How To: Understand Agentic Commerce
You've probably noticed the phrase everywhere lately. Agentic commerce. Agent checkout. AI agents that shop for you. It sounds like a big, abstract shift, and underneath the buzzwords, it actually is one IMO. But the mechanics are more concrete than the hype suggests, and once you see the pieces, the whole thing stops feeling ~mysterious~.
Here's the plain version.
What "agentic commerce" actually means
Agentic commerce is what happens when an AI agent, not a human, is the one clicking buy.
You give an agent a goal in plain language. Something like "reorder the running shoes I usually get, as long as they're under $120." The agent takes it from there: it searches, compares options, checks your constraints, and completes the purchase, no further input from you. That's the whole category. Not a chatbot suggesting a product for you to buy, an agent that actually moves the money and finishes the order.
It shows up in a few different shapes right now. Consumer agents live inside tools like ChatGPT, Perplexity's browser, or Google's AI shopping mode, buying things on behalf of a person. Enterprise agents live inside company tools, reordering office supplies or renewing software subscriptions on behalf of a business. Different context, same basic idea: a goal goes in, a completed purchase comes out. Right now, there are a lot of LLM’s suggesting things for YOU to buy, but where agentic commerce actually differs, is that the agent is making the purchase without immediate oversight from a human.
How an agent actually pays
This is the part that trips people up, because it sounds like it should require inventing something new. Mostly, it doesn't. It reuses two ideas payments already had, stitched together in a new way.
First: proving the agent is legitimate.Merchants have spent years building checkout flows to keep bots out: CAPTCHAs, multifactor prompts, all the friction designed to make sure a human is on the other end. An agent trips every one of those alarms by default. So the card networks built a workaround: agent identity credentials. Visa's version is called Trust Authentication Protocol. Mastercard has Agent Pay for Machines. Amex has its own developer kit. Different names, same idea: the agent carries a cryptographically signed credential that says "I'm a registered, verified agent, not a scraper," and the merchant's system checks that credential the way it would check a card number.
Second: proving the agent is allowed to spend. This is where it gets more like handing someone a limited use credit card than handing them your wallet. You set boundaries up front, like a maximum amount, a category of purchase, sometimes a specific merchant, and the agent's authority is scoped to exactly that. Try to go outside the boundary, and the transaction just doesn't clear. Some of this runs on familiar rails, like OAuth style permissions. Some of it is newer: Stripe, for instance, provisions a "Shared Payment Token" scoped to your intent once you authorize an agent, and the agent carries that token into every transaction it attempts. Google takes a more explicitly contractual approach with its AP2 protocol, where your instructions are turned into a cryptographically signed "mandate" the agent has to produce before a purchase clears.
Put those two together and you get the current shape of agentic checkout: a verified agent, operating inside spending rules you set, completing a purchase without you touching a checkout page.
Where it breaks down right now
Fraud detection wasn't built for this. For decades, fraud systems have leaned on behavior to catch problems: how long someone lingers before buying, the rhythm of their typing, whether the purchase pattern matches their history. An agent produces none of that. It completes a purchase in milliseconds, with no hesitation, at a speed no human ever browses at. Nothing about that is fraudulent, but nothing about it looks "normal" to a system trained on human behavior either. Merchants and networks are still catching up on how to tell the difference between a legitimate agent purchase and something that's actually gone wrong.
Being authorized isn't the same as being right. An agent can be fully verified, fully within its spending limits, and still make a call you wouldn't have made: picking the wrong item, misreading an ambiguous instruction, missing context a human would have caught. The current systems check whether the agent was allowed to buy something. They don't really check whether it should have. And who is at fault when an agent purchases something it shouldn’t have? Can a chargeback be filed? Who holds the financial liability? Which brings me to:
Nobody's fully settled who's on the hook when it goes wrong. If a human's card gets used fraudulently, there's a well worn dispute process. If an agent makes a purchase that was technically authorized but clearly not what you wanted, the liability picture is a lot less clear, and it's likely to be one of the more contested parts of this space over the next couple of years.
The short version
Here's the TL;DR: agentic commerce is alive and working already. We’ve built the “easy” components: Verify the agent. Scope the spending. Sign the token. All solvable with cryptography, and all solved fast, because that's engineering.
The part that isn't live yet is the part that was never a technical problem to begin with: figuring out who eats the loss when a fully authorized agent buys the wrong thing. That's not an engineering question. That's a "whose fault is it" question, and those take a lot longer to settle than a signature scheme.
So when someone tells you agentic commerce is basically solved, ask them which half they mean.
This is part of an ongoing series on payments infrastructure and where the money actually moves. Next up: let’s dive deeper into this last question- what happens to chargebacks and dispute liability when the "buyer" filing the dispute isn't the one who authorized the charge, it was an agent that did.