Every AI agent gets its own scoped, fundable virtual card. Single-use cards are the safe default for one-off tasks.