The “Architecting the Autonomous Economy” Series — Part 4

Architecting Agentic Commerce

Securing the Financial Rails

In Part 1, we defined the roles of the autonomous economy and the shift from discovery to agentic action. Then, we mapped those roles into four core deployment models in Part 2. In Part 3, we showed merchants how to close the “Action Gap” by transitioning from SEO to ACO using UCP-compliant endpoints.

Each of these strategic pathways leads to the exact same door: a signed cryptographic mandate, ready to move money. This article covers what happens on the other side of that door — the financial layer that converts a cryptographic promise into a settled transaction, the regulatory scaffolding still catching up to it, and the engineering gaps that remain in the system as of mid-2026.

Part I: The Strategy Shift

Historically, Payment Service Providers (PSPs) served as silent facilitators of commerce — transferring funds, managing risk, and operating seamlessly in the background. The rise of agentic commerce fundamentally redefines this role. PSPs now evolve from passive pipes for capital into active verifiers of programmatic intent. When the entity at checkout is an autonomous AI agent rather than a human, the payment processor must validate who authorized the payment, what was purchased, and under what specific conditions.

While “PSP” is a convenient umbrella term, the credentials and merchant processing roles behave differently and should be kept separate, as defined in Part 1 of this series. On the consumer side, the Credentials Provider (CP) holds the payment mandate, authenticates the agent, and issues the payment token. On the merchant side, the Merchant Payment Processor (MPP) receives that token, settles the funds, and carries the fraud and dispute liability for the sale. A single company can hold both roles — such as a digital wallet acting as a CP for its own PSP business — but architecturally they address different concerns: the CP asks, “Did the user really authorize this?” while the MPP asks, “Will I actually get paid, cleanly, for this sale?”

This structural shift is driving a competitive land grab across the fintech industry:

• Google’s Agent Payments Protocol (AP2) launched in September 2025 with more than sixty partners. Its v0.2 specification, shipped in April 2026, introduced support for “human-not-present” payments, allowing an agent to buy limited-release concert tickets the instant they go on sale. At Google I/O in May 2026, AP2 was paired with the launch of Universal Cart , Gemini Spark and then donated to the FIDO Alliance, elevating this trust layer of agentic payments to an open, industry-owned infrastructure.
• Visa’s Trusted Agent Protocol (TAP), part of its broader Intelligent Commerce portfolio, verifies AI agent identity by signing it into HTTP request headers using RFC 9421 HTTP Message Signatures and Web Bot Auth, enabling real-time verification against a Visa-operated Agentic Directory.
• Mastercard’s Agent Pay tokenizes card credentials and scopes them to a specific agent, merchant, and consent policy. In June 2026, Mastercard extended this logic to machine-to-machine interactions with Agent Pay for Machines (AP4M), built for a future where autonomous software agents purchase services directly from other software entities with no human shopper in the loop.

The Protocol Landscape

Figure 1: Agent Payment Tech

Three Pillars of Agentic Payment Trust

1. Agent Identity: Standardizing how an agent identifies itself and its associated user during a transaction handshake. While networks like Visa (via TAP’s public key directories) and Mastercard (via Agent Pay tokens) are actively deploying registries to verify these declared network identities, verifying the integrity of the agent’s active runtime environment remains an open challenge.
2. Scoped Authorization: Binding a payment credential to strict, deterministic limits (such as transaction amount, merchant whitelist, merchant category, and defined time windows), so an agent cannot transact outside its authorized mandate.
3. Evidence, Not Inference: Establishing a signed, cryptographically auditable record of what the user actually authorized. This ensures that any subsequent disputes are adjudicated on hard cryptographic proof rather than post-hoc reconstruction.

Use Case: Human-Not-Present

A fan instructs their AI agent weeks in advance: “If tickets for this reunion tour go on sale in Las Vegas, grab two on the floor for under $400 each, and don’t wake me up to ask.” This instruction instantly translates into a cryptographically signed Intent Mandate — containing the price ceiling, ticket category, geography, and a “human-not-present” flag — held securely by the agent rather than the merchant or ticketing platform. At 10:02 AM on sale day, the agent detects availability, constructs a Cart Mandate matching the actual floor-seat price, and presents both mandates to its Credentials Provider (CP).

The CP instantly validates the cryptographic chain: Is the agent’s identity still valid? Is the ticket price within the original $400 ceiling? Has the mandate been revoked since it was signed? This validation clears in under 200 milliseconds, releasing a single-use payment token to the venue’s Merchant Payment Processor (MPP), which settles the transaction against that token.

The fan finds out over breakfast. No raw credit card credentials ever touched the ticketing site. Furthermore, had the ticket price auto-escalated past $400 as inventory tightened, the CP would have declined the transaction outright, rather than silently approving an over-cap charge.

Diagram 1: Human-not-present Flow

Global Use Case: Alipay’s ACTP

In January 2026, Alipay launched its own Agentic Commerce Trust Protocol (ACTP) in China, in collaboration with Alibaba’s Qwen App, Taobao Instant Commerce, smart-glasses manufacturer Rokid, entertainment ticket giant Damai, and Alibaba Cloud’s Bailian platform.

Get Renee Zhang’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The protocol supports two core payment models:

1. Instant Payment: For immediate, chat-based purchases (e.g., ordering food via AI chat).
2. Delegated Authorization: Allowing users to set specific parameters for an agent to execute transactions autonomously at a later time — a feature functionally equivalent to AP2’s “human-not-present” support, built independently for the Alibaba ecosystem.

The AP2 Enhancement

As a rapidly evolving specification (v0.2 as of April 2026), AP2 is continuously maturing. For engineering teams planning near-term production deployments, there are three primary integration enhancements to implement alongside the core protocol:

1. Extending Agent Identity Verification: Today, AP2 natively binds a mandate to the user’s cryptographic signing key. To protect against scenarios where a compromised agent might present a mandate contrary to the user’s real intent, production systems can enhance the architecture. Combining AP2 with specialized identity verification layers to create a robust, multi-layered trust model.
2. Optimizing Mid-Flight Revocation: Cryptographic mandates are inherently non-repudiable to guarantee transaction security. An important design enhancement is implementing an out-of-band, high-speed revocation mechanism. This allows users or CPs to immediately trigger a “kill switch” mid-transaction if anomalous activity is detected, without compromising the core non-repudiation features of the protocol.
3. Scaling to High-Volume Enterprise Environments: The initial wave of AP2-compatible services, including PayPal’s Conversational Commerce Agent, the Mastercard Agent Pay pilot inside PayPal, and the x402 web3 extension, proves the protocol’s viability. The next operational enhancement is stress-testing these integrations to handle massive, card-network-scale events like Black Friday.

Part II: The Compliance Frontier

As of mid-2026, no major jurisdiction has finished writing rules specifically for autonomous AI purchasing. The industry is building the rails faster than regulators are building the guardrails, so the payments layer is currently doing double duty as both infrastructure and de facto policy.

Figure 2: Agentic Commerce Regulatory Landscape

United States

The Consumer Financial Protection Bureau’s (CFPB) January 2026 advisory (compiled in collaboration with banking associations) treats agent-initiated card transactions as falling within the existing dispute-and-chargeback regime, with the clarification that a consumer’s right of recourse survives an agent mandate — it is only narrowed if the mandate was properly and explicitly scoped.

Separately, the CFPB’s ongoing Section 1033 open banking rulemaking (following the August 2025 ANPRM) is examining whether an AI agent qualifies as an authorized “representative” for accessing a consumer’s financial data, and whether that status should carry a fiduciary duty. Regulation E, which governs electronic fund transfers, remains a major challenge. It was not designed for a world where a consumer grants a standing authorization to an agent rather than approving each transaction individually, and this regulatory gap remains unresolved.

In testimony to the House Financial Services Committee in January 2026, the Electronic Transactions Association (ETA) argued that most of the necessary principles — authorization, consent, liability, and auditability — already exist in payments law and require modern reinterpretation rather than a complete rebuild from scratch.

European Union

Europe has multiple moving pieces advancing simultaneously. PSD3, the long-awaited overhaul of the EU’s payments rulebook, is still being negotiated and, in its current draft, largely assumes a human is at the keyboard for Strong Customer Authentication (SCA) purposes.

The EU AI Act, applying in full starting August 2, 2026, layers a horizontal risk-based framework on top of existing financial regulations but does not speak directly to autonomous purchasing. This leaves the AI Liability Directive, currently moving through trilogue, as the piece most directly aimed at assigning civil responsibility when an agent errs.

Consequently, compliance teams are being advised to map SCA delegation liability under the current draft of PSD3 and treat agentic AI as a first-class category in model risk frameworks, rather than waiting for the finalized rulebook.

United Kingdom

The UK Law Commission published a foundational discussion paper on AI agents and contract law in July 2025. In the absence of AI-specific statutes, industry analysts point to the UK’s existing Authorised Push Payment (APP) fraud reimbursement rules as the likely template. Under this framework, liability is split 50/50 between sending and receiving PSPs, up to a statutory cap of £85,000.

Extended by analogy to agentic commerce, this framework could expose payment providers to significant aggregate liability, given the unmatched speed and volume at which autonomous agents transact.

The De Facto Regulators: Card Network Rules

In the absence of finalized statutes, card networks’ own rulebooks are functioning as the nearest thing to binding regulation today. Visa’s Trusted Agent Protocol and Mastercard’s Agent Pay / Verifiable Intent frameworks establish identity verification and consent standards that issuers, merchants, and PSPs are adopting now, ahead of legislative mandates.

What it Requires

Whichever deployment model you are building toward, three operational principles hold true regardless of how the final rules solidify:

1. Log everything cryptographically: Agent identity, mandate scope, consent timestamps, and the original user intent should all be instantly retrievable at the exact moment of a dispute, rather than reconstructed after the fact.
2. Treat liability as an upfront design decision: Decide contractually where transaction risk sits among the agent platform, merchant, Credentials Provider (CP), Merchant Payment Processor (MPP), and consumer before the first automated dispute forces the question.
3. Monitor the card networks closely: The evolving frameworks from Visa and Mastercard represent the fastest-moving signals of where public regulation may ultimately land.

Beyond the Transaction

Payments are the crucial bridge where agentic commerce will either establish durable trust or fall flat. While payment protocols are designed and card networks are live, the ultimate question of liability and risk remains unanswered. Standard fraud detection engines are blind to autonomous bots, leaving the industry with an urgent challenge: how do you verify, in real-time, that an agent is exactly who they claim to be and that their decision-making engine is secure?

In Part 5, we will look past the financial layer to explore the runtime environment. This next part details how agent identity and AI-native fraud detection converge, exploring the threats of agent spoofing, commerce-focused prompt injection, and the new “Know Your Agent” (KYA) compliance standards required to protect the ecosystem.

Ready to start? Explore AP2, A2A, UCP,Google Vertex AI and the ADK to discover how to architect your first transactional agent.

Please note: These thoughts represent our personal perspectives only, not an official guide. We welcome all questions and further discussion!