Marrowbone announced a $95 million Series B on Tuesday led by Bessemer Venture Partners, with Georgian and Inovia participating and a strategic investment from Mastercard. The Toronto company solves a problem that sounds narrow and is not: how an autonomous software agent spends money on behalf of an organization without either handing it a corporate card or requiring a human to approve every transaction. Its product issues single-use virtual cards bound to a policy, evaluates each authorization against that policy in real time, and produces an audit record linking every charge to the agent run that caused it. Three enterprises run it in production, including a travel management company processing about $40 million in annualized agent-initiated spend.
The problem, concretely
An agent booking travel needs to pay for a flight. The available options today are all bad. Giving the agent a corporate card number means an unbounded credential inside a system whose behavior is probabilistic. Requiring human approval per transaction defeats the automation. Prefunding a wallet caps exposure and provides no control over what gets bought. Every company deploying agents that transact has built some version of this and none of them wanted to.
The failure modes are not hypothetical. A procurement team at a customer described an early internal agent that, given a card and a task, purchased the same software license eleven times because a confirmation page failed to load and the retry logic did not check. That is a $30,000 mistake from a bug, not an attack, and it is the kind of thing that gets agent projects cancelled by finance rather than by engineering.
How the product works
An agent requests a payment credential through an API, supplying an intent: what it is buying, from whom, up to what amount, and referencing the task and the human authority it acts under. Marrowbone issues a virtual card scoped to that intent, with merchant category restrictions, an amount ceiling, and a short expiry. When the authorization arrives from the network, Marrowbone evaluates it against the declared intent and approves or declines within the network's response window, which is under a second.
The policy layer sits above that. An organization defines rules in a language resembling access control policy: this agent class may spend up to $2,000 per task in these merchant categories, requires human approval above $500 for new merchants, and may not transact at all outside business hours. Chief executive Dev Malhotra, previously at Shopify, said the design goal was that a finance controller should be able to read the policy and understand it without an engineer translating.
The story is rarely the launch. It is what breaks, what ships, and who owns the mess at 2 a.m.
Why Mastercard invested
Card networks have been working on agent-initiated payments for two years, and both Visa and Mastercard announced frameworks in 2025 that define how an agent identifies itself in an authorization message. Those frameworks need implementations, and the networks would rather have several credible ones than build the software themselves. Mastercard's investment comes with a technical partnership giving Marrowbone early access to the agent authentication fields as they roll out.
That relationship is an asset and a dependency. If the networks eventually build this capability into their own platforms, or if a large issuer offers it as a feature, Marrowbone's product becomes a thin layer. Malhotra's answer is that the policy engine and the audit trail are the durable value and that credential issuance is table stakes. That is the correct answer strategically and it requires the policy engine to be genuinely hard to replicate.
The competition and the timing question
Stripe has an issuing product that could be extended in this direction and has shown interest in agent payments. Ramp and Brex both have virtual card infrastructure and strong finance-team relationships. Several Y Combinator companies are building similar products, four of them in the most recent batch alone. The category is crowded relative to how many customers exist.
That last point is the real risk and Bessemer partner Janelle Teng addressed it directly when we asked. Her position is that agent-initiated commerce is small today and growing at a rate that makes the current customer count irrelevant, and that the winner will be whoever has the enterprise relationships and the compliance work done when volume arrives. That is a defensible thesis and it is a bet on timing rather than on product.
The unresolved questions
Liability is the largest one. If an agent makes an unauthorized purchase within its policy because the policy was too permissive, who bears the loss? Card network chargeback rules were written for human cardholders and do not map cleanly. Marrowbone's contracts allocate risk to the customer for policy configuration and to Marrowbone for enforcement failures, which is reasonable and untested in any dispute.
Regulatory treatment is the second. An entity issuing payment credentials and making authorization decisions is doing something that looks like payment processing, and Marrowbone operates through a sponsor bank arrangement in the United States and holds an electronic money institution license application pending in Ireland. Financial regulators have not addressed agent-initiated payments specifically, and the first enforcement action or guidance in this area will reshape the category.
Skarvonix will keep following this beat with reporting grounded in how systems behave outside the launch keynote.
- Funding
