Confidential by defaultEstablished 201072 Jurisdictions
Faisal KhanFaisal KhanRequest a Consultation

When Your AI Becomes the Buyer

Shopping changes fundamentally when an AI can move from recommending a product to selecting it, paying for it, and managing what happens afterward.

Agentic Commerce: What Happens When Software Starts Spending

You tell an AI: “Find me a quiet hotel near the conference, under US$250 a night, with free cancellation. Do not book anything with a late-night check-in.” Ten seconds later, it returns not with a list of links, but with a confirmation number.

At some point between your sentence and that receipt, the software stopped being a search tool and became an economic actor. It interpreted your preferences, rejected alternatives, selected a merchant, accepted terms, presented a payment credential, and created an obligation in your name.

That transition is the heart of agentic commerce. It is also why the difficult part is not teaching an AI to click “buy.” The difficult part is proving that the click represents a decision you genuinely authorized.

From recommendation to agency

Most online shopping already contains automation. Recommendation engines rank products. Travel sites compare fares. Subscription services reorder familiar items. Digital wallets fill in an address and card number. None of that necessarily makes the software an agent.

Agency begins when the system can choose and act within delegated authority. A simple assistant may recommend three laptops. A more capable agent might compare specifications, read return policies, check delivery dates, decide which offer best matches a budget, and complete the order. A highly autonomous agent could monitor prices for a week and buy only when a specified condition is met.

The difference is not intelligence alone. It is discretion. Traditional e-commerce asks the human to approve each important step. Agentic commerce asks the human to define a mandate and lets software handle some of the decisions inside it.

The mandate is the new checkout button

A checkout button records a narrow act: the buyer saw a cart and approved that cart at that moment. An agentic mandate can be much broader: buy whenever the price falls below US$500; reorder when inventory reaches ten units; choose any airline except two named carriers; never accept a nonrefundable rate; spend no more than US$2,000 this month.

That flexibility creates value, but it also creates ambiguity. Did “book the cheapest reasonable flight” authorize a six-hour layover? Does “replace the printer ink when needed” permit a premium brand? If an agent buys from a marketplace seller with a weak return policy, did the user authorize the merchant or merely the product category?

A trustworthy system therefore needs more than a payment credential. It needs a tamper-resistant record of intent: who gave the instruction, which agent received it, what limits applied, when the authority expires, whether another approval was required, and what the agent actually did.

How an agentic purchase works

A mature agentic transaction can be understood as a chain of evidence.

First, the user establishes intent. The instruction might contain a budget, product requirements, prohibited merchants, delivery constraints, or a requirement to ask before committing. For a business, it may also include procurement policy, approved suppliers, tax treatment, cost center, and the employee authorized to delegate the task.

Second, the agent discovers offers. Instead of reading a storefront designed for human eyes, it consumes structured catalog data: product identifiers, inventory, variants, prices, shipping options, taxes, return terms, and merchant credentials.

Third, the agent evaluates and selects. This is where recommendation becomes judgment. The agent weighs price against quality, delivery speed, cancellation rights, warranty, merchant reputation, and the instructions it was given.

Fourth, the agent initiates checkout using a constrained payment instrument. The safest model is not to hand the agent a permanent card number. It is to provide a token limited by merchant, amount, time, purpose, or transaction. The merchant or its payment provider then processes the payment through familiar authorization and settlement rails.

Finally, the agent follows the order after payment. It can monitor delivery, request an invoice, reconcile the purchase, seek a refund, rebook after a cancellation, or escalate an exception to the user. Agentic commerce is not merely automated checkout; it can cover the entire commercial relationship.

The payment is familiar; the permission is new

Early agentic-commerce systems are being designed to preserve much of the existing payments infrastructure. The merchant remains the seller of record. Its payment service provider still handles authorization and capture. Card networks, banks, wallets, and fraud systems still perform their familiar roles.

What changes is the layer above them. OpenAI and Stripe’s Agentic Commerce Protocol provides a common way for an agent and merchant to exchange catalog, cart, checkout, and order information while allowing the merchant to retain its existing payment and fulfillment systems. Google’s Agent Payments Protocol focuses on how agents, merchants, wallets, and payment providers can coordinate around verifiable user authorization.

Visa and Mastercard are extending network tokenization toward agent-initiated transactions. Rather than exposing the underlying card number, an authorized agent can receive a restricted credential connected to the user’s intent. Standards organizations including FIDO Alliance and EMVCo are working on ways to carry agent identity, delegated authority, authentication, and transaction evidence across the payment lifecycle.

The industry is converging on an important principle: the agent should not merely possess a credential. It should be able to prove why it is entitled to use that credential for this purchase.

Who—or what—is the customer?

Traditional compliance begins with familiar questions. Who is the customer? Who controls the account? Who authorized the payment? Agentic commerce inserts another actor between the person and the merchant.

The merchant may need confidence in three identities at once: the human or company funding the purchase, the software agent acting on its behalf, and the platform or developer responsible for that agent. “Know your customer” is no longer enough if the merchant cannot distinguish an approved purchasing agent from malicious automation impersonating one.

This does not necessarily mean every shopping bot needs a government-issued identity. It means participants need traceability. A merchant should be able to tell whether an agent is registered, which platform vouched for it, what authority the user granted, and whether the payment credential is bound to those conditions.

The fraud problem changes shape

Conventional e-commerce fraud often involves stolen credentials, account takeover, fake identities, or a customer falsely disputing a legitimate purchase. Agentic commerce preserves those risks and adds new ones.

A malicious product description could try to manipulate the agent rather than persuade a person. A compromised agent could quietly substitute a favored merchant. A fraudulent merchant could present machine-readable terms that differ from the terms shown to humans. An attacker might alter a mandate, extend its expiry, or trick the agent into treating a hidden instruction as part of the user’s request.

There is also the danger of perfectly authorized mistakes. The agent may follow the instruction exactly and still misunderstand what the user meant. Payment systems are good at asking whether a credential was valid. They are less prepared to decide whether an AI made a poor but technically permitted choice.

Risk systems will therefore need to evaluate more than the account and transaction. They may need to evaluate the agent, its software lineage, the mandate, the decision path, and whether the resulting purchase was consistent with the user’s historical behavior and stated limits.

The liability question nobody can avoid

Suppose an agent buys the wrong product. The cardholder says, “I never wanted this.” The merchant replies, “Your authenticated agent placed the order using a valid token.” The agent provider says, “The purchase was within the mandate.” Who bears the loss?

Existing card and bank-transfer rules distinguish authorized transactions from unauthorized ones, while merchant contracts and consumer law govern delivery, refunds, misrepresentation, and defective goods. Agentic commerce makes the boundary harder to locate. A payment can be technically authorized even when the commercial decision is disputed.

The evidence attached to the transaction will matter enormously: the original instruction, the agent’s permissions, any price or merchant limits, the cart shown to the user, whether confirmation was required, and the exact terms accepted. A system that cannot reconstruct these events will struggle with disputes, chargebacks, regulatory complaints, and fraud investigations.

Clear revocation is equally important. Users need to be able to cancel an agent’s authority without searching through layers of settings. Merchants and payment providers need to know when a mandate or credential has been withdrawn. An agent that remembers an old instruction after the user has changed their mind is not convenient automation; it is an unauthorized-payment machine waiting to happen.

Merchants will need a storefront for machines

Websites today are designed to persuade people. They use photography, placement, reviews, scarcity messages, sponsored listings, and carefully chosen defaults. Agents prefer structured facts.

That shift could change competition. If agents compare the total delivered price, return rights, product durability, and seller reputation across hundreds of merchants, brand and advertising may lose some power. But the opposite is also possible: platforms may charge merchants to appear in agent recommendations, or optimize rankings around commissions that the user cannot see.

The old argument over search-engine placement may become an argument over agent reasoning. Why did the agent choose this merchant? Was the result sponsored? Did it compare the whole market or only integrated sellers? Did the cheapest product lose because another merchant paid for privileged access?

For merchants, machine-readable inventory and checkout will become as important as a visually attractive website. A product that an agent cannot reliably identify, price, verify, or purchase may become commercially invisible even if its webpage looks beautiful.

Where agentic commerce may arrive first

Consumer shopping attracts attention, but business purchasing may be the more natural early market. Companies already operate through budgets, approval limits, preferred vendors, purchase orders, expense policies, and reconciliation rules. These controls can be translated into explicit machine-readable mandates.

An agent could monitor inventory, request quotations, select among approved suppliers, place routine orders, match invoices to deliveries, and flag exceptions. Treasury agents might schedule payments around cash availability. Travel agents could rebook disrupted trips within company policy. A procurement agent could negotiate small purchases that are too time-consuming for a human buyer to optimize.

Agentic commerce may also use stablecoins and other programmable forms of money, particularly for cross-border, machine-to-machine, or always-on payments. But it does not depend on crypto. Cards, bank transfers, wallets, and existing payment providers can all support agent-led transactions if permission, identity, and liability are handled properly.

Where it helps—and where it becomes dangerous

The upside is substantial. Agents can reduce search costs, monitor prices continuously, execute repetitive purchases, help people navigate complex products, and give smaller merchants access to customers without forcing those customers through another unfamiliar checkout.

The danger is that convenience can hide delegation. A human may approve a broad instruction without understanding how many purchases it enables. Merchants may not know whether they are dealing with a genuine customer preference or an agent optimized by another platform. Consumers may struggle to challenge decisions when every participant can point to a technically valid record.

The winning systems will not be those that make agents maximally autonomous. They will be those that make autonomy legible: bounded authority, visible reasoning, secure credentials, meaningful approval points, easy revocation, and evidence strong enough to resolve a dispute.

Did you know?

Agentic commerce is not one universal protocol. Different initiatives address different layers: product discovery, agent-to-merchant communication, checkout, payment authorization, tokenization, identity, and verifiable intent. Interoperability will depend on how well those layers fit together.

A payment token is not merely a disguised card number. It can be restricted to a merchant, device, channel, amount, or use case, reducing the value of the credential if it is stolen. Agentic systems are extending this idea by linking the credential to delegated intent.

The most important record in future e-commerce may not be the receipt. It may be the mandate that existed before the receipt: the evidence showing what the person allowed the machine to decide.

The click is disappearing

E-commerce was built around a visible ritual. A person searched, compared, filled a cart, and pressed a button. The click was imperfect evidence, but everyone understood what it was supposed to mean.

Agentic commerce removes that moment. The buyer may define an objective on Monday and receive a completed order on Thursday. Trust therefore has to move backward—from the final click to the original instruction—and remain attached to every decision the agent makes in between.

That is the real invention. Not an AI that can shop, but a commercial system that can distinguish helpful delegation from accidental, manipulated, or unauthorized spending. Until that distinction is reliable, the agent may be intelligent, but the commerce around it is not.

Important sources

Share
Page Last Updated: 01-Nov-2026 (2495881)