A card issuer can give an artificial intelligence shopping assistant permission to buy a customer’s groceries without giving it a card number it could use to buy anything else.