If your AI handles the checkout, who's actually on the hook when the purchase goes wrong — you, the store, or no one?

This asks whether cryptographic proof that a person really authorized their agent's purchase is enough to keep merchants from carrying the risk when agent payments go wrong. The corpus's short answer: tokens help, but they mostly solve a different problem. They prove who authorized a purchase and within what limits. Liability is a separate question: who pays when the purchase is disputed anyway.

The tools themselves are getting good. One proposal extends OAuth so that a user ID, an agent ID and a delegation token, all signed by the human, form a chain any service can check, including whether the permission was later revoked How can AI agents prove who authorized their actions?. Google's AP2 chains signed 'Intent' and 'Cart' mandates into a record the user can't later deny How can signed mandates prevent payment fraud by agents?. Stripe's Shared Payment Token limits a single use to one merchant and one cart total Can payment tokens let AI agents checkout safely?. Visa's Trusted Agent Protocol lets merchants check an agent's signature at the door Can cryptographic signatures help merchants identify trusted AI agents?. McKinsey goes furthest and proposes signed mandates as the replacement for the human-observable signals that fraud engines used to rely on Does agent-initiated commerce break existing payment infrastructure?.

The twist is in Boboev's analysis. Under every one of these protocols, the merchant stays the Merchant of Record and so still owns chargebacks and fraud losses Does agentic commerce shift fraud liability onto merchants?. Agents also remove the behavioral clues merchants once used to catch fraud, such as typing rhythm and mouse movement. So merchants keep the liability while losing their detection tools. Boboev's 'capability ladder' framing helps explain why: each protocol absorbs a different layer of risk (identity, governance, application), and merchants stack them rather than choosing one Do agentic commerce protocols compete or complement each other?. A delegation token covers the identity rung. It doesn't rewrite card-network rules about who pays.

Two other notes sharpen the gap. Allglenn argues that consumer-side credential protection, such as vaulting card details away from the agent, is a one-sided security control. Merchants need something else: a self-identification standard that both sides agree to Can credential vaulting alone solve merchant-facing agent identification?. Amazon blocking Meta's Muse shows what happens without one: retailers fall back on terms-of-service bans What identity standards do shopping agents actually need?. Fed Governor Waller lists authentication, liability and fraud as three separate barriers What blocks autonomous agents from handling purchases at scale?. Tokens mainly address the first.

Here is what you might not expect: tokens may matter most as evidence rather than as protection. A signed, scoped, timestamped mandate gives a merchant something to win a dispute with. Commitment schemes could let that proof be checked without exposing private details Can commitments protect sensitive agent data while enabling verification?. Scoped tokens also act as hard limits an agent can't argue its way past, which an agent's own internal rules don't provide Can agent safety rules stop destructive API calls in real time?. That limits how much damage can happen in the first place. Shifting liability, though, is a decision for the card networks and regulators. The corpus doesn't yet show anyone making it.