Agentic Commerce Payments: What an Operator Must Verify
Agentic commerce changes who initiates checkout, but does not erase payment authorization, merchant fulfilment or dispute obligations.
An AI agent can search, select and initiate a purchase, but merchant checkout, payment authorization and fulfilment remain separate events.
Agentic commerce lets software act on a customer's purchasing instruction. Operators must distinguish the user's permission, the agent's identity, the checkout request, the payment credential, the authorization result and fulfilment. An agent label or token alone proves neither that the customer authorized a particular order nor that payment succeeded.
An agent can choose a product and start checkout while its user is elsewhere. That does not turn the search result, the user's permission, the payment authorization and the fulfilled order into one event. For a payment operator, the work is joining those events without assuming that any one proves the others.
Six records, six questions
| Record | Question it answers | What it does not establish |
|---|---|---|
| User instruction | What was the agent asked to do, and within which limits? | Whether a merchant accepted an order. |
| Agent identity | Which software actor presented the request? | Whether the customer approved this purchase. |
| Merchant order | What goods, price, delivery terms and reference did the merchant accept? | Whether payment succeeded. |
| Payment credential | What account or token could the agent present, and within which controls? | Whether the transaction was authorized. |
| Payment result | What did the issuer, bank or payment provider approve or settle? | Whether the merchant delivered. |
| Fulfilment record | What was delivered and when? | Whether the user originally delegated the purchase. |
This is an operator model, not a claim that every protocol emits six standardized objects. A useful audit trail links each record with stable references and preserves the version of the instruction that applied at purchase time.
Where the initiatives fit
OpenAI's commerce documentation addresses product discovery and checkout integration in ChatGPT. A product appearing in discovery does not establish that its seller participates in checkout. Google's Universal Commerce Protocol and Agent Payments Protocol address different questions: commerce interaction and payment authorization. Visa's Trusted Agent Protocol provides a way for a merchant to assess the identity of an agent approaching its site. Mastercard's Agent Pay framework names identity, intent, controls, execution and intelligence as separate trust elements. Our protocol comparison maps their documented roles; it is not a compatibility promise.
The distinction between bounded authority and transaction risk became sharper in Mastercard's 30 September 2026 announcement. Its first new intelligence service is a probability score indicating whether an AI agent initiated a transaction, initially rolling out for testing in the United States. Mastercard says it plans to add behavioral, merchant, transaction, credential and consumer-propensity context. The score is not proof that the user authorized the item, and the announced future signals are not a published scoring specification. The Agent Pay trust-services reference separates the announcement from what an issuer or merchant can verify today.
The checkout boundary
The merchant remains responsible for identifying its own order and payment outcome. An agent's browser redirect, a checkout session completion, a link status and a final payment status are different observations. Some payment methods confirm later than the initial interaction. Reconcile the order to the provider's authoritative payment event before fulfilment, then keep payment and fulfilment references together. The agent checkout lifecycle maps these records and uncertain outcomes; the payment-link lifecycle shows a different checkout entry point with the same state problem.
Do not put raw card details into an agent prompt or conversation as an implementation shortcut. Use the credential and consent flow provided for the particular integration, and verify what its controls actually limit: merchant, amount, time, transaction count or something else. A limit on a credential reduces exposure but does not itself supply evidence of a customer's intent for a particular order.
Authentication cannot be collapsed into “3-D Secure breaks for agents.” An agent may not have a human device at purchase time, but the issuer's decision, challenge route and any liability treatment depend on the specific flow and applicable rules. A token does not automatically replace authentication or transfer all fraud liability. Document your supported path, challenge and failure behavior, and evidence available for a later dispute.
One practical launch test
Before offering agent-initiated purchases, run a reversible test order and then try to answer, from stored records alone: Who instructed which agent? What purchase boundaries applied? Which merchant order was accepted? Which credential was presented? Which payment event confirmed the outcome? What was delivered? What happens if the order is cancelled or disputed?
If those answers live in separate systems, make the join explicit. The agent payment-controls guide covers permission design. This article's boundary is the purchase evidence that must survive after the agent's conversation ends.
Sources & methodology (4)
Mastercard describes an Agent Pay trust framework with identity, intent, controls, execution and intelligence as distinct elements; its first new intelligence service is an AI-initiation probability score rolling out for testing in the US
Checked:
Visa Trusted Agent Protocol provides technical specifications for identifying and validating agents interacting with a merchant
Checked:
OpenAI's commerce documentation distinguishes product discovery, checkout and payment concepts
Checked:
Google describes AP2 as a protocol for agent payment authorization and mandates
Checked:
Source types explained in our Methodology.
By Shaun Toh · Director, Digital Payments · Razer