Guide · agentic commerce
What is agentic commerce?
Agentic commerce is buying and selling where an AI agent, not a person clicking through a checkout, carries out some or all of a purchase on someone’s behalf. The agent searches, compares, fills the cart and pays within limits it was given. For payment, risk and e-commerce teams the question stops being “is this a real customer?” and becomes “is this a real agent, acting for a real customer, within what that customer allowed?”
What an agent actually does in a purchase
In a typical flow, a person states a goal (“reorder printer toner under $80”), the agent finds offers, builds a cart and completes checkout with a payment credential it has been allowed to use. Some flows stop for the person to confirm; others let the agent complete purchases inside preset limits.
- Discovery: the agent reads product and price data, often through a merchant integration rather than a web page.
- Checkout: the agent submits the order through a protocol or API the merchant supports.
- Payment: a credential is presented — a token, a delegated card or a payment method stored with a provider.
- Fulfilment and service: returns, refunds and disputes still happen, now with an agent in the history.
Why payment and risk teams care
Card-not-present rules assume a person at a keyboard. When an agent buys, familiar signals — device, typing, session behaviour — describe the agent’s infrastructure, not the customer. Merchants need to tell legitimate agents from bots, and businesses running their own purchasing agents need to prove each purchase was authorised.
- Authorisation: did the person allow this agent, this merchant and this amount?
- Authentication: is the agent who it claims to be?
- Liability and disputes: who answers when an agent buys the wrong thing?
- Evidence: can you show what the agent was told and what rule let it pay?
The emerging standards
Several open protocols and card-network programmes now describe how agents should check out and pay: the Agentic Commerce Protocol from Stripe and OpenAI, Google’s Agent Payments Protocol (AP2), Visa Intelligent Commerce with its Trusted Agent Protocol, and Mastercard Agent Pay. Our protocol guide summarises each from its own documentation.
What to put in place before an agent can pay
Whatever protocol carries the transaction, the business letting an agent spend still needs its own controls: a registered identity and owner for each agent, the purchase actions it may take, an amount above which a person approves, rules for where it may pay, a decision made before the payment runs, and a record of each decision. The free agent checkout risk check scores those ten points in two minutes.