How Does Agentic Commerce Work?

While scrolling through Twitter, I saw a post from my friend Debbie O’Brien. She’s been excitedly tweeting about her adventures of using an AI agent as her Chief of Staff.

But unlike her other enthusiastic tweets, this one voiced frustration. When asking her agent to restock on groceries or buy school supplies for her kids, she has to intervene because we’ve spent years teaching websites to block bots.

Debbie's experiment ran directly into one of the biggest open problems in agentic commerce. An agent can shop for you, but completing the purchase requires a lot more.

The merchant needs to know which agent is making the request. The payment provider needs proof that the user authorized the purchase. The agent needs a way to use payment credentials without seeing or storing a card number. And everyone needs a record of what the user approved, what the agent did, and who is responsible when something goes wrong.

Companies are now building each of those pieces.

Agents need a standard way to work with merchants

While there are several companies working to enable agentic commerce, no single protocol currently covers a full purchase across the entire web.

Every merchant has its own systems and rules for selling and fulfilling orders. An agent that relies on a custom integration for every merchant won't reach much of the web.

Google and Shopify developed the Universal Commerce Protocol with several major retailers. UCP gives merchants and agents a shared way to discover the commerce capabilities each side supports. It covers the larger shopping process and works through APIs or agent protocols such as MCP and A2A.

Agents can use UCP’s catalog capability to get current product information. They can also link a customer's merchant identity so that existing loyalty benefits still apply.

OpenAI and Stripe introduced the Agentic Commerce Protocol in 2025 as an open standard that lets an agent complete a purchase inside of a ChatGPT conversation while the merchant stays the merchant of record.

While OpenAI initially built ACP around Instant Checkout in ChatGPT, they later narrowed that scope in March 2026 to focus on product discovery, giving merchants more room to run their own checkout. This proves the point that merchants have spent years building their commerce systems, and new protocols have to work with what's already there.

A payment needs proof of the user's intent

Giving an agent a way to interact with merchants still doesn't answer the main authorization questions. Did I approve this merchant? Did I approve this amount? Can the agent buy the item now, or should it wait for a lower price? Does the approval expire?

Google developed Agent Payments Protocol (AP2), which provides verifiable evidence around a payment that can run on existing payment rails. The protocol uses signed digital records called mandates to capture what the user approved. Open Checkout and Payment Mandates record the user's limits, while closed mandates bind that approval to the final checkout and payment.

Mastercard built the Verifiable Intent specification together with Google as a companion to AP2. Verifiable Intent creates a record of the user's approval that merchants and issuers can check independently.

The agent still needs a way to pay

Proving what the user approved doesn't hand the agent anything it can actually pay with. The agent still needs a credential that works at checkout without exposing the user's real card number.

Stripe, Visa, American Express, and Mastercard have each built their own way to hand an agent a limited credential instead of the real card number. Every one of those schemes ties the credential to that company's own network, and each company chose to solve it on its own terms. No one has yet published an open, cross network standard for this part of the stack.

So while an agent can prove what a user approved through AP2 and Verifiable Intent, the actual credential it uses to complete the purchase still depends on which network is involved.

The existing web still needs a path for trusted agents

Structured protocols such as UCP and ACP give agents a cleaner way to work with merchants. But the rest of the web won't adopt a new commerce API all at once, so agents will continue to use websites built for people.

A CAPTCHA is the clearest example of the wall Debbie ran into. The website sees automated traffic and has no reliable way to tell the difference between an authorized shopping agent and a bot trying to scrape inventory or commit fraud.

Cloudflare led the draft of the Web Bot Auth standard, which lets an agent sign its web requests so the merchant or its infrastructure provider can verify the agent's identity.

They then partnered with Visa to build on Web Bot Auth's signing mechanism by creating Trusted Agent Protocol, which adds a way for that signed request to say whether the agent is browsing or attempting a payment.

Merchants can apply their normal access and fraud controls, and once verified, the agent can use tokenized payment credentials through the merchant's current checkout flow.

Structured commerce protocols and existing websites will likely coexist. Agents can use protocols such as UCP and ACP when merchants support them and identify themselves through existing websites when merchants don’t.

Merchants shouldn't have to choose between blocking every bot and allowing every bot into checkout. They need to verify an agent before letting it use their normal checkout and fraud controls.

Agents will buy services from other agents

Consumer shopping is the easiest use case to picture, but some of the fastest activity is happening in machine commerce. An agent may pay for a small digital service as part of a larger task.

Coinbase created x402, which uses the HTTP 402 Payment Required status to let a service request payment as part of a normal web interaction. The agent responds with proof of payment and receives the service. This method fits digital services that cost fractions of a cent and don't justify a subscription or a traditional checkout page. Because it settles in stablecoins instead of card rails, it bypasses the need for a limited payment credential altogether.

Stripe and Tempo’s open Machine Payments Protocol also uses HTTP 402, but it’s payment agnostic. MPP supports cards, wallets, and stablecoins, and can handle ongoing usage through payment sessions.

The distinction between shopping and software execution starts to fade here. An agent may purchase digital services from other agents while completing a task, and the person who assigned the task may never see a checkout screen.

Trust has to exist below the model

Teams often focus on whether an agent can be tricked by a prompt, but payment systems also need protection when the model behaves correctly.

Research published in July 2026 found 33 protocol vulnerabilities across three agentic commerce platforms. The researchers demonstrated attacks caused by weak verification throughout the payment flow regardless of which model powered the agent.

A stronger model can't repair an unsigned payment message. Commerce protocols need to bind the final transaction to the user's exact instruction, and implementations need conformance and security testing across protocol boundaries.

And let’s not forget that agents will need to manage what happens after checkout. A system that can complete a payment but can't explain or reverse it isn't ready to act for people at scale.

Open standards need to work together

Agentic commerce is becoming a practical test of whether the open agentic stack can work across vendors.

The boundaries aren't settled. Some protocols cover more than one responsibility, and several companies are solving the same problem in different ways. The overlap is useful right now because people are testing these designs against actual merchant systems and payment networks.

Those layers will overlap, but they shouldn't require every agent platform or merchant to adopt one company's full stack. A merchant should be able to support a commerce protocol without choosing the customer's agent, an agent should be able to use more than one payment network, and a user's authorization should remain understandable when a task moves between agents.

If these systems worked together, a shopper could tell an agent what to buy and set a price limit. The agent would identify itself to the merchant, build the cart with current merchant data, and check it against the limit the shopper already set.

If the purchase falls within that limit, the agent could complete it without pulling the shopper back in. A signed record would tie the purchase to what the shopper had already authorized, so there's still proof of what happened, just not a live checkpoint. The payment provider would give the agent a limited payment token instead of the shopper's card number, and the merchant would process the order through its existing system. Finally, the agent would return the receipt and order status, and the shopper could revoke any remaining authority at any time.

The shopper stays in control without taking over the browser. The merchant keeps its checkout rules and remains the merchant of record, while each system receives the proof it needs to complete the purchase.

Open specifications are a start, but the industry also needs a place to work through where they overlap and how they should operate together. AAIF’s Agentic Commerce Working Group, chaired by Ilya Grigorik of Shopify and co-chaired by Rahul Bansal of OpenAI, brings together people working across the agentic purchase process. The group provides a neutral place to identify gaps and develop open approaches to trusted autonomous transactions.

Continue the discussion at AGNTCon and MCPCon North America

AGNTCon and MCPCon North America brings the people building these protocols together with the companies trying to use them in commerce systems. There are several sessions specifically focused on agentic commerce:

• Universal Commerce Protocol - Shopify Distinguished Engineer and Chair of the AAIF Agentic Commerce Working Group, Ilya Grigorik, will explain how UCP supports a full purchase without a custom integration for every merchant and agent pairing.
  
• AP2, UCP and So Many Others.. But What Completes My Payments? - Muskan Jain, Software Engineer at Walmart Global, will compare the emerging protocols and explain which part of the payment process each one completes.
• Architecting Agentic Commerce: The Universal Commerce Protocol and Agent Payments Protocol - Director of Engineering for Google Commerce, Amit Handa, and Senior Product Manager, Prateek Dudeja, will show how UCP handles the broader commerce process while AP2 records authorization and supports secure payment.
• Embedding Agentic Payments with x402, A2A and Other Emerging Protocols - Fede Sarquis, Head of Developer Relations at Crossmint, will cover how agents can combine communication and payment protocols to purchase digital services inside a workflow.
• Reading is Free, Spending is Not: What a Minimal Agent Learns Probing Live Ecommerce Endpoints - N1AI’s AI Practice and Community Lead, Francesco Marinoni Moretto, will test live commerce endpoints and show the gap between reading product information and receiving permission to spend.

Bring the commerce flow your team is trying to build. We need people across the commerce stack working through the same purchase from instruction to fulfillment. And since you made it to the end of the post, I have a 25% discount for you: COMMUNITY25. Agents love a discount 😆