Agentic commerce explained: how AI agents shop

Key points

• In agentic commerce, an AI agent searches, compares and pays for its principal.
• Several approaches solve parts of the task: Verifiable Intent, AP2, Trusted Agent Protocol, Agentic Commerce Protocol.
• Merchants check agent, customer, limits and validity before accepting a purchase.
• A neutral verifier allows one rule for all agents, regardless of the approach.

What changes

Until now, a person clicks through the shop, adds items to the cart and pays. In agentic commerce, an AI agent takes over these steps: it searches offers, compares prices and delivery times and completes the purchase, often without the person ever seeing the merchant's page.

For merchants, this cuts both ways. Agents bring new customers and handle recurring purchases reliably. At the same time, the signals merchants used to tell people from bots disappear. Blocking all automated access loses legitimate agents; allowing all of it opens the door to abuse.

How an agent purchase works

1. Instruction: the customer defines what the agent may buy, for example office supplies up to CHF 200 from certain merchants.
2. Search: the agent calls product pages or interfaces, ideally identifying itself with signed requests.
3. Selection: the agent picks the right offer within the limits.
4. Checkout: the agent submits cart, delivery details and payment, together with proof of its authority.
5. Verification: merchant and payment network check whether agent, customer and limits fit together.
6. Receipt: the purchase is recorded so it stays traceable later.

The approaches at a glance

Since 2025, several providers have introduced their own approaches. Mastercard Verifiable Intent lets the user sign the limits of a purchase and binds the agent's final values to them. Google AP2 works with mandates for intent, cart and payment. Visa's Trusted Agent Protocol identifies the agent toward the merchant with signed requests. The Agentic Commerce Protocol by OpenAI and Stripe describes the checkout between agent and shop.

The approaches differ but solve parts of the same task. The article Agent protocols compared offers a detailed comparison.

What merchants should check

Before accepting an agent purchase, four questions arise:

• Is the agent known? A valid signature following Web Bot Auth shows whose agent is asking.
• On whose behalf does it act? The evidence must link agent and customer.
• Is the purchase within the limits? Amount, merchant and items must match the mandate.
• Are the limits still valid? A revoked mandate must not carry any further purchase.

The answers determine whether a merchant accepts the purchase, asks for confirmation or declines.

Risks and disputes

New flows bring new risks. An attacker can pose as a known agent if signatures are not verified. A hidden instruction on a website can lead an agent into purchases the customer never wanted (prompt injection). And an agent can simply misunderstand what was wanted.

In a dispute, the evidence decides: what was allowed, what was bought, and did the two match? Without evidence, it is one statement against another, and chargebacks become a matter of negotiation. With evidence, the question can be settled in minutes.

The role of a neutral verifier

Merchants face several approaches, depending on agent and payment method. A neutral verifier checks the evidence of different providers by the same rules and returns a uniform result. KYA currently verifies Verifiable Intent, Web Bot Auth, HTTP signatures following RFC 9421 and its own mandates, locally in the browser or as a package in one's own system.

This lets a merchant define one rule for all agents, such as: “Purchases above CHF 100 only with a proven mandate and a checked revocation status.” Try an example.

What changes for customers

For customers, agentic commerce means fewer clicks but more responsibility when setting the limits. Whoever allows an agent to shop should choose amount limits, permitted merchants and validity deliberately and keep the option to revoke. A good agent shows what it intends before every larger purchase and keeps a receipt afterwards. This keeps it traceable what was bought on whose behalf, even if the customer never saw the merchant's page.

Frequently asked questions

Should merchants block AI agents?

Blanket blocking excludes legitimate customers. It makes more sense to recognize signed agents and to make purchases subject to verifiable proof of authority.

Which approach to agentic commerce will prevail?

That is open. Several approaches are developing in parallel and partly converging. A neutral verifier helps avoid betting on a single one.

What happens with a chargeback after an agent purchase?

That depends on the payment network's rules. Evidence showing mandate, decision and receipt makes clarification considerably easier.

Do customers need anything special for agentic commerce?

They need an agent that supports mandates with limits. It is important to set amount limits and permitted merchants deliberately and to revoke mandates when needed.

How does a merchant detect a fake agent?

By a missing or invalid signature. An agent posing as a known agent cannot create a valid signature without the operator's private key.

Does agentic commerce also apply between businesses?

Yes. Especially in business purchasing, agents order repeatedly from approved suppliers, often with budgets and approvals above certain amounts.

Who is liable for a wrong purchase by an agent?

That depends on the individual case. As a rule, the agent's declarations are attributed to whoever deploys it; more on this in the article on liability.

Sources

1. Verifiable Intent (Mastercard), Spezifikation und Referenz: https://github.com/agent-intent/verifiable-intent
2. Agent Payments Protocol (AP2): https://github.com/google-agentic-commerce/AP2
3. Trusted Agent Protocol (Visa): https://github.com/visa/trusted-agent-protocol
4. Agentic Commerce Protocol: https://www.agenticcommerce.dev/