Could one sign-in system both hide a shopper's card details and prove to the store which robot is checking out?
What identity and authorization standard would satisfy both consumer and merchant requirements?
This explores whether one identity-and-permission system could let a shopping agent protect the consumer's credentials and also prove to a merchant who it is and who sent it, or whether those two jobs need different machinery.
This explores whether a single standard can serve both sides of an agent purchase: the consumer, who needs their secrets protected and their intent respected, and the merchant, who needs to know which agent is at the door and whether a real person authorized it. The corpus suggests the honest answer is that no single standard does this today. The workable path looks like a small stack of layers that share common building blocks. Part of what makes the question hard is that people often treat the consumer and merchant requirements as one problem when they are really two. Storing a user's card and login in a vault keeps the agent from leaking them, but the consumer side controls that on its own, and it tells the merchant nothing about who is knocking (Can credential vaulting alone solve merchant-facing agent identification?). Amazon blocking Meta's Muse agent shows what happens without a merchant-facing layer. Retailers fall back on terms-of-service blocks because no agreed handshake exists (What identity standards do shopping agents actually need?).
The most promising answer to "what would satisfy both" is a chain of signed proofs, not a new standard. Authenticated delegation extends OAuth and OpenID Connect with three tokens: one for the user, one for the agent, and a delegation token the human signs. Any service can then check who authorized the agent, for what scope, and whether the permission has been revoked (How can AI agents prove who authorized their actions?). This covers the consumer's need for bounded permission and the merchant's need for verifiable accountability with one artifact. NIST's NCCoE takes the same line from a standards-body angle: reuse OAuth 2.0/2.1, OIDC and SPIFFE rather than inventing something new. It also notes that MCP is already built on these (Can existing identity standards work for AI agents?).
The payments industry is building the commerce-specific layers on top. Visa's Trusted Agent Protocol has agents sign their HTTP requests, so a merchant can tell a recognized agent from a scraper and receive intent and payment data along with the signature (Can cryptographic signatures help merchants identify trusted AI agents?). Google's AP2 handles the consumer side. It chains a signed Intent Mandate (what the user asked for) to a Cart Mandate (what the agent actually picked), which leaves a tamper-proof record of what the user approved (How can signed mandates prevent payment fraud by agents?). McKinsey explains why this matters: fraud engines used to infer intent from human behavior, and signed mandates are what replaces those signals once no human is clicking (Does agent-initiated commerce break existing payment infrastructure?). Boboev's framing ties these together. ACP, AP2, UCP, TAP and Mastercard's Web Bot Auth are rungs on a ladder that merchants stack depending on how much fraud risk they will absorb, not rival standards (Do agentic commerce protocols compete or complement each other?).
What the reader may not expect is that the technical design is the easy part. Even a perfect identity stack does not settle whether a merchant must let a verified agent in. Senator Warner's draft AI AGENT Act tackles that directly. It would create an FTC registry of trusted agents, require large platforms to admit them, and direct NIST to write the technical standard (Could federal AI agent registries solve platform access unfairness?). Busch adds a European angle: once transactions move to agent-to-agent APIs, consumer protections that depended on screens and buttons stop working. Consumer rights would need their own protocol-level hooks, such as a withdrawal API (Can EU consumer law rules survive agent-to-agent API transactions?).
There is one more catch. Identity proves who the agent is and who sent it. It does not prove whose side the agent is on. Azhar argues that an agent paid by merchant referral fees cannot be loyal to both parties, and that this incentive, more than the technology, is what decides who blocks whom (Can an AI agent serve both merchant and user interests fairly?). Consumers seem to sense this already. Only 23% trust AI to make payments, but 61% trust a known payments brand to stand behind agent transactions (Does naming a payments brand increase trust in AI transactions?). That suggests the standard that satisfies both sides may be the one carried by a trusted intermediary, whatever its exact cryptography.
Sources 12 notes
Secure credential storage is a unilateral consumer-security control that prevents agent exposure of secrets, but it cannot substitute for a visible, retailer-legible self-identification protocol that both the account holder and merchant must agree to separately.
Amazon's block of Meta's Muse reveals that AI agents need standardized ways to identify themselves and prove authorization to retailers—separate from consumer-side credential security. Without such protocols, retailers enforce access through terms-of-service blocks rather than negotiated standards.
A three-token scheme (User ID, Agent ID, and Delegation Token) signed by human delegators creates cryptographically verifiable authorization chains. Services can now verify who authorized an agent, under what scope, and when revocation occurred.
NIST's NCCoE concept paper argues that OAuth 2.0/2.1, OIDC, and SPIFFE/SPIRE should be applied to AI agents rather than developing new protocols. The paper identifies five priority areas—identification, authorization, access delegation, logging, and data flow tracking—and notes that MCP already embeds these standards as its foundation.
Visa developed Trusted Agent Protocol with Cloudflare to enable merchants to authenticate AI agents through agent-specific cryptographic signatures carrying intent, consumer recognition, and payment data. The protocol builds on HTTP Message Signatures and aims to bridge the gap between AI-assistant adoption and merchant trust.
Show all 12 sources
Google's Agent Payments Protocol chains signed Intent and Cart Mandates into tamper-proof records of user authorization. Built with 60+ payment firms, the protocol captures user intent upfront and verifies cart contents before payment, establishing accountability for agent-led transactions.
McKinsey argues that payment gateways and fraud engines built around explicit human identity and intent face significant strain when autonomous agents initiate transactions. The firm proposes cryptographically signed mandates as a replacement for human-observable signals fraud systems traditionally relied upon.
Boboev argues ACP, AP2, UCP, TAP, and Web Bot Auth each solve different layers—application, governance, discovery, and identity—creating a capability ladder merchants stack rather than choose between, with each layer absorbing different levels of fraud risk.
Senator Warner's discussion draft would require large platforms to admit AI agents, establish an FTC registry of trusted agents, impose best-interest duties on agents, and direct NIST to set technical standards. The package aims to prevent platforms from blocking competing agents while protecting user privacy and ensuring agent accountability.
Busch argues that agent-to-agent API transactions bypass design-based consumer protections like mandatory buttons and disclosure rules. He proposes parallel protocol-layer obligations, such as withdrawal APIs, to preserve substantive rights in a post-GUI transaction environment.
Azhar argues that agents like Meta's Muse, which earn referral fees from merchants like Expedia, face structural conflicts that prevent unbiased recommendations. The incentive to collect fees, not technology, determines which platforms build or block such agents.
A Harris Poll survey found 72% of US adults use AI assistants, but only 23% trust AI to execute payments. When Visa's name was attached, 61% reported trust in the company to handle agent-initiated transactions—suggesting consumers prefer a recognized intermediary over AI alone.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- Authenticated Delegation and Authorized AI Agents
- Payments in the Age of AI Agents
- The agentic commerce opportunity: How AI agents are ushering in a new era for consumers and merchants
- Accelerating the Adoption of Software and AI Agent Identity and Authorization (concept paper, draft)
- From Product Search to Preference Articulation: The Economics of Agentic Commerce
- Whom Do AI Agents Work For? Role Assignment Induces Sponsorship Bias in LLM Recommenders
- Deep Dive: The hidden liability of agentic commerce
- Powering AI commerce with the new Agent Payments Protocol (AP2)