Mastercard's Partnership

Manoj Saxena opens the fireside chat by introducing Andrew Reiskind, Chief Data Officer at Mastercard, highlighting Mastercard as one of the earliest financial services members to lean into the Responsible AI Institute (RAI Institute). Providing background on the institute's formation nine years prior, Saxena recalls his time as the first general manager of IBM Watson, when the IBM board handed him the famous *Jeopardy!*-playing machine with the mandate: "Go build a business." As soon as Watson began entering commercial deployment, fundamental issues around trust and explainability immediately surfaced. Saxena recognized that the industry desperately needed an independent, third-party verifier to evaluate AI systems, rather than letting technology giants grade themselves. Without external validation, "people are self-marking their own homework," with IBM or Google simply claiming their respective AI models are great.

To solve this dilemma, Saxena founded the Responsible AI Institute, positioning it conceptually as a "J.D. Power of AI" or a "FICO score for your AI agent." He invites Reiskind to explain what prompted Mastercard to join as an early member and how the company approaches this responsibility.

- **Foundational Analogy**: Saxena compares the RAI Institute to established independent benchmarking authorities like J.D. Power or credit-scoring systems like FICO. - **Independent Verification**: Founded to counter the industry tendency where model creators evaluate their own proprietary systems without standardized third-party oversight.

---

[01:35](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=95s) Mastercard's Data Principles and the Need for Industry AI Standards

Andrew Reiskind outlines Mastercard's ongoing governance journey, noting that the AI governance team reports directly to him. Six to seven years prior, Mastercard established core data principles grounded in the philosophy that individuals own their data and the company bears the responsibility to manage and protect it transparently. Over time, these evolved into comprehensive "data and tech principles" to specifically encompass artificial intelligence, with governance frameworks continually updated as new paradigms—such as Generative AI—emerged.

```mermaid flowchart TD accTitle: Mastercard AI Governance and Standards Evolution subgraph Principles["1. Foundational Governance"] DP["Data Principles<br/>(User Data Ownership & Trust)"] --> DTP["Data & Tech Principles<br/>(Expanded to AI & GenAI)"] end

subgraph InternalExternal["2. Multi-Stakeholder Collaboration"] DTP --> Internal["Internal AI Governance Teams<br/>(Mastercard)"] DTP --> External["Independent Partners<br/>(Responsible AI Institute)"] end

subgraph Objective["3. Desired Outcome"] Internal & External --> Standards["Consensus-Based Standards & Metrics<br/>(Safe, Trustworthy, Brand-Protected AI)"] end ```

Reiskind emphasizes that despite strong internal development capabilities, no single company can establish solutions or standards in isolation. Because platform foundation models remain opaque, rapidly evolving, and applied across shifting use cases, organizations cannot rely solely on the platform vendors themselves for guardrails. Instead, enterprise users must unite through organizations like the RAI Institute to establish common metrics and objective standards. For Mastercard, responsible AI governance is essential to protecting customer trust and ensuring the brand continues to stand for safety and security.

- **Evolution of Principles**: Transitioned from general data handling principles to integrated "data and tech principles" covering predictive models, GenAI, and emerging agentic systems. - **Enterprise-Led Governance**: Focuses on collective standard-setting driven by enterprise deployers and users rather than relying exclusively on platform providers.

---

[04:01](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=241s) Defining Agentic Commerce: Transactions Between AI Agents

Turning to the rapid evolution from deep learning to foundation models, generative AI, and now agentic systems, Saxena asks Reiskind to define "agentic commerce" and discuss how his background across technology, legal, data, and AI sectors shapes his perspective. Reiskind defines agentic commerce as an environment where a consumer delegates tasks to an autonomous agent on their mobile device or computer to execute purchases or participate in any phase of the purchasing journey—including search, comparison, fraud detection, or dispute management.

Simultaneously, merchants and e-commerce platforms are deploying their own autonomous agents. This shifts the commerce model into an ecosystem where consumer bots and merchant bots interact directly to execute transactions. Just as Mastercard previously pioneered the infrastructure that made traditional e-commerce possible with payment cards, the company is now building the trust layer and payment mechanisms needed for agent-to-agent commerce. As a foundational first step, Mastercard launched "Agent Pay" approximately two months prior, introducing card tokenization so sensitive card credentials are never directly passed or exposed across autonomous agent interactions.

```mermaid flowchart LR accTitle: Agentic Commerce Transaction Flow subgraph ConsumerSide["Consumer Environment"] C["Consumer"] --> CA["Consumer Agent<br/>(Search & Procurement)"] end

subgraph TrustLayer["Mastercard Trust & Payment Layer"] AP["Agent Pay & Tokenization<br/>(Card numbers hidden)"] Auth["Identity & Bot Verification<br/>(Proof of authorization)"] end

subgraph MerchantSide["Merchant Environment"] MA["Merchant Agent<br/>(Catalog & Order Processing)"] --> M["Merchant"] end

CA <--> AP AP <--> Auth Auth <--> MA ```

- **Core Definition**: Transactions and purchasing workflows conducted via autonomous software agents acting on behalf of consumers and merchants. - **Agent Pay**: Mastercard's tokenized payment framework preventing the transmission of raw payment card numbers during automated bot-to-bot transactions.

---

[05:54](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=354s) Identity, Dispute Resolution, and Merchant Loyalty in Agentic Ecosystems

Reiskind explains that payment tokenization is merely step one of a far broader architectural challenge. In an automated agentic economy, critical verification questions arise: How does a user authenticate themselves to their bot? How does a merchant confirm that an incoming bot is legitimate and not a malicious actor? Furthermore, systems must confirm intent—verifying that when a user instructs a bot to buy "three pairs of sneakers," it does not mistakenly purchase "four sets of sheets."

Governance frameworks must also reinvent dispute resolution and chargebacks for autonomous contexts. If an erroneous transaction occurs, establishing liability becomes complex when merchants argue, "No, no, no, it was your agent that did that." In addition to transaction integrity, agentic commerce operates in a data-rich environment that threatens merchant loyalty programs. If third-party Large Language Model (LLM) agents manage the shopping journey, merchants risk disintermediation from their customers. Mastercard aims to ensure that consumers retain rewards and loyalty points while all participants maintain a fair and secure exchange of value.

- **Authentication & Authorization**: Ensuring cryptographic proof of bot identity and verifying that purchase instructions faithfully reflect consumer intent. - **Agentic Chargeback Frameworks**: Resolving liability disputes when autonomous agents execute unauthorized or misconfigured purchases. - **Ecosystem Protection**: Preventing merchant disintermediation by third-party LLM providers while preserving loyalty point mechanics and consumer protections.

---

[08:04](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=484s) Consumer Adoption and the Path to Trust: From Human-in-the-Loop to B2B Automation

Saxena observes that consumer skepticism toward agentic commerce mirrors the early days of the internet, when people swore they would "never in a million years" enter a credit card number online. When asked how trust will take root, Reiskind explains that consumer adoption currently remains strictly "human-in-the-loop." Sharing a personal anecdote, Reiskind describes using an agent to plan a vacation to Milan: he asked the model to search for hotels within a specific price range and amenity list, but would never permit the bot to finalize the booking autonomously. Instead, he preferred to be "persnickety," carefully checking the dates, filtering options, and confirming each selection himself.

```mermaid flowchart TD accTitle: Adoption Path for Agentic Commerce Trust subgraph B2BPath["B2B Acceleration (High Repetition)"] B1["Repetitive Business Tasks<br/>(e.g., 1,000 reams of paper/month)"] --> B2["Autonomous Agent Execution"] B2 --> B3["Proven Operational Trust"] end

subgraph ConsumerPath["Consumer Acceleration (High Oversight)"] C1["Human-in-the-Loop Search<br/>(e.g., Milan hotel discovery)"] --> C2["Manual Confirmation of Details"] C2 --> C3["Confidence from Workplace & Social Proof"] end

B3 --> C3 C3 --> Final["Broad Ecosystem Trust & Value-Added Services"] ```

However, Reiskind predicts that commercial adoption will move much faster in B2B environments driven by routine, repetitive procurement. A business purchasing a thousand reams of paper each month does not want an employee manually clicking through purchase orders every cycle; such tasks will be delegated to autonomous agents immediately. As users witness repetitive agentic transactions succeeding reliably in the workplace, they will bring that confidence into their personal lives, creating word-of-mouth validation across social networks. Saxena concurs, noting that trust will start with baseline, low-risk transactions before scaling into complex, value-added services.

- **Current Consumer Posture**: Cautious reliance on AI for discovery and filtering, requiring direct manual confirmation before checkout. - **B2B as the Catalyst**: High-frequency, repetitive business procurement (such as monthly office supplies) drives initial autonomous agent adoption. - **Diffusion of Trust**: Workplace success builds consumer confidence, driving broader market acceptance through practical familiarity and peer recommendations.

[09:36](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=576s) MCP as an Enabling Protocol and Establishing Ecosystem Guardrails

Manoj Saxena shifts the discussion toward emerging agentic protocols, specifically asking Andrew Reiskind how Mastercard views MCP (Model Context Protocol) as an enabling technology across various operational layers. Reiskind contextualizes MCP within Mastercard's long technological evolution. In the early days, communication between merchant and bank traveled over traditional phone lines. Over time, that infrastructure migrated to internet protocols like HTTP, SSL, and modern API standards. Now, MCP represents the next protocol layer. Reiskind emphasizes that while technology providers define the raw transport mechanisms, Mastercard's role is defining the underlying data standards: what data elements are strictly necessary to authorize a transaction, what payload is required for fraud prevention, and what precise formatting ensures security. As Chief Data Officer, Reiskind sees MCP opening up a richer data environment that unlocks advanced personalization and merchant-consumer value, provided rigorous standards are set.

Saxena notes how trust layers must naturally build from human trust to infrastructure/protocol trust, culminating in data trust. When asked about urgent governance bottlenecks—such as transaction completion versus rollbacks—Reiskind points out that while consumers are accustomed to e-commerce and mobile commerce (m-commerce), agentic commerce introduces new dynamics. Individual consumers already trust familiar merchants and will gradually trust agents with personal data. The real friction lies with agent developers who are accustomed to operating in an unstructured "wild west" rather than strictly regulated payment ecosystems. Mastercard's focus is establishing guardrails for safety and security, noting that while traditional merchant acceptance networks understand compliance, educating consumer-facing agent developers will be the steepest hurdle.

```mermaid flowchart LR accTitle: Evolution of Payment Network Protocols subgraph S1["1. Legacy Era"] A["Phone Lines / Analog Dial-up"] end subgraph S2["2. Digital & API Era"] B["Internet Protocols\n(HTTP / SSL / REST APIs)"] end subgraph S3["3. Agentic Commerce"] C["Model Context Protocol (MCP)\nRich Data Standards & Guardrails"] end A --> B B --> C ```

- **Protocol transition**: Mastercard previously transitioned payment messaging from phone lines to HTTP/SSL and structured APIs; MCP represents the next evolutionary protocol layer. - **Ecosystem friction**: Traditional merchant networks are already aligned with payment security, but consumer AI agent developers require substantial education to adapt to regulated ecosystem guardrails.

---

[12:27](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=747s) The Verification Vacuum: Codes of Conduct and Credit Scores for AI Agents

Saxena highlights a growing industry challenge: a "verification vacuum" in agent-to-agent interactions as global regulators in the US, UK, and elsewhere take a step back to avoid stifling innovation in the AI race. He describes the current corporate climate as being told to "jump out of the plane and stitch your own parachute as you're falling to the ground." In the absence of prescriptive government mandates, independent third-party verification becomes vital. To fill this void, the Responsible AI Institute is preparing to launch an **Agent Code of Conduct**.

Drawing an analogy to human employment, Saxena notes that human employees receive employee handbooks, undergo performance appraisals, and are overseen by HR departments—structures that currently do not exist for autonomous digital workers. The proposed Agent Code of Conduct functions as both a human-readable and machine-readable credential. For example, if a Mastercard agent interacts with Verizon's systems to pay a phone bill, it presents this credential to verify that its behavior has been independently audited and validated by the Responsible AI Institute. Saxena envisions this acting like a "FICO score" or a "LinkedIn for agents," establishing verified trust badges for autonomous interactions.

```mermaid flowchart TD accTitle: Agent Trust and Verification Architecture subgraph Agents["Autonomous Agents"] M["Mastercard Agent"] V["Verizon Billing Agent"] end subgraph Verification["Trust Framework (RAI Institute)"] C["Agent Code of Conduct\n(Machine- & Human-Readable)"] F["Agent Trust Badge / 'FICO Score'"] end M <-->|"Autonomous Transaction"| V M -.->|"Presents Credential"| C C -->|"Independent Validation"| F ```

- **Verification vacuum**: Governments are letting market forces steer rapid AI deployment, shifting the burden of safety validation onto enterprise builders and independent bodies. - **Agent Code of Conduct**: A dual human- and machine-readable specification serving as a digital worker handbook and compliance credential for agent-to-agent transactions. - **Digital trust scoring**: RAI Institute is developing an independent auditing framework analogous to credit scoring (FICO) or professional profiling (LinkedIn) for autonomous systems.

---

[15:02](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=902s) Unstructured Data Governance, Synthetic Testing, and Foundational Skills

Asked where enterprise leaders should begin building technical and business trust, Reiskind stresses that organizations must design agents to be measurable from day one. The central governance dilemma is that enterprise data management has historically revolved around structured data. Organizations lack mature tools and processes to govern unstructured data—such as decades of stale, unvetted PowerPoint presentations that are routinely ingested to train models. Reiskind draws parallels to established financial security frameworks like EMVCo and PCI DSS, which rely on third-party auditors to verify compliance. Applying a similar audit model to AI requires clean synthetic test datasets (question-answer pairs) and baseline data hygiene. He jokes that as a CDO he sees "everything as a data problem," while AI engineers consider it a "math problem."

Reflecting on his 17-year tenure at Mastercard spanning the transitions from e-commerce to m-commerce and now agent commerce, Reiskind expresses excitement for the career-defining challenge of structuring this new paradigm. When asked what single skill young professionals should cultivate amidst technological disruption, Reiskind points not to coding or static legal rules, but to fundamental **critical and logical thinking**. Saxena concludes by affirming that AI will ultimately highlight and elevate distinctly human qualities as the two organizations collaborate on shaping trustworthy AI frameworks.

- **Unstructured data challenge**: Unlike structured databases, enterprises have little experience tracking data quality, freshness, or lineage across unstructured assets (e.g., legacy presentation decks) used in AI training. - **Security standards precedent**: Established payment security models like EMV and PCI DSS demonstrate the viability and necessity of independent, third-party compliance auditing for agent ecosystems. - **Core future skill**: While technical programming and legal specifics rapidly become obsolete, critical and logical reasoning remains the most durable skill for navigating AI-driven industries.

## Notable quotes > [00:04](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=4s) Go build a business. — Manoj Saxena

> [00:04](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=4s) people are self-marking their own homework — Manoj Saxena

> [00:04](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=4s) J.D. Power of AI — Manoj Saxena

> [00:04](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=4s) FICO score for your AI agent — Manoj Saxena

> [05:54](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=354s) No, no, no, it was your agent that did that. — Andrew Reiskind

> [08:04](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=484s) never in a million years — Manoj Saxena

> [09:36](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=576s) wild west — Andrew Reiskind

> [12:27](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=747s) jump out of the plane and stitch your own parachute as you're falling to the ground. — Manoj Saxena

> [15:02](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=902s) everything as a data problem — Andrew Reiskind

> [15:02](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=902s) math problem — Andrew Reiskind

## Mentioned Manoj Saxena, Andrew Reiskind, Mastercard, Responsible AI Institute, IBM Watson, Jeopardy!, Google, J.D. Power, FICO, Agent Pay, Model Context Protocol (MCP), Verizon, LinkedIn, EMVCo, PCI DSS

## Video description Manoj Saxena, Founder and Chairman, Responsible AI Institute Andrew Reiskind, Chief Data Officer, Mastercard

Abstracts

As AI adoption accelerates, how can businesses ensure ethical, transparent, and responsible deployment? In this fireside chat, Responsible AI Institute founder and chairman, Manoj Saxena, and Mastercard's Chief Data Officer, Andrew Reiskind—representing Mastercard as a RAI Institute member—will discuss the critical role of responsible AI in financial services and beyond. They'll explore strategies for balancing innovation with governance, mitigating risks like bias, and setting industry standards for trustworthy AI.

With the increasing need for evaluation and validation of these dynamic AI systems, this discussion becomes particularly relevant for organizations navigating the complex AI landscape. Join this insightful discussion on how organizations can lead the way in shaping a responsible AI future.

[Source](https://www.youtube.com/watch?v=omYKgmW9Vkw)

中文简报

Mastercard与RAI Institute为自主智能体商业设立护栏 随着监管机构不再推行规定性AI规则，在机器对机器（bot-to-bot）商业能够安全规模化之前，独立的第三方验证和标记化支付层必须填补这一治理真空。 Saxena和Reiskind探讨了从生成式模型向智能体商业的转变，在这种模式下，自主消费者机器人与商家机器人可以直接进行交易。为支持这一范式，Mastercard正在开发基础信任机制，例如Agent Pay标记化、机器人身份验证、意图验证以及争议管理协议。面对监管验证的真空，讨论强调了对独立第三方审计框架的迫切需求，其中包括RAI Institute的《智能体行为准则》和智能体信任评分。为了建立可持续的信任，企业必须超越传统的结构化数据，通过合成测试和严格的数据清洗来治理非结构化训练资产。 针对基础模型缺乏透明度以及技术厂商“自我打分”的弊端，Mastercard 与 Responsible AI Institute 呼吁企业必须通过独立第三方机构制定统一的标准与评估指标，而非单纯依赖供应商自设的护栏。 (1:35) 随着电子商务转向消费者智能体与商户智能体直接交互的“智能体商务”（Agentic Commerce），Mastercard 推出 Agent Pay 机制，利用支付卡 Token 化防止敏感卡号在 Bot 对 Bot 交易中暴露。 (4:01) 智能体商务正面临用户真实意图核实、Bot 身份认证及退款归责等治理难题；目前消费端仍严格保持“人在回路”，但高频重复的 B2B 采购流程将率先实现完全自主化落地。 (8:04) 面对全球监管机构暂缓干预所带来的“验证真空”，RAI Institute 正准备推出兼具人类与机器可读特性的“智能体行为准则”（Agent Code of Conduct），为自主 Agent 打造类似 FICO 信用分的第三方独立合规认证体系。 (12:27)

Reading summary

As autonomous artificial intelligence shifts commerce toward direct agent-to-agent transactions, Mastercard and the Responsible AI Institute argue that industry-led standards, tokenized payments, and independent auditing are essential to fill a growing regulatory and verification vacuum. Independent Auditing and the AI Verification Vacuum (0:04) Responsible AI Institute founder Manoj Saxena contends that the artificial intelligence sector suffers from a fundamental conflict of interest where platform creators evaluate their own proprietary models rather than submitting to third-party oversight. Because regulators in jurisdictions such as the United States and the United Kingdom have stepped back to prevent stifling technological competition, enterprises face a verification vacuum in which they must deploy systems without standardized public guardrails. To address this gap, Saxena compares the institute's role to an independent benchmark like J.D. Power or a FICO credit score for digital agents. The organization is preparing an Agent Code of Conduct—designed as a machine- and human-readable credential—that acts like an employee handbook and compliance badge. This credential allows autonomous agents, such as a Mastercard system interacting with a telecom provider to pay a bill, to present verifiable proof of third-party audit and behavioral compliance before executing tasks. Payment Protocols and Tokenization in Agentic Commerce (4:01) Mastercard Chief Data Officer Andrew Reiskind defines agentic commerce as an ecosystem where consumers and merchants delegate search, comparison, procurement, and dispute management to autonomous software agents interacting directly. To prevent sensitive financial exposure during bot-to-bot transactions, Mastercard launched Agent Pay, which uses card tokenization to hide raw payment card numbers during autonomous exchanges. Reiskind views emerging standards like the Model Context Protocol (MCP) as the next stage in payment infrastructure evolution, progressing from legacy phone lines to internet protocols like HTTP, SSL, and modern APIs. While technology companies engineer the transport protocols, Mastercard focuses on establishing underlying data standards—defining what transaction payloads, fraud metrics, and data elements are necessary to authorize payments securely. A primary operational hurdle remains educating consumer-facing agent developers, who are accustomed to unstructured environments, on regulated payment guardrails. Identity Authentication, Liability, and Adoption Paths (5:54) Beyond payment tokens, autonomous transactions require technical mechanisms to authenticate bot identities, confirm incoming agents are legitimate, and verify that executed purchases accurately reflect user intent. Reiskind emphasizes that the industry must reinvent dispute resolution and chargeback rules for autonomous commerce to resolve situations where merchants and consumers contest whether an agent operated under authorization or misconfigured instructions. Furthermore, systems must ensure third-party model providers do not disintermediate merchants from their customer loyalty programs. Regarding market adoption, Reiskind predicts that consumer use will remain cautious and human-in-the-loop for personal commitments, such as verifying hotel bookings manually. In contrast, adoption will accelerate first in high-frequency, repetitive business-to-business procurement—such as automated monthly office supply orders. As enterprise workers witness autonomous agents executing routine corporate transactions reliably, that familiarity is expected to build the trust necessary for broader consumer acceptance. Unstructured Data Governance and Enterprise Readiness (15:02) Reiskind notes that building technical and business trust requires enterprises to make artificial intelligence measurable from inception. Historically, corporate governance frameworks were built around structured databases, leaving organizations ill-equipped to govern unstructured assets—such as decades of stale, internal presentations routinely ingested to train models without tracking provenance, quality, or freshness. To establish scalable governance, Reiskind points to financial security precedents like EMVCo and PCI DSS, which rely on external third-party auditors and standardized synthetic test datasets composed of question-answer pairs. While engineering teams frequently approach AI performance as a mathematical challenge, Reiskind frames system reliability as a fundamental data governance issue, concluding that durable human skills like critical and logical thinking will remain more essential for future workforces than learning ephemeral coding syntax. Mastercard and the Responsible AI Institute conclude that establishing trust in autonomous agent commerce requires combining payment-level tokenization with external accreditation akin to credit ratings. However, unresolved challenges persist, particularly in creating enforceable liability rules for agent purchasing errors, educating developer communities on financial compliance, and establishing mature tools to audit unstructured enterprise data.

精炼阅读摘要

Mastercard 首席数据官 Andrew Reiskind 与负责任人工智能研究所（RAI Institute）创始人 Manoj Saxena 提出，随着 AI 演进至自主代理式商业阶段，行业必须建立超越模型开发者自我评估的第三方验证机制与数据安全标准，以解决代理身份验证、交易确责及非结构化数据治理等信任难题。 第三方独立验证与企业治理标准 (0:04) Saxena 回顾主导 IBM Watson 商业化落地的经验，指出大型科技公司缺乏外部验证时倾向于“给自己的作业打分”，导致模型在实际部署中的可信度与可解释性存疑，因此行业需要类似 J.D. Power 或 FICO 评分的第三方独立评估机构。Reiskind 表示，Mastercard 内部的人工智能治理框架基于确立于六至七年前的原则，已从早期强调用户数据所有权演进为涵盖生成式 AI 的“数据与技术原则”。 Reiskind 强调，底层基础模型具有不透明性且更替迅速，仅靠模型供应商自设安全防线并不充分。单一企业无法孤立解决标准问题，作为部署方的企业机构必须通过 RAI Institute 等平台形成共识，制定通用的客观评估指标与治理护栏，以确保系统在品牌声誉和安全合规层面的可控性。 代理式商业定义与底层支付协议升级 (4:01) Reiskind 将代理式商业定义为消费者与商户各自委托自主代理软件执行搜索、比价、欺诈识别、支付及争议处理的交互生态。为支撑这种“代理对代理”的自动化交易，Mastercard 在两个月前推出了“Agent Pay”框架，通过卡号代币化技术隐藏敏感凭证，避免在智能体自主交互过程中暴露底层卡号。 在技术通信演进方面，Reiskind 将 MCP（Model Context Protocol）视作支付通信从早期电话拨号、HTTP/SSL 到现代 API 之后的下一代协议层。他指出，技术提供方负责构建传输通道，而 Mastercard 的角色在于规范底层数据标准，明确授权认证与反欺诈风控所需的数据负载与加密格式，以支持更高维度的个性化价值交换。 身份核验、交易纠纷与商户生态保护 (5:54) Reiskind 认为支付代币化仅是基础，代理式经济更关键的挑战在于身份验证与意图校准——系统既要验证终端代理是否合法，还需防范代理执行偏差（例如将购买三双球鞋误操作为四套床单）。与此同时，现行争议裁决与退单机制必须重构，以解决交易失误时商户与代理开发者之间的责任归属争议。 针对第三方大模型代理可能带来的商户脱媒风险，Mastercard 旨在维护原有的忠诚度积分与奖励机制，保障商户与消费者的直接连接。Reiskind 补充指出，相较于已习惯严格合规流程的传统商户网络，缺乏受监管环境运作经验的消费端代理开发者构成了当前生态规则适配的主要阻力。 信任演进路径：B2B采购驱动消费采纳 (8:04) 面对消费者对自动化交易的警惕心理，Reiskind 指出当前个人用户仍严格坚持“人在回路（Human-in-the-loop）”模式，仅将代理用于信息搜索和筛选，在最终下单阶段仍会手动核对细节（例如其本人使用代理规划米兰度假行程时的谨慎态度）。 Reiskind 预测，企业端高频且重复的常规采购（例如每月定期订购一千令复印纸）将率先实现代理全流程接管。随着员工在工作环境中建立起对代理自动执行的可靠性认知，这种信任将通过社交网络与工作习惯外溢至个人消费场景；Saxena 亦认同生态信任通常从低风险基线交易起步，再逐步向高附加值服务拓展。 代理行为准则与非结构化数据治理 (12:27) Saxena 指出，因各国监管部门为鼓励创新而暂缓推行硬性干预，企业目前面临合规制度真空，不得不“边跳伞边缝制降落伞”。对此，RAI Institute 正在制定兼具机器可读性与人类可读性的“代理行为准则（Agent Code of Conduct）”，作为代理交互时的合规数字凭证，以实现类似员工手册或履职资质的独立审计背书。 在企业落地层面，Reiskind 提示企业必须在代理设计之初嵌入可度量性，并解决非结构化数据治理的短板——相较于成熟的结构化数据库管理，企业大量用于模型训练的非结构化历史资料（如长期沉淀的 PPT 文档）往往缺乏质量、时效性及血缘追溯。他建议借鉴金融支付领域的 EMVCo 和 PCI DSS 第三方合规审计模式，通过构建合成测试数据集夯实数据卫生，并强调批判性与逻辑思维是应对技术变局的最核心能力。 代理式商业将支付体系推向全自动化交互阶段，但技术落地仍受制于多重现实瓶颈，包括企业内部非结构化训练数据的治理缺陷、自动化退单责任界定的缺失，以及外部开发者的合规意识不足。尽管 Mastercard 与 RAI Institute 试图通过代币化、MCP 数据标准及代理行为准则建立信任层，但在全球监管暂未出台硬性框架的背景下，这套依靠第三方自律与行业共识构筑的治理机制能否有效约束更广泛的市场参与者，仍有待长期检验。

Detailed notes — zh

## Background 本内容由 Ai4 于 2025 年 8 月 27 日发布在 YouTube 平台上。视频记录了负责任人工智能研究所（Responsible AI Institute）创始人兼主席 Manoj Saxena 与万事达卡（Mastercard）首席数据官 Andrew Reiskind 的炉边对话，深入探讨了在 AI 快速普及背景下，金融服务行业如何平衡创新与治理、化解偏见风险，并制定可信 AI 的行业标准。 ## TL;DR 对话围绕负责任 AI 治理、第三方独立验证的必要性以及“智能体商务”（Agentic Commerce）的前沿变革展开。万事达卡首席数据官 Andrew Reiskind 介绍了企业从数据原则向 AI 治理演进的历程，并阐述了包括“Agent Pay”代币化支付方案在内的落地实践。双方深入剖析了智能体交易中的身份认证、争议拒付重塑、MCP 协议演进及非结构化数据治理等现实挑战。面对当前监管落后于创新的真空期，RAI Institute 倡导建立类似于数字员工“行为准则”与信用评分的独立认证体系，共同推动从电商、移动商务向智能体商务的安全跃迁。 ## Atmosphere & style 整场炉边谈话专业严谨而不失轻松风趣，两位资深从业者既有对行业宏观演进的高屋建瓴，也有对具体业务痛点的深刻洞察。Manoj 善用“自己给自己批改作业”和“跳出飞机在下坠中缝降落伞”等生动比喻揭示行业困局，Andrew 则结合 17 年的支付治理沉淀和个人度假等鲜活案例从容回应。对话在探讨技术黑盒与监管挑战时充满审慎与危机意识，但在展望智能体商务未来与人才核心素养时又洋溢着理性的乐观与探索激情。 ## Key takeaways - [00:04](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=4s) 负责任 AI 亟需建立独立的第三方评估基准，避免企业在缺乏外部监督的情况下“自己给自己批改作业”。 - [01:35](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=95s) 面对 AI 模型的黑盒属性与动态变化，企业需携手第三方机构与行业同仁共建可量化的治理标准与安全底线。 - [03:47](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=227s) 商业形态正向智能体商务（Agentic Commerce）演进，万事达卡通过 Agent Pay 的代币化技术构筑机器间交互的安全基石。 - [05:54](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=354s) 智能体交易生态需要重塑争议拒付（Chargeback）规则与身份认证架构，并防止大型模型平台对商户产生脱媒侵蚀。 - [07:25](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=445s) 大众对 AI 支付的信任将循序渐进，标准化、高重复性的 B2B 采购场景将比个人消费更早实现智能体全自主下单。 - [09:36](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=576s) 支付通信协议正从传统 API 迈向 MCP（模型上下文协议）等新型智能体标准，金融机构的核心职责在于确立数据格式与防欺诈规范。 - [11:01](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=661s) 新兴智能体开发者普遍缺乏强合规经验，金融生态必须设立严格的安全防护栏以规范处于“狂野西部”状态的生态参与者。 - [12:27](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=747s) 在政府监管细则缺位的情况下，RAI Institute 推出“智能体行为准则”，为数字员工建立兼具人机可读的信用凭证与合规评级。 - [15:02](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=902s) 非结构化数据治理是构建可信 AI 的最大痛点，AI 治理可借鉴 EMVCo 与 PCI DSS 等成熟金融标准的第三方独立审计机制。 - [17:18](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=1038s) 商业范式正经历从电商、移动电商到智能体商业的跨越，批判性与底层逻辑思维是从业者应对 AI 变革的最核心能力。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=4s) 负责任 AI 的起源与第三方评估的必要性 对话伊始，负责任人工智能研究所（Responsible AI Institute，简称 RAI Institute）创始人兼主席 Manoj Saxena 热情介绍了同台嘉宾——来自万事达卡（Mastercard）的首席数据官 Andrew Reiskind，并指出万事达卡是该研究所最早的成员之一。Manoj 回顾了自己创办该非营利组织的初衷：早在九年前，业界甚至还没有对“负责任 AI”形成明确定义时，他正担任 IBM Watson 的首任总经理。当时 IBM 董事会将刚刚赢得《危险边缘》（Jeopardy!）人机问答大赛的超级计算机交到他手中，要求他以此开拓商业化业务。在推进过程中，团队立刻遭遇了 AI 系统在信任度和可解释性方面的严重瓶颈。 Manoj 敏锐地意识到，AI 领域亟需一个独立的第三方验证机构。如果缺乏外部客观评估，各家厂商无异于“自己给自己批改作业”——IBM 会宣称自己的 AI 完美无瑕，Google 也会自夸技术卓越。正是为了打破这种自说自话的局面，负责任 AI 研究所应运而生。Manoj 将研究所的角色生动地比作“AI 领域的 J.D. Power”或“AI 智能体的 FICO 信用评分”，旨在为行业建立客观公正的评估基准，而万事达卡正是金融服务领域中最早积极响应并深度参与这一倡议的标杆企业。 ### [01:35](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=95s) 万事达卡的 AI 治理演进与行业标准诉求 万事达卡首席数据官 Andrew Reiskind 阐述了负责 AI 治理团队向其汇报的架构，并分享了万事达卡在数据与技术治理方面的演进历程。早在六七年前，万事达卡就确立了一套核心数据原则，明确主张“数据的所有权属于用户本身”，而企业的职责是以高度可信的方式管理与处理这些数据。随着技术演进，这套理念进一步扩展为“数据与技术原则”，将专门的 AI 治理体系纳入其中，并在生成式 AI（Gen AI）浪潮爆发后持续进行动态迭代。 ```mermaid flowchart TD accTitle: 万事达卡 AI 治理与生态协作演进 subgraph Governance["治理演进路径"] A["6-7 年前：确立数据原则<br/>（用户数据所有权与信任治理）"] --> B["演进为数据与技术原则<br/>（纳入 AI 专属治理体系）"] B --> C["生成式与智能体 AI 阶段<br/>（动态应对不可解释与黑盒风险）"] end subgraph Partnership["行业协同与标准"] D["内部研发与探索"] <--> E["携手第三方机构<br/>（如 RAI Institute）"] E --> F["联合行业同仁制定客观标准<br/>（衡量安全、可信与品牌声誉）"] end C -.-> E ``` Andrew 强调，尽管万事达卡内部团队在开发新解决方案方面表现出色，但企业绝不可能单打独斗，也不是所有标准与方案的唯一主导者。AI 模型本身往往缺乏透明度且处于黑箱状态，底层模型与实际用例又在日新月异地变化。面对这种高度动态的不确定性，企业亟需与 RAI Institute 等可信伙伴及同业携手共建行业标准。对于万事达卡这样将“信任、安全与保障”视为生命线的品牌而言，唯有建立量化指标与明确基准，才能切实保障客户权益并守护自身品牌声誉。 ### [03:47](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=227s) 智能体商务的前沿定义与 Agent Pay 实践 随着技术重心从深度学习、基础模型、生成式 AI 快速迈向智能体 AI（Agentic AI），Manoj 将话题引向了一个极具颠覆性的新概念——“智能体商务”（Agentic Commerce）。Andrew 解释称，智能体商务是指消费者通过手机或电脑上的 AI 智能体来执行搜索、下单、欺诈争议处理等全流程或部分交易环节的商业形态。目前，不仅诸多电商平台在商户端部署了智能体，消费者端也已在各类生成式 AI 工具中广泛接触到智能体功能。 未来的商业交易正在演变为“消费者的智能体”与“商家的智能体”之间的直接对话。Andrew 回顾道，万事达卡当年通过信用卡与支付卡网络奠定了传统电子商务（E-Commerce）的基石；而如今面对机器与机器交互的智能体时代，万事达卡正致力于构建新一代交易底座。作为切入点，万事达卡在大约两个月前推出了“Agent Pay”理念，核心在于通过卡号代币化（Tokenization）技术，确保交易过程中绝不泄露真实卡号，防止支付凭证在智能体通信中丢失或被盗，为更为复杂的智能体商业生态打下第一道安全地基。 ### [05:54](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=354s) 智能体交易生态的信任、认证与商业博弈 Agent Pay 仅是万事达卡进军智能体生态的起点，在底层支付安全之上，还存在一整套亟待解决的身份认证与信任架构难题。Andrew 抛出了一连串切中行业要害的现实挑战：消费者如何向自己的专属 Bot 证明身份？商家又如何确信接入的 Bot 并非恶意程序？在具体交易中，系统如何确证用户确实是想买“三双球鞋”而不是被错误下单为“四套床单”？ ```mermaid flowchart LR accTitle: 智能体商务交互与争议处理流 subgraph UserSide["消费者端"] U["消费者"] -->|身份认证与授权| UA["消费者专属智能体"] end subgraph Transact["智能体交互与支付网络"] UA <-->|Agent Pay 代币化支付| MA["商户端智能体"] MA <-->|清算、积分与安全验证| MC["万事达卡支付生态"] end subgraph MerchantSide["商户与权益"] MA --> M["电商商户"] MC -->|防止被 LLM 平台脱媒| M end ``` 这种全新的交易模式也给传统金融规则带来了深刻冲击： - **争议与拒付机制（Chargeback）重塑**：当交易由智能体自主发起时，退款与拒付规则必须重写。如果消费者声称某笔交易并非本意，而商家坚称“这正是你的智能体发出的指令”，责任界定将面临全新考验。 - **数据富集与权益兑换**：在智能体主导的超丰富数据环境中，系统如何确保消费者的忠诚度积分（Loyalty Points）能够无缝累积与自动抵扣。 - **防止商户“脱媒”（Disintermediation）**：商户普遍担忧大型语言模型（LLM）平台及其智能体掌控交易入口，从而切断商户与消费者的直接联系。万事达卡的目标是维护一个公平、安全的生态，让消费者获得最大价值的同时，确保商户的品牌粘性与商业价值不被中间平台侵蚀。 ### [07:25](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=445s) 从“人在回路”到高频自动化：信任建立的演进路径 Manoj 感慨地回忆起互联网早期，公众曾一度坚决抵制在线支付，声称“打死我也绝不会把信用卡号输入到网站上”，而如今这已成为习以为常的生活方式，下一代人更将在智能体普及的世界中成长。面对当下的智能体商务，公众是否已经准备好将信用卡全权托付给 AI 去自主购物？ Andrew 分析认为，绝大多数普通消费者目前仍处于“人在回路”（Human in the loop）的谨慎阶段。他以自身的度假经历举例：当他计划前往米兰度假时，会让 AI 智能体根据价格区间和服务要求去检索并推荐酒店列表，但他“绝不会直接授权它替我下单付款”。他会亲自对备选方案进行细致筛选，严格核对每一条预订日期和细节。然而，在企业级采购或高频重复场景中（例如企业每月固定采购一千箱打印纸），管理者不会愿意每次都手动审批，这类标准化、高重复性的交易将率先实现智能体全自主下单。正是通过 B2B 和日常低风险业务的持续验证，智能体交易的信任感将逐步沉淀并扩散至个人消费生活之中。 ### [09:36](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=576s) MCP 协议与支付通信的演进：从电话线到 Agent 数据标准 在探讨新兴技术时，Manoj Saxena 邀请 Andrew Reiskind 分享万事达卡（Mastercard）对 MCP（Model Context Protocol / 模型上下文协议）等前沿使能技术的看法。Andrew 回顾了万事达卡的通信演进史：最早银行与商户之间的通信完全依赖电话线路；随后行业转向基于 HTTP、SSL 等互联网协议；而如今，随着 AI 智能体的普及，技术底层正在迈向以 MCP 为代表的新一代交互协议。虽然 Andrew 调侃自己总记不清各种协议缩写，但他强调，当年万事达卡推行 API 时，就曾制定过严格的数据标准——明确完成交易必须包含哪些数据、防欺诈需要校验什么字段以及数据格式规范。在 MCP 时代，这套标准化逻辑同样适用，且环境中的数据维度将变得更加丰富。作为首席数据官，他非常兴奋地看到这一趋势在防止欺诈、提供高度个性化以及为商户和消费者创造新价值方面的潜力。万事达卡的定位并非直接定义底层基础技术，而是让科技厂商去推动技术实现，万事达卡则专注于确立行业标准与规则。 ```mermaid flowchart LR accTitle: 支付通信协议与数据标准的演进历程 subgraph S1["通信基础设施演进"] A["早期阶段<br/>电话线路通讯"] --> B["互联网时代<br/>HTTP / SSL 协议"] B --> C["API 时代<br/>API 接口与结构化标准"] C --> D["AI Agent 时代<br/>MCP 协议与丰富数据环境"] end subgraph S2["核心治理重点"] D --> E["交易完整性与安全"] D --> F["反欺诈与风险识别"] D --> G["个性化与生态价值"] end ``` - **协议迭代历程**：电话网络 $\rightarrow$ 互联网 HTTP/SSL $\rightarrow$ 开放 API $\rightarrow$ MCP 新型智能体上下文协议。 - **数据治理职责**：技术厂商定义技术实现，金融网络负责制定数据格式、交易安全与防欺诈标准。 --- ### [11:01](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=661s) 数据治理挑战：从“狂野西部”到受监管的生态网络 Manoj 指出，从人类信任、协议信任再到数据信任，当前数据治理面临着重大考验。谈及智能体流程中最紧迫的数据挑战（如交易完成、事务回滚等），Andrew 认为，消费者在移动商务（m-commerce）和电子商务（e-commerce）时代已经习惯向信任的知名商户提供个人数据，未来他们也会逐渐信任代表自己的 AI 智能体。真正严峻的挑战在于**智能体提供商**（Agent Providers）——这些新兴玩家此前习惯于不受约束的“狂野西部”（Wild West）环境，极度缺乏在强合规金融生态中运作的经验。 因此，万事达卡等机构必须为这片“狂野西部”设立防护栏（Guardrails），明确告诉生态参与者：如果想进入一个讲求安全可靠的生态系统，就必须严格遵守对应的数据与安全标准。在技术受理侧（商户端），传统技术供应商通常具备合规意识；但面向普通消费者的 Agent 提供端，未来将面临最艰巨的市场教育门槛。 - **信任基础的承袭**：消费者对传统电商的信任正迁移至可信商户的数字代理上。 - **治理断层所在**：Agent 开发者习惯了自由生长的“狂野西部”，亟须接入具备严格合规与安全防护栏的金融生态。 --- ### [12:27](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=747s) 监管真空与 AI Agent 的“数字员工行为准则” 针对智能体信任体系的建立，Manoj 提出了一个核心痛点：当前全球监管机构（包括美、英等国）在 AI 军备竞赛中倾向于让市场自由决定，甚至某种程度上退后了一步，导致企业在构建智能体（对内使用或 Agent-to-Agent 交互）时陷入了“验证真空”（Verification Vacuum）。这就像要求企业“一边跳出飞机，一边在下坠过程中缝制自己的降落伞”（"jump out of the plane and you stitch your own parachute as you're falling to the ground"）。在缺乏官方监管细则的情况下，第三方独立验证机构的角色变得极为关键。 为此，责任人工智能研究所（Responsible AI Institute）正在筹备推出一项名为 **Agent Code of Conduct（智能体行为准则）** 的机制。Manoj 用“数字人类/数字员工”与真实员工做类比：当实体员工入职时，会有员工手册、行为准则、HR 部门以及定期的绩效考核，但目前针对 AI Agent 却没有任何类似 HR 的治理部门。该准则将生成一份兼具人类可读与机器可读的凭证： ```mermaid flowchart TD accTitle: Agent 行为准则与跨机构信任验证流程 subgraph G1["发起端"] A["万事达卡 Agent<br/>(Mastercard Agent)"] end subgraph G2["独立验证与信誉评级"] B["第三方认证机构<br/>(RAI Institute)"] B -. 颁发合规徽章与信用评级.-> A end subgraph G3["接收端与交易执行"] C["电信服务商 Agent<br/>(如 Verizon Agent)"] end A -- "出示机器可读的行为准则与合规徽章" --> C C -- "确认身份与行为合规后完成账单支付" --> A ``` - **验证真空问题**：政府监管缺位倒逼第三方独立机构提供客观合规标准。 - **Agent 信用评级体系**：RAI Institute 致力于打造类似于 Agent 领域的“FICO 信用评分”或“LinkedIn 职业档案”，通过合规徽章（Compliance Badges）为跨实体智能体交互提供信任背书。 --- ### [15:02](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=902s) 非结构化数据挑战与金融级安全审计标准 对于企业首席数据官（CDO）或技术负责人而言，构建 Agent 信任体系应该从何切入？Andrew 指出，首要基石是建立可衡量其信任度的体系，而最大的难点在于**非结构化数据治理**。业界多年来早已熟练掌握结构化数据的管理与治理，但对于非结构化数据却缺乏成熟规范——比如企业多年来积累了无数 PowerPoint 演示文稿，没有任何人能确切说明哪些内容已过时、哪些内容是高质量或有缺陷的，然而这些文档却被直接用来训练或调优模型。 此外，随着测试与验证深入，AI 的测试往往需要问答对（QA pairs），这也引出了合成数据（Synthetic Data）的可信度问题。Andrew 幽默地指出，数据官眼中“一切都是数据问题”，而 AI 专家眼中“一切都是数学问题”。万事达卡长期遵循 EMVCo、PCI DSS 等金融支付安全标准，并依赖第三方独立审计确保合规。他认为智能体治理也必须借鉴这一模式，从基础的基线数据治理出发，构建标准并实施第三方验证，从而让生态参与者和监管机构都能对安全性感到放心。 - **非结构化数据黑盒**：缺乏评估非结构化语料质量与时效性的有效手段，这是数据负责人的首要担忧。 - **金融成熟模式的迁移**：将 EMVCo / PCI DSS 的标准化与独立第三方审计模式引入 AI 治理。 --- ### [17:18](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=1038s) 商业演进的未来与青年人才的核心竞争力 谈及未来最让人兴奋的前景，Andrew 分享了自己在万事达卡工作 17 年的亲身经历。他目睹了整个商业形态从传统的电子商务（e-commerce）演变为移动商务（m-commerce），如今正阔步迈入**智能体商业（Agent Commerce）**时代。每一次技术范式迁移都伴随着全新的挑战、机遇与技术重构，而这些充满未知的难题也将成为支撑他未来职业生涯的动力。 在对青年从业者的职业建议环节，Manoj 与 Andrew 一致认为，在 AI 浪潮下最核心、最具复原力的能力是**批判性与逻辑性思维**（Critical and logical thinking）。单纯学习写代码在未来两三年内是否依然保持原有价值仍未可知，法律条文也会随时代淘汰，但严谨的底层逻辑思考能力永远不会过时。Manoj 总结道，AI 的发展最终将促使人类回归更具人性化的本质，双方期待携手共同推进可信 AI 网络的建设。 - **三大商务范式跃迁**：e-commerce（电商） $\rightarrow$ m-commerce（移动电商） $\rightarrow$ agent commerce（智能体商业）。 - **终极技能建议**：掌握底层批判性与逻辑思维，应对编程工具与行业规则快速迭代带来的不确定性。 ## Notable quotes > [00:04](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=4s) 各家厂商无异于“自己给自己批改作业”——IBM 会宣称自己的 AI 完美无瑕，Google 也会自夸技术卓越。正是为了打破这种自说自话的局面，负责任 AI 研究所应运而生。 — Manoj Saxena > [01:35](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=95s) 数据的所有权属于用户本身 — Andrew Reiskind > [01:35](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=95s) 尽管万事达卡内部团队在开发新解决方案方面表现出色，但企业绝不可能单打独斗，也不是所有标准与方案的唯一主导者。 — Andrew Reiskind > [07:25](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=445s) 打死我也绝不会把信用卡号输入到网站上 — Manoj Saxena > [07:25](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=445s) 绝不会直接授权它替我下单付款 — Andrew Reiskind > [11:01](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=661s) 真正严峻的挑战在于智能体提供商——这些新兴玩家此前习惯于不受约束的“狂野西部”环境，极度缺乏在强合规金融生态中运作的经验。 — Andrew Reiskind > [12:27](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=747s) jump out of the plane and you stitch your own parachute as you're falling to the ground — Manoj Saxena > [15:02](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=902s) 数据官眼中“一切都是数据问题”，而 AI 专家眼中“一切都是数学问题”。 — Andrew Reiskind > [17:18](https://www.youtube.com/watch?v=omYKgmW9Vkw&t=1038s) 单纯学习写代码在未来两三年内是否依然保持原有价值仍未可知，法律条文也会随时代淘汰，但严谨的底层逻辑思考能力永远不会过时。 — Andrew Reiskind ## Mentioned Manoj Saxena, Andrew Reiskind, Responsible AI Institute, Mastercard, IBM Watson, Jeopardy!, Google, J.D. Power, FICO, Agent Pay, MCP, Verizon, EMVCo, PCI DSS, LinkedIn ## Video description Manoj Saxena, Founder and Chairman, Responsible AI Institute Andrew Reiskind, Chief Data Officer, Mastercard Abstracts As AI adoption accelerates, how can businesses ensure ethical, transparent, and responsible deployment? In this fireside chat, Responsible AI Institute founder and chairman, Manoj Saxena, and Mastercard's Chief Data Officer, Andrew Reiskind—representing Mastercard as a RAI Institute member—will discuss the critical role of responsible AI in financial services and beyond. They'll explore strategies for balancing innovation with governance, mitigating risks like bias, and setting industry standards for trustworthy AI. With the increasing need for evaluation and validation of these dynamic AI systems, this discussion becomes particularly relevant for organizations navigating the complex AI landscape. Join this insightful discussion on how organizations can lead the way in shaping a responsible AI future. [Source](https://www.youtube.com/watch?v=omYKgmW9Vkw)

Source quotes

[0:04] Manoj Saxena: 各家厂商无异于“自己给自己批改作业”——IBM 会宣称自己的 AI 完美无瑕，Google 也会自夸技术卓越。正是为了打破这种自说自话的局面，负责任 AI 研究所应运而生。 [1:35] Andrew Reiskind: 数据的所有权属于用户本身 [1:35] Andrew Reiskind: 尽管万事达卡内部团队在开发新解决方案方面表现出色，但企业绝不可能单打独斗，也不是所有标准与方案的唯一主导者。 [7:25] Manoj Saxena: 打死我也绝不会把信用卡号输入到网站上 [7:25] Andrew Reiskind: 绝不会直接授权它替我下单付款 [11:01] Andrew Reiskind: 真正严峻的挑战在于智能体提供商——这些新兴玩家此前习惯于不受约束的“狂野西部”环境，极度缺乏在强合规金融生态中运作的经验。 [12:27] Manoj Saxena: jump out of the plane and you stitch your own parachute as you're falling to the ground [15:02] Andrew Reiskind: 数据官眼中“一切都是数据问题”，而 AI 专家眼中“一切都是数学问题”。 [17:18] Andrew Reiskind: 单纯学习写代码在未来两三年内是否依然保持原有价值仍未可知，法律条文也会随时代淘汰，但严谨的底层逻辑思考能力永远不会过时。

Source quotes

[0:04] Manoj Saxena: Go build a business. [0:04] Manoj Saxena: people are self-marking their own homework [0:04] Manoj Saxena: J.D. Power of AI [0:04] Manoj Saxena: FICO score for your AI agent [5:54] Andrew Reiskind: No, no, no, it was your agent that did that. [8:04] Manoj Saxena: never in a million years [9:36] Andrew Reiskind: wild west [12:27] Manoj Saxena: jump out of the plane and stitch your own parachute as you're falling to the ground. [15:02] Andrew Reiskind: everything as a data problem [15:02] Andrew Reiskind: math problem

Original transcript

[0:04] I'm delighted to um have here on stage [0:06] with me Andrew u with Mastercard. You [0:09] know they're one of the first members of [0:12] the responsible AI institute. And I'll [0:13] give you a little bit of context and [0:14] we'll have a conversation here around [0:17] trustworthy AI particularly as we move [0:20] from Gen AI into agentic AI. So I lead a [0:24] nonprofit called the responsible AI [0:26] institute. I started this 9 years ago. [0:28] In fact, we started defining what was [0:29] responsible AI back then. At that time, [0:32] I was running IBM Watson as the first [0:34] general manager. So, the IBM board had [0:36] given me the Jeopardy playing machine [0:38] and said, "Go build a business." And [0:40] immediately we started seeing issues on [0:42] trust and explainability in these [0:44] systems. And I recognized that there is [0:47] a need for a third party independent [0:49] verifier of how these systems are [0:52] because otherwise people are [0:53] self-marking their own homework. IBM [0:55] will say my AI is great. Google will say [0:57] my AI is great. So that gave birth to [1:00] the responsible AI institute. So think [1:01] of us almost like a JD powers of AI or a [1:04] FICO score for your AI agent uh a third [1:08] party and we have been very blessed to [1:11] have some of the prominent companies [1:13] over the years via members and [1:16] Mastercard was u one of the early ones [1:18] on the financial services side who [1:20] leaned in and um I'm going to ask uh [1:23] Andrew here for a bit of an introduction [1:25] as well as perhaps the first leadoff [1:28] question on you know you are one of the [1:30] first companies to become become members [1:31] of the responsible AI institute. What [1:33] drove that uh that decision? [1:35] >> Sure. So uh so I'm Andrew Ricekin. I'm [1:38] the chief data officer for Mastercard [1:40] and the AI governance team reports [1:42] through to me. So I would say for us [1:45] this has been a journey for a while. So [1:48] about se six seven years ago we launched [1:50] these data principles about that people [1:53] should own their data and it's our [1:54] responsibility to manage it and to to be [1:57] trustworthy in how we handle it. And in [2:00] uh relation to that we then also stood [2:02] up AI governance um as a program and [2:05] ever since then we've been evolving both [2:07] of them. So our data principles became [2:09] our data and tech principles to [2:11] encompass a uh AI specifically and that [2:14] which we do for AI governance keeps [2:16] changing with the latest rounds being [2:18] hit by um Gen AI as it got launched. So [2:21] we are continually looking to others for [2:24] solutions because we know as much as we [2:27] can do for ourselves and my teams do [2:29] great jobs in developing and coming up [2:30] with new solutions. We are not the [2:32] owners of those solutions. We are not [2:34] the only place that could develop those [2:36] solutions. We look for other partners, [2:38] other like-minded companies to develop [2:40] th those solutions and to deliver [2:42] develop standards. And so therefore, we [2:45] look to trustworthy partners like the [2:47] responsible AI institute to say help us [2:49] get gatherings of like-minded companies [2:52] because it's not the companies that are [2:53] the platforms developing the AI. It [2:56] really is about users. How as we uh as [2:59] users of these models that are not [3:02] transparent with this new technology [3:04] that's continually evolving, the models [3:06] are continually changing, the use cases [3:08] are continually changing. How do we stay [3:10] on top of that? Where are the standards? [3:13] We can talk about standards um in in [3:16] depth. There aren't the standards to say [3:18] what is safe and trustworthy now. And so [3:20] it's up to us as organizations, as [3:22] responsible organizations that want to [3:24] do the right thing by our customers to [3:26] maintain protection of our brand so that [3:28] our brand still stands for trust and [3:30] safety and security. We need to make [3:32] sure that our AI is responsible. In [3:35] order to do that, we need to know what [3:36] are the metrics for that. What are the [3:37] standards? So we look to um places like [3:40] the Responsible AI Institute to help get [3:42] that going and to get other people to to [3:45] join us and say here's where the [3:46] standard should be. [3:47] >> That's great. Now thank you for that. [3:49] And also like you rightfully said there [3:51] is this evolution just in the last 7 8 [3:53] years going from you know deep learning [3:56] people don't even talk about that [3:57] foundation models geni now agentic AI. [4:01] One of the things I found very [4:02] fascinating in my conversation with you [4:04] one is your background. I mean, you've [4:06] really done a whole range of things from [4:08] technology companies to legal companies [4:11] and data and AI and now you're looking [4:13] at this new frontier of agentic [4:16] commerce. Um, so two-part question. One [4:19] is how do you or how does Mastercard [4:21] define agentic commerce and second is [4:24] how do you think your role and your [4:26] background in the past which is so [4:27] varied prepares you better to understand [4:30] and tackle agentic commerce. [4:32] >> Sure. So um an on aentic commerce for us [4:36] that is you are using an agent on your [4:39] mobile device on your computer in order [4:41] to make a purchase to do a part of the [4:44] where it sits in a purchase experience [4:46] could be part of the search could be [4:48] part of fraud dispute. There are whole [4:50] bunches of ways you could use an agent [4:52] in order to affectuate a purchase. And [4:54] some merchants, e-commerce merchants [4:56] have already implemented agents on their [4:58] side of the fence, too. But you as a [5:00] consumer, it's already available in many [5:02] of the Gen AI tools that you can access [5:05] as a consumer. So, we're facing this [5:07] world where you as a consumer are using [5:09] an agent. The merchants are using [5:11] agents. These two agents need to talk to [5:13] each other for there to be a [5:15] transaction. Transactions require two [5:17] parties. And so Mastercard had built and [5:20] enabled e-commerce, right? There [5:22] wouldn't have been e-commerce without [5:23] Mastercard and credit cards uh and and [5:26] payment cards. And so now we're facing [5:28] this world of okay, how do we enable [5:30] commerce between agents? It's much more [5:32] complex. And so we started we launched I [5:36] guess about two months ago the idea of [5:38] agent pay and enabling agent pay i.e. [5:41] tokenization of card numbers. So card [5:43] numbers are not passed in that [5:45] transaction and you can't lose the the [5:47] card number for us. That is step one of [5:49] a much larger engagement that we need to [5:51] undertake relative to agentic AI. [5:54] Namely, how do I know that my bot is [5:57] actually my bot? How do I authenticate [6:00] myself to my bot as a a merchant? How do [6:03] I know to trust that bot? That that bot [6:05] is not some nefarious agent? How do I [6:08] confirm that I b went and bought three [6:11] pairs of sneakers that it was me buying [6:13] those three pairs of sneakers and I'm [6:14] actually buying three pairs of sneakers [6:16] and not four sets of sheets? So, there's [6:19] a whole ecosystem that needs to happen [6:21] with regard to just that transaction and [6:24] safety and security. What what does a [6:26] chargeback look like when it's the agent [6:28] making a transaction? How do you as a [6:30] consumer prove that maybe that that [6:32] transaction shouldn't have happened when [6:34] the merchant's going to go, "No, no, no. [6:36] was your agent that did that. So these [6:38] are the kinds of things we're thinking [6:39] about just about that transaction. But [6:41] now we're in a datarich environment, a [6:43] much richer environment than we've been [6:45] in. How do I make sure that you still [6:47] get your loyalty points? How do I make [6:49] sure that you can use your loyalty [6:51] points? As a merchant, it's quite easy [6:53] for you to be disintermediated because [6:55] now you have some other agents run by [6:57] one of the platforms and LLM providers [7:00] managing a situation and I as a merchant [7:02] want to maintain my loyalty. How does [7:04] that happen in this new ecosystem? And [7:06] that's part of the the role Mastercard [7:09] plays that we want to make sure that all [7:11] parties to that payment ecosystem are [7:13] safe and secure but getting the value [7:15] exchange that they otherwise bought into [7:17] that the consumers get the biggest [7:19] benefit from their engaging their [7:21] transaction and it's a safe and secure [7:22] transaction. That's again it's [7:25] fascinating again I remember I'm dating [7:28] myself there was a time where people [7:29] used to struggle about putting a credit [7:31] card online right people would say I'm [7:33] never in a million years putting my [7:35] credit card up there now we see that as [7:37] a pattern and I look at my daughters and [7:39] my granddaughters and I say they will [7:40] grow up in a world where this will [7:42] become a common place but when you start [7:45] looking at it from an ecosystem [7:46] perspective particularly from the end [7:48] user perspective [7:49] how what are you seeing as issues of [7:52] trust are people willing to trust an [7:55] agent with a credit card and say go buy [7:57] this for me or what are some of the um [8:00] early signals you're finding in that [8:01] area on how to build trust. [8:04] >> I think um most consumers are still in [8:07] the place of human in the loop. [8:10] >> Yeah. [8:10] >> And so I I mean I was doing this myself. [8:12] Please go find me hotels in Milan. I'm [8:16] going there going there for a vacation. [8:19] Here's the price range. Here's the the [8:20] services. please provide me a list and [8:23] give suggestions. I would never tell it [8:25] to actually go book it for me. I just [8:27] would want to filter through it, look at [8:29] each choice, make sure it was the right [8:31] choice, make sure the dates were. I [8:33] would be that I I I would say pnicity to [8:36] make sure that that that was accurate. I [8:38] don't think I'm different than a lot of [8:40] people for that initial transaction. But [8:42] I do think on the other hand, if I'm a [8:44] company and I'm buying a thousand reams [8:47] of of paper every month, I don't want to [8:49] be in that mode of having to go and [8:50] press a thousand reams of paper every [8:52] month. So I think in those cases, you're [8:54] going to set up an agent that gets [8:55] repetitive much faster. So I think those [8:59] kinds of transactions will get to [9:00] trusting the agent in a faster way where [9:03] it's repetition, it's happened before, [9:06] and so that trust that you're talking [9:07] about will happen over time. So I start [9:09] buying the thousand reads of paper at [9:11] work. I see it works now. I'm going to [9:13] try it at home and I'm going to tell 10 [9:14] 10 friends. They'll tell 10 friends and [9:16] we'll have our own little social network [9:18] to get to trust and acceptance. [9:19] >> So you'll build it basically with some [9:21] basic transactions and you start adding [9:23] value added services. Yes. [9:24] >> As people get more confident on it. [9:27] >> Um you know so that's on the user side [9:29] in terms of user readiness if you may. [9:31] When you shift over and start looking at [9:33] infrastructure readiness um we talked [9:36] briefly about technologies like MCP and [9:39] all coming up. So share give us your [9:41] view of how does Mastercard look at MCP [9:44] as an enabling technology and how do you [9:46] see that emerging in terms of various [9:49] layers of it. [9:50] >> So MCP is the enabler. So um let's go [9:55] back to Mastercard's history. That piece [9:58] of communicating between the bank and [10:00] the merchant all used to go over phone [10:02] lines. Then we've switched to internet [10:05] lines using HTTP SSL and protocols like [10:08] that. So now we're moving to a new [10:10] protocol system of um MCP and I'll keep [10:14] butchering the the the acronym till I [10:16] get it down. But the but now MCP will [10:19] now become the new protocol. So when we [10:21] did APIs, we did data standards for the [10:23] APIs. What data is necessary to get to [10:25] the transaction? What data is necessary [10:27] to be put in there to make sure it's not [10:29] fraud? What is the format of that data? [10:32] That's still going to have to happen [10:33] with MCP. But again, it's a much richer [10:36] data environment. the chief data [10:38] officer. I love that. Lots of [10:39] opportunities here for for um and [10:42] preventing fraud but providing [10:44] personalization and providing value to [10:46] the merchant and to the consumer with [10:49] regard to that. So I I think from our [10:51] perspective that we're letting the tech [10:53] players determine what the technology [10:55] is, but we're the ones saying no no you [10:57] put the technology in place. We have to [10:59] develop standards to make this work. [11:01] So, so that actually that's really a [11:03] good sort of a segue from we looked at [11:06] the human trust, you're looking at the [11:08] infrastructure trust or protocol and [11:10] then the final piece is the data trust. [11:12] You know, in terms of are people ready [11:14] to start exposing this? So, from a data [11:16] governance point of view, what do you [11:18] see as some of the most urgent [11:20] challenges around here? Is it around [11:22] completion of a transaction is or is it [11:24] that as well as a transaction roll back [11:26] or what are the kinds of data challenges [11:28] in this flow that you're beginning to [11:30] see? I I would say um the pe the tra [11:33] people have gotten used to mcommerce and [11:35] e-commerce and so I think the [11:37] individuals when it's their a merchant [11:39] they trust and that they know and [11:41] they'll begin to trust the agent that [11:44] they're already used to providing their [11:45] own personal data. I think the pieces [11:47] where it's not so straightforward about [11:50] the data flows are the agent providers [11:53] are not used to working in ecosystems. [11:56] Instead, they've had the wild west. And [11:58] so now we're going to need to say, "No, [11:59] here are the guardrails for the wild [12:01] west. You want to play in an ecosystem [12:03] that requires safety and security. Here [12:05] are the data requirements for doing so." [12:08] I think on the technology side for I I [12:10] will call it the um acceptance side, the [12:12] the merchant side. I think those [12:14] traditional technology players know that [12:17] that's required. But I would say the [12:20] other side of the consumer agent side [12:22] that I I imagine we're going to have the [12:24] biggest education um hurdle ahead. [12:27] >> So one of the things I think on the [12:29] agent trust side that at the responsible [12:31] AI institute we are beginning to see is [12:33] that as companies are building these [12:35] agents both internal use and agent to [12:37] agent there is a verification vacuum as [12:40] we call it because regulations are now [12:42] stepping back. I mean governments be it [12:44] US, UK or other parts of the world [12:47] essentially they're saying let the [12:48] market decide. We're sort of in this AI [12:50] arms race and in essence companies are [12:53] telling you you jump out of the plane [12:55] and you stitch your own parachute as [12:56] you're falling to the ground. We are not [12:58] going to as regulators tell you anything [13:00] or help you with it. So in the absence [13:03] of this regulatory guidance um we're [13:06] looking at as a nonprofit I think the [13:08] need for this third party to verify this [13:11] stuff goes up. So we will soon be [13:13] launching this thing called uh an agent [13:15] code of conduct. So you know so if you [13:18] use the analogy for a minute of a [13:20] digital human versus a physical human. [13:22] So an agent if you say is a digital [13:24] worker um when you have a physical [13:27] worker join you you're given a code of [13:28] conduct. You're given an employee [13:30] handbook and you're supposed to follow [13:32] those principles supposed to follow [13:34] those values and you're done performance [13:35] appraisals. So people have and u process [13:40] and an HR department for agents uh for [13:42] humans but there is no HR department for [13:44] agents right so one of the things we are [13:47] launching is this notion of an agent [13:49] code of conduct which will say it's a [13:52] human readable document it's also [13:53] machine readable so if I'm a Mastercard [13:56] agent and I'm connecting with Verizon to [13:59] pay the phone bill I would present my [14:01] code of conduct and responsible AI [14:04] institute will say this is legit because [14:06] we have verified its behavior. So we see [14:09] as a as a nonprofit, we see our role [14:11] almost like a FICO score or a credit [14:13] score for an agent. How do you trust an [14:16] agent? And these compliance badges that [14:18] we are planning to launch will be around [14:20] and I keep asking myself, what does a [14:23] LinkedIn for agents look like? Right? [14:26] What does the FICO score for agents look [14:28] like? So, one of the things we're [14:29] excited about partnering with you and [14:31] learning from you is as you start [14:33] building these networks and these [14:35] transactions, we would like to see [14:37] ourselves as an enabler of trust, as [14:39] third party independent trust. So, if [14:42] you're in the audience looking at [14:43] building agents for yourself, if you're [14:45] a co, what would you say, Andrew, that [14:48] both the technical trust as well as the, [14:51] you know, the business trust, where [14:53] should a co start? What are some of the [14:55] big foundational things they should put [14:57] in place when they start attacking or [15:00] addressing agents? [15:02] >> I think the piece uh about the the [15:04] foundational piece for the agents at the [15:07] moment is simply building them in a way [15:09] that you can measure whether or not to [15:11] trust them which kind of goes back to [15:12] the standards piece is as I say is we're [15:16] all used to doing data management on [15:18] structured data. None of us are used to [15:20] doing data management and data [15:22] governance on unstructured data. We [15:24] don't know what that looks like and [15:26] therefore we don't know how to tell [15:27] what's good data versus bad. I mean, how [15:29] many PowerPoints have we created over [15:31] the years? How do you know which ones [15:32] are good or bad? How do you know which [15:34] ones go stale? You don't. And yet all of [15:36] those are required to train the models. [15:39] And so I would say that that for for me [15:42] that's big my biggest worry as the data [15:44] guy. [15:45] >> I would say building from that as you [15:47] have the agent it goes to the next piece [15:50] is to say well what are the standards? [15:52] what do I need to make sure there's data [15:54] availability to meet th those standards? [15:57] So, from a Mastercard perspective, it's [15:59] great to hear that you're building out [16:00] these verification pieces because we [16:02] come from the world of EMV code, PCIGSS [16:05] to layer in more acronyms, but basically [16:07] safety and security standards and [16:09] therefore there are third party auditors [16:11] that audit whether people are in [16:12] compliance with those standards. So, [16:15] we're used to operating in a world like [16:16] that. So it's great to have standards [16:18] and the ability to verify that you're [16:21] meeting those standards. That way we as [16:23] as running a safe and secure ecosystem [16:25] can get comfortable, but others in that [16:27] ecosystem, including regulators, can get [16:30] comfortable with the safety and security [16:31] of it. So I would say from a data [16:33] perspective, what is it that I need to [16:35] do to feed that? Where does the data [16:38] verification happen in that side of it? [16:41] There's the AI that needs to happen, but [16:43] we were discussing this, right? to test [16:45] the AI, I need question answer pairs. [16:47] Okay, so is that synthetic data? How do [16:48] I know that I trust that synthetic data? [16:51] So, sorry, as the data officer, I'll say [16:52] everything's a data problem. Uh, I'm [16:54] sure the AI people will all say it's all [16:56] a math problem. Um, we all have our own [16:59] personal biases here. And so, I I would [17:02] just say that's now going to necessitate [17:04] more and more data. So, I don't know [17:06] that I have one place to start. I to me [17:08] it's start from basic line governance [17:11] and then build from there. That's very [17:13] prescriptive and I think very precise [17:14] and uh so that's something that you're [17:17] concerned about. One last comment. What [17:19] is the thing that you're most excited [17:20] about as you look down the road here? I [17:23] I would say so I've been at Mastercard [17:25] for 17 years. We've gone to e-commerce [17:30] to mobile commerce and now we're going [17:32] to agent commerce. Each has presented [17:34] their own challenges and opportunities [17:36] and new things to develop. So I enjoy a [17:38] challenge. I'm viewing this as a great [17:40] new challenge that'll uh keep me [17:42] occupied potentially for the rest of my [17:44] career. [17:45] >> So for those of us in the audience here [17:47] as we building careers in this area, [17:49] what is the one skill that you would [17:52] advise a young person to build as we go [17:54] down this AI path? I I would not s well [17:59] um I would say critical and logical [18:02] thinking is the real skill at the end of [18:04] the the day. If you apply critical and [18:06] logical thinking to everything you're [18:08] doing, it'll help anything. I mean, [18:10] people who learned to code, is that [18:12] going to be useful in two years? Yeah, [18:14] you none of us really know, right? And I [18:17] I have a legal background. A lot of the [18:18] laws that I learned, well, not [18:20] necessarily relevant anymore. Life has [18:22] moved past it. So, I would say it really [18:25] comes down to just that basic skill set. [18:27] >> I think I do believe that AI will make [18:28] us more human um down the line. These [18:30] skills are going to come up. Listen, [18:32] thank you again for sharing this. will [18:34] be watching your journey, learning from [18:36] it and um appreciate you making [18:38] >> we'll be working together man. Thank [18:40] you. [18:41] >> Thank you. Thank you. [18:42] [Applause]