An agent adds items to a cart and completes a purchase. Later, the customer disputes it. Who authorised that transaction, and how would you prove it?
That single question is the whole of agentic commerce, and it is a harder problem than making the agent capable of buying.
The Trust Gap
Existing payment infrastructure assumes a human at the moment of purchase. Consent is implied by the click. Remove the human from that moment and every part of the chain has a question: the merchant does not know the agent had authority, the payment provider cannot verify consent, and the customer has no way to bound what the agent may do.
You cannot solve that with a better API. It needs a way to prove authority cryptographically.
How AP2 Approaches It
The Agent Payments Protocol, introduced by Google in September 2025 and positioned as an extension to the A2A ecosystem, builds trust using mandates: tamper-proof, cryptographically signed digital statements that define what an agent is allowed to do.
A mandate can specify that an agent may create a cart, or complete a purchase, within limits the user set. The signature is the proof. Instead of a merchant trusting that an agent has permission, the agent presents verifiable evidence of it.
The Linux Foundation reported the effort launching with more than 60 supporting organisations, which for a payments standard is the number that matters, since a payment protocol nobody accepts is a research project.
The Four Steps of an Agentic Purchase
| Step | What happens | Where it breaks |
|---|---|---|
| Discovery | Agent finds merchants and products | Catalogues not machine readable |
| Authorisation | Agent proves it may transact | No mandate, no trust |
| Payment | Funds move | Fraud rules built for humans |
| Fulfilment | Goods or service delivered | Returns and disputes with no human buyer |
It Is Not the Only Standard
AP2 sits alongside other approaches, including the Agentic Commerce Protocol with its three-party model of agent, seller and payment provider, and payment-layer efforts like x402. Retail platforms have announced their own agentic commerce standards too.
Nobody should bet the business on one of these yet. The reasonable position is to understand the shape they share, because all of them need the same things from you: a machine-readable catalogue, verifiable authorisation, and a dispute process that works when the buyer was software.
What to Do Now If You Sell Anything
- Make your catalogue machine readable. Structured product data with prices and availability. Agents cannot buy what they cannot parse.
- Decide your policy on agent purchases. Allowed, blocked or limited. Not deciding is a decision that your fraud rules will make for you.
- Check your fraud rules. Systems trained on human behaviour flag agents as suspicious, so you may be blocking genuine demand already.
- Sort out disputes. Who do you refund, and what evidence do you keep, when the purchase was made by software with a mandate?
- Watch, do not build. The standards are moving. Get the fundamentals ready and adopt when your payment provider supports one.
Conclusion
Agentic commerce is a trust and authorisation problem before it is a payments problem, and mandates are the mechanism the leading protocols have converged on. Prepare by making your catalogue machine readable, deciding your policy on agent buyers, and reviewing fraud rules that were written when every buyer was human. Then wait for your payment provider to pick a standard rather than picking one yourself.
Frequently Asked Questions
Can agents already make purchases?
Yes, generally by driving normal checkout flows, which is exactly the untrustworthy path these protocols exist to replace with something verifiable.
Which standard will win?
Too early to say, and the more likely outcome is coexistence with bridges between them, as happened with earlier payment standards.
What is the biggest risk for merchants?
Blocking legitimate agent traffic with fraud rules built for humans, and losing sales without ever knowing it happened. Check your decline reasons before you worry about protocols.