As AI agents start shopping for us, who actually eats the cost when a purchase goes wrong?
Does merchant liability move up the agentic commerce protocol stack?
This explores whether, as agentic commerce gets built in layers (identity, discovery, authorization, payment), legal and fraud liability shifts away from the merchant toward the protocols, platforms, or agents higher in the stack, or stays with the merchant.
This explores whether the layered design of agentic commerce protocols takes fraud and legal liability off merchants and hands it to the systems sitting above them. In the corpus the short answer is no: the risk gets spread across the layers, but the liability stays with the merchant. Boboev's analysis is the clearest source. Across every major proposal (OpenAI/Stripe's ACP, Google's AP2 and UCP, Visa's TAP, Mastercard-backed Web Bot Auth), the merchant remains Merchant of Record, the party legally on the hook when a transaction goes wrong Does agentic commerce shift fraud liability onto merchants?. And their position gets worse. When an agent checks out instead of a person, the signals merchants used to catch fraud (typing rhythm, mouse movement, browsing hesitation) disappear.
The less obvious point is that the protocols really do form a stack. Boboev describes them as a capability ladder that merchants adopt in combination, not as rivals. Each rung handles a different kind of risk: who the agent is, whether it's authorized, what it can discover, how it pays Do agentic commerce protocols compete or complement each other?. So risk *mitigation* moves up the stack while legal *responsibility* stays at the bottom. Each layer gives the merchant better evidence for defending a disputed charge. None of them takes the dispute away. McKinsey's proposed fix, cryptographically signed mandates that prove what a customer actually authorized, fits the same pattern: it replaces the lost human signals with proof, not with a new liable party Does agent-initiated commerce break existing payment infrastructure?. The IMF's three-layer model helps explain why. It walls off the agent's probabilistic decision-making from deterministic authorization and settlement, because only the lower layers can provide the legal enforceability payments require Should AI agents make payment decisions independently?. Accountability sinks to wherever things are predictable, and that is close to the merchant.
A small multi-agent study offers a useful parallel from outside commerce. Assigning accountability to an agent only changed outcomes when the workflow actually routed the work through that agent Does accountability placement actually shape multi-agent outcomes?. Applied here: if liability is ever going to move up to agent platforms, the protocols would have to route authorization decisions through those platforms in ways that create a verifiable record. The identity gap shows how far away that is. Amazon's block of Meta's Muse showed that agents still have no standard way to identify themselves or prove authorization to retailers. Merchants fall back on terms-of-service blocks, which is a sign that responsibility hasn't been negotiated at the protocol level at all What identity standards do shopping agents actually need?.
Regulators are approaching it from the other direction. Busch argues that EU consumer protections were designed around screens (mandatory buttons, visible disclosures) and stop working when agents transact through APIs. He proposes obligations written into the protocol layer itself, such as a withdrawal API Can EU consumer law rules survive agent-to-agent API transactions?. That is the most concrete idea in the corpus for actually moving duties up the stack, and it is aimed at consumer rights, not merchant fraud exposure. Meanwhile BCG's survey finds consumers and payment networks capturing most of the gains from agentic shopping while merchants face a structural disadvantage Who wins and loses as AI agents reshape shopping?. Put together: the value moves up the stack and the liability doesn't.
The corpus is thinner on what could change this, such as card-network rule changes, chargeback reallocation, or agent platforms accepting liability contractually. Waller's argument that agentic commerce will split into open and closed systems, much like open- and closed-loop payment networks, points to the likeliest lever: closed systems that control the agent end to end may be the first to take on liability, because they can see the whole transaction Will agentic commerce platforms adopt open or closed models?.
Sources 9 notes
Boboev argues that AI agents executing transactions remove behavioral fraud signals like typing cadence and mouse movement, leaving merchants holding liability as Merchant of Record across all proposed protocols. Merchants absorb autonomous-execution risk without access to the fraud-detection tools they historically used.
Boboev argues ACP, AP2, UCP, TAP, and Web Bot Auth each solve different layers—application, governance, discovery, and identity—creating a capability ladder merchants stack rather than choose between, with each layer absorbing different levels of fraud risk.
McKinsey argues that payment gateways and fraud engines built around explicit human identity and intent face significant strain when autonomous agents initiate transactions. The firm proposes cryptographically signed mandates as a replacement for human-observable signals fraud systems traditionally relied upon.
An IMF analysis argues that agent-mediated payments must split probabilistic AI decision-making (Layer 1) from deterministic authorization and settlement (Layers 2–3) because core payment infrastructure requires predictability and legal enforceability that probabilistic reasoning cannot guarantee.
Ablation studies show RACI accountability tags change outcomes only when the collaboration protocol's control flow passes the deliverable through the accountable agent. The best placement varies by model family, requiring per-model validation rather than universal design.
Show all 9 sources
Amazon's block of Meta's Muse reveals that AI agents need standardized ways to identify themselves and prove authorization to retailers—separate from consumer-side credential security. Without such protocols, retailers enforce access through terms-of-service blocks rather than negotiated standards.
Busch argues that agent-to-agent API transactions bypass design-based consumer protections like mandatory buttons and disclosure rules. He proposes parallel protocol-layer obligations, such as withdrawal APIs, to preserve substantive rights in a post-GUI transaction environment.
BCG's survey of 2,500 US consumers found that $1.3 trillion of e-commerce spend will shift to agent-assisted or autonomous shopping, with consumers and platform networks capturing most gains while merchants face structural disadvantage.
Waller argues agentic commerce platforms will divide between open systems allowing multiple agents and closed systems requiring proprietary ones, mirroring payment network structure. This choice will shape market concentration, vertical integration, and standards adoption.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- The agentic commerce opportunity: How AI agents are ushering in a new era for consumers and merchants
- How Agentic AI Will Reshape Payments
- From Product Search to Preference Articulation: The Economics of Agentic Commerce
- Payments in the Age of AI Agents
- AI Agents Want to Shop for You: The Future of Agentic Commerce
- Deep Dive: The hidden liability of agentic commerce
- Magentic Marketplace: An Open-Source Environment for Studying Agentic Markets
- Infrastructure for AI Agents