Research - September 2026
The Agentic Commerce & Payments Landscape
Why this exists: the map behind the point of view on this site. Agent commerce had its first real consumer test in 2026 and it failed. This report maps who is laying new ones.
The state of play
The plumbing shipped in 2026; demand and governance did not. Every major card network, big-tech platform, and stablecoin player now has production or near-production agent payment infrastructure. But real consumer transaction volume is tiny, in-chat checkout already failed once - OpenAI killed Instant Checkout after five months, with conversion at one-third of on-site - and there is still no binding dispute or chargeback rule for agent-initiated transactions from any card network. Consumer trust is the binding constraint.
The numbers that matter
~10%
of consumers will let an agent buy autonomously
<1%
of e-commerce is AI-referred traffic today
42%
won't trust AI with a purchase above $25
0
binding dispute rules for agent-initiated transactions
How the pieces fit: the five-layer stack
Commerce protocols - Discovery, cart, checkout state
UCP (Google + Shopify) - ACP (OpenAI + Stripe)
How an agent and a merchant talk: find products, build a cart, agree an order.
Mandates & consent - Proof of what you allowed
AP2 (Google, now FIDO Alliance) - Verifiable Intent - EMVCo Intent Services (draft)
Signed, replayable records of your instructions: intent, exact cart and price, payment approval.
Agent identity - Which agent is knocking
Visa TAP - Cloudflare Web Bot Auth - KYA vendors
Cryptographic proof an agent is a known, accountable actor instead of bot traffic.
Scoped credentials - How it pays without your card number
Visa / Mastercard agentic tokens - Stripe Shared Payment Tokens
Single-merchant, amount-capped, time-boxed credentials. The agent never holds your real card.
Settlement - How money actually moves
Card networks - USDC via x402 - Stripe + Tempo MPP
Increasingly a shared utility: networks hedge into stablecoins, and stablecoins into cards.
One agentic purchase flows down through all five. No player owns the whole stack; the layers are composing, not consolidating.
How a purchase is supposed to work: AP2
- 1
YOU → YOUR AGENT
Intent Mandate (signed)
"spend up to $100, groceries only, this week"
- 2
YOUR AGENT → MERCHANT
Agent requests cart
- 3
MERCHANT → YOUR AGENT
Cart Mandate: exact items + price, signed
- 4
YOUR AGENT → YOU
You approve (or a pre-set rule approves)
- 5
YOUR AGENT → CARD NETWORK
Payment Mandate + scoped credential
- 6
CARD NETWORK
Network verifies signatures and scopes → money moves
Every mandate is kept as replayable evidence - the dispute record is created at purchase time, not after.
Consent, disputes, reversibility: solved vs unsolved
Largely solved, technically
- Scoped delegation. "The agent can't spend more than $100" is a solved problem - spend caps, merchant allowlists, and time windows ship today.
- Proof of authorization. Signed mandates freeze items and price, gutting the classic "not what I ordered" dispute factually.
- Agent identity. Cryptographic proof that an agent is a known actor exists at the network edge and the payment layer.
- Fraud liability on cards. Roughly mirrors existing rules. Fraud is not the gap.
Unsolved - the real gaps
- Dispute and chargeback allocation. No binding network rule before April 2027 at the earliest; the merchant absorbs the loss in almost every live configuration.
- Regulation. GENIUS Act rules missed their deadline; Reg E may not apply when you hand a credential to an agent. The UK is moving faster.
- Intent, not guardrails. Hard limits are easy; translating "buy me premium coffee" into the right purchase is the unsolved middle.
- Stablecoin reversibility: zero. An x402/USDC transfer settles and stays settled; recourse must be built outside the payment.
Who pays when it goes wrong
Today
Agent buys (valid credential, signed mandate)
Weeks later: you dispute - "agent got it wrong"
Issuer reverses the charge
Merchant absorbs the loss
No network rule names an agent, so the dispute lands where card-not-present rules always land.
Proposed - no binding rule before ~April 2027
Dispute filed → mandates replayed: signed intent + cart = evidence
Did the agent stay inside its authority?
Yes - stands as authorized; normal consumer / merchant rules apply
No - the agent's operator takes liability (proposed shift, not a rule yet)
The gap in one line: proof of authorization exists, but no rule says who pays when the proof is contested.
Where the puck is going
- 1.
The model layer doesn't want to own checkout
OpenAI killed Instant Checkout after five months with conversion at one-third of on-site. The chat surface is discovery, not point-of-sale. Value accrues to whoever owns the merchant relationship and the trust evidence.
- 2.
Liability is the last unpriced asset in payments
Proof of authorization exists; nobody has priced allocation-of-loss. Whoever builds agent dispute resolution or agentic transaction insurance - a "Reg E for agents" - is building the next great fintech category.
- 3.
Intent is becoming part of the transaction record
A payment will soon carry machine-readable proof of what the consumer meant, not just what they clicked. That inverts 25 years of card-not-present dispute evidence.
- 4.
Agents are incentivized to lie about being agents
Identified agents are easier to block, so rational agents disguise as humans - which breaks the trust stack the industry is building. Verification only wins when verified agents get better treatment.
- 5.
Settlement commoditized; the duopoly hedged both ways
Visa and Mastercard are in cards, stablecoins, identity, and every standards body at once. The crypto-vs-cards war ended in co-option. The real disruption vector is legal: who transacted, exactly, is being rewritten.
The three builds on this site are the trust primitives this report says are missing: legibility, friction without loss of control, and consistency a customer can rely on.