Visa wants merchants to recognize shopping bots the way they recognize legit browsers — but who gave the bot permission in the first place?
How does Visa's protocol differ from OAuth-based delegation approaches?
This explores how Visa's Trusted Agent Protocol, where an agent signs its requests so a merchant can recognize it, differs from OAuth-style schemes where a human grants an agent scoped permission to act for them, and whether the two compete or solve different problems.
This explores how Visa's approach to agent trust differs from OAuth-based delegation. The short answer from the corpus is that they mostly answer different questions. OAuth-style delegation answers *"who said this agent could do this?"* Visa's protocol answers *"is this a legitimate agent the merchant should let through?"* The first faces the person who authorized the agent. The second faces the merchant receiving its requests.
The OAuth approach builds a chain of permission. In How can AI agents prove who authorized their actions?, a human signs a delegation token that links three things: the user's identity, the agent's identity and the scope of what the agent may do. A service can check that chain, see who authorized the action and how far the permission reaches, and notice if it has been revoked. Sierra and Meta's Personal Agent Protocol follows the same idea: consumers use OAuth to decide what access to give an agent, and companies limit what agents can do (Can a protocol split agent access from agent incentives?). Visa's Trusted Agent Protocol, built with Cloudflare, works at a different point. The agent cryptographically signs its web requests using HTTP Message Signatures, and those signatures carry intent, consumer recognition and payment data, so a merchant can tell a trusted shopping agent apart from an anonymous bot (Can cryptographic signatures help merchants identify trusted AI agents?).
The corpus suggests the industry needs both, as separate layers. Boboev treats Visa's TAP and Mastercard's Web Bot Auth as the *identity* layer of a stack. Other layers include ACP, AP2 and UCP, which cover application logic, governance and discovery. Merchants add layers to this stack instead of choosing one (Do agentic commerce protocols compete or complement each other?). Allglenn's analysis of Amazon blocking Meta's Muse agent shows why the merchant-facing piece matters. Retailers had no standard way to recognize an agent, so they fell back on blocking it under their terms of service (What identity standards do shopping agents actually need?). Allglenn also argues that protecting the consumer's credentials does not solve merchant-facing identity, because the merchant has to be able to read and accept the agent's identification separately (Can credential vaulting alone solve merchant-facing agent identification?). OAuth delegation sits on the consumer's side of that split. TAP sits on the merchant's side.
There is also a difference in who people trust. In OAuth delegation, the permission comes from the user and the service checks it, with no central guarantor. Visa's model puts a payment network in the middle to vouch for agents. That may matter more than the technical design: in Visa's survey, only 23% of US adults trust AI to make payments, but 61% trust Visa to handle agent-initiated transactions (Does naming a payments brand increase trust in AI transactions?). The IMF makes a related structural argument. Authorization and settlement should stay predictable and rule-based, kept separate from the AI's probabilistic decisions (Should AI agents make payment decisions independently?). Both approaches fit in that predictable layer.
The part you might not expect to care about is what *neither* approach covers. A valid OAuth grant or a valid Visa signature proves an agent is authorized and recognized. Neither proves the agent is acting in your interest. An agent paid through merchant referral fees can pass every check and still steer you toward purchases that earn it money (Can a protocol split agent access from agent incentives?, Can an AI agent serve both merchant and user interests fairly?). Careful scoping can also be undone by one broad consent setting: an "allow always" checkbox reportedly let Muse finish a sale and share a user's address without checking back first (Do broad consent settings pose bigger risks than prompt injection attacks?). Identity and delegation protocols handle who the agent is and what it was allowed to do. Loyalty and meaningful consent remain open problems.
Sources 10 notes
A three-token scheme (User ID, Agent ID, and Delegation Token) signed by human delegators creates cryptographically verifiable authorization chains. Services can now verify who authorized an agent, under what scope, and when revocation occurred.
Sierra and Meta's protocol uses OAuth to let consumers authorize agents and companies restrict agent capabilities, but it does not address misaligned incentives like merchant referral fees. A merchant-paid agent could hold valid authorization while steering purchases for its own profit.
Visa developed Trusted Agent Protocol with Cloudflare to enable merchants to authenticate AI agents through agent-specific cryptographic signatures carrying intent, consumer recognition, and payment data. The protocol builds on HTTP Message Signatures and aims to bridge the gap between AI-assistant adoption and merchant trust.
Boboev argues ACP, AP2, UCP, TAP, and Web Bot Auth each solve different layers—application, governance, discovery, and identity—creating a capability ladder merchants stack rather than choose between, with each layer absorbing different levels of fraud risk.
Amazon's block of Meta's Muse reveals that AI agents need standardized ways to identify themselves and prove authorization to retailers—separate from consumer-side credential security. Without such protocols, retailers enforce access through terms-of-service blocks rather than negotiated standards.
Show all 10 sources
Secure credential storage is a unilateral consumer-security control that prevents agent exposure of secrets, but it cannot substitute for a visible, retailer-legible self-identification protocol that both the account holder and merchant must agree to separately.
A Harris Poll survey found 72% of US adults use AI assistants, but only 23% trust AI to execute payments. When Visa's name was attached, 61% reported trust in the company to handle agent-initiated transactions—suggesting consumers prefer a recognized intermediary over AI alone.
An IMF analysis argues that agent-mediated payments must split probabilistic AI decision-making (Layer 1) from deterministic authorization and settlement (Layers 2–3) because core payment infrastructure requires predictability and legal enforceability that probabilistic reasoning cannot guarantee.
Azhar argues that agents like Meta's Muse, which earn referral fees from merchants like Expedia, face structural conflicts that prevent unbiased recommendations. The incentive to collect fees, not technology, determines which platforms build or block such agents.
A single "allow always" checkbox can override advertised per-transaction approval safeguards, allowing agents to complete sales and share personal data without checking back first, as shown in a reported case where Meta's Muse closed a sale and gave out a user's address without confirmation.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- Payments in the Age of AI Agents
- When Agents Shop for You: Role Coherence in AI-Mediated Markets
- Authenticated Delegation and Authorized AI Agents
- Amazon blocked Meta's Muse at the account wall
- The agentic commerce opportunity: How AI agents are ushering in a new era for consumers and merchants
- From Product Search to Preference Articulation: The Economics of Agentic Commerce
- Agentic Commerce and Incentives
- Visa Introduces Trusted Agent Protocol: An Ecosystem-Led Framework for AI Commerce