Do agentic commerce protocols compete or complement each other?

Sam Boboev, in the Medium essay "Deep Dive: The hidden liability of agentic commerce," argues that the "protocol war" among emerging agentic-commerce standards is better read as a stack than a competition. He writes "I think it is a mistake to view these as competing products. They are building a 'capability ladder' that determines how much risk a merchant is prepared to absorb," and states that "each protocol addresses a different layer of the stack, from the application layer to the settlement layer."

He assigns each protocol a distinct layer. OpenAI and Stripe's Agentic Commerce Protocol (ACP), he says, is "the application layer for conversational commerce," built around a Shared Payment Token that scopes card data to a specific merchant and amount but, in his view, "does little to protect the merchant from intent disputes." Google's AP2, built with a coalition Boboev says includes 60 partners, is "the governance layer," using cryptographically signed "mandates" that reject a transaction before it reaches the processor if an agent tries to exceed its authorized spend. UCP, in his account, standardizes "discovery and post-purchase flows" — JSON-RPC 2.0 schemas for carts, logistics and returns — so a merchant can "build once" and reach any UCP-compatible agent. At the network level, he distinguishes Visa's Trusted Agent Protocol (TAP), a cryptographic identity standard built on "three distinct signatures" that lets an agent pass user context without a full login, from Mastercard's approach, which he calls a "no-code" method built on the IETF's Web Bot Auth standard (RFC 9421) at the CDN layer for "mass-market scalability."

This pattern sits alongside Does agentic commerce shift fraud liability onto merchants? — the same source's claim that no matter how far this ladder of protocols is climbed, Merchant-of-Record liability does not move. It also contrasts with Can existing identity standards work for AI agents?, which argues enterprises should reuse OAuth, OIDC and SPIFFE/SPIRE rather than adopt new agent-specific standards; Boboev's account describes the opposite trend in commerce, where ACP, AP2, UCP and TAP are each new, purpose-built protocols rather than extensions of existing identity infrastructure. AP2's "mandates" also parallel the token-based approach in How can AI agents prove who authorized their actions?, applying a similar delegation-proof concept specifically to payment authorization.

The excerpt only describes what each protocol is designed to do, attributed to its sponsors and to Boboev's own reading; it offers no evidence on adoption rates, interoperability in practice, or whether merchants are actually combining these layers as he predicts. If the layering holds as he describes it, a merchant's practical protocol choice is not a single either/or decision but a set of stacked integrations — checkout, governance, catalog, and identity — each solving a different part of the risk problem he identifies.