---
title: "Questions from merchants about AI agents: 13 answers"
url: https://knowyouragent.ch/en/knowledge/faq/merchants
lang: en
updated: 2026-10-17
license: © Innopulse Consulting GmbH
---

# Questions from merchants about AI agents: 13 answers

AI agents shop on behalf of their customers. For merchants, this raises new questions: how do I recognize an agent, should I admit it, and how do I know the order is wanted? Here are the most important answers.

[Leutrim Miftaraj](https://knowyouragent.ch/en/about/leutrim-miftaraj), Founder, Innopulse Consulting GmbH
Published 17 October 2026

## What this is about

This page is aimed at operators of online shops and platforms that receive or expect orders from AI agents. Technical details are in the linked glossary terms and articles; the answers give the overview needed for decisions.

## Questions and answers

### How do I recognize that an AI agent is ordering from me?

Reliably by a signature following Web Bot Auth or the Trusted Agent Protocol, which proves which operator is asking. Without a signature, only the assessment by bot detection remains.

### Should I admit AI agents in my shop?

Agents bring orders from real customers. It makes sense to admit signed agents of known operators deliberately and to keep handling unsigned automated traffic as before.

### How do I know the customer really wants the order?

Through proof of authority, such as a signed purchase intent following Verifiable Intent or a mandate with limits. The agent's signature alone proves only its identity.

### What is the difference between identity and authority?

Identity says who the agent is. Authority says what it may do on behalf of which customer. For orders with consequences, both are needed.

### How does an agent pay?

Usually with a network token that applies only to one merchant or agent, or through a protocol such as the Agentic Commerce Protocol. The agent usually does not see the customer's card number.

### Does strong customer authentication also apply to agents?

In principle, the general rules apply. Merchants clarify with their payment service provider how payments by agents are classified.

### Who is liable if an agent places an order the customer did not want?

That depends on whether the agent acted within its authority to act. Evidence such as a mandate helps settle this in a dispute. The article on liability explains the legal details.

### How do I handle returns and refunds?

As with other orders, with one addition: keep the evidence of the original order, so it can be shown later within which limits it was placed.

### Do I have to adapt my shop software?

Deliberately admitting signed agents requires verifying signatures, often through the CDN provider. For proof of authority, the KYA engine can be integrated.

### What does KYA verify for merchants?

KYA verifies signed requests following RFC 9421, purchase intents following Verifiable Intent, mandates, decisions and receipts, locally and without transmitting data.

### Does verification with KYA cost anything?

No. The verification page and the engine are free; the engine is licensed under Apache 2.0 and can be run in one's own system.

### Which details about the customer do I see with an agent order?

Only what the agent discloses. With selective disclosure, an agent can prove authority without revealing all personal details.

### How do I best get started?

With three steps: analyze automated traffic by signatures, admit signed agents of known operators and require proof of authority for orders above an amount.

### Which agents should I admit first?

Those from operators whose customers already shop with you and who sign their requests following Web Bot Auth. This way you serve existing customers without additional risk.

## Sources

- Agentic Commerce Protocol: [https://www.agenticcommerce.dev/](https://www.agenticcommerce.dev/)
- Verifiable Intent (Mastercard): [https://github.com/agent-intent/verifiable-intent](https://github.com/agent-intent/verifiable-intent)
- Web Bot Auth: Architektur-Entwurf (IETF): [https://datatracker.ietf.org/doc/draft-meunier-web-bot-auth-architecture/](https://datatracker.ietf.org/doc/draft-meunier-web-bot-auth-architecture/)

---
Quelle: https://knowyouragent.ch/en/knowledge/faq/merchants · KYA – Know Your Agent