Agentic Commerce Moves the Checkout Risk Upstream

<h1>Agentic Commerce Moves the Checkout Risk Upstream</h1> <h2>Executive summary</h2> <p>The first wave of agentic-commerce products is being sold as a checkout story: software can find an item, assemble a cart and pay without making the customer move through a conventional purchase funnel. That description is directionally right and operationally incomplete. An agent can remove screens, but it cannot remove the need to establish intent, constrain authority, identify the merchant, protect credentials, handle exceptions and prove what happened after a disputed transaction.</p> <p>Those functions are moving earlier in the journey and becoming machine-readable. Visa is building agent and merchant directories, token-assurance signals and spend controls. Mastercard is extending credentialing and settlement to high-frequency machine payments. Google-backed protocols separate the commercial order from the authorization mandate. Stripe is introducing shared payment tokens and machine-payment standards that let an agent transact without receiving the underlying card credential. The common design choice is revealing: the emerging control plane sits upstream of checkout.</p> <p>For merchants, issuers and platforms, the near-term decision is not whether to “add an AI checkout.” It is which actions an agent may take, what evidence must travel with each action, who owns the exception and how performance will be measured. The winners will make products legible to agents while keeping authority narrow, reversible and observable.</p> <h2>Market context</h2> <p>Agentic commerce combines two workflows that digital commerce historically kept separate. Product discovery and recommendation occurred in media, search or a merchant interface; payment authorization occurred later, after the buyer had reviewed a cart and interacted with checkout. An agent can collapse these steps into one delegated instruction: find an acceptable product, choose a seller and complete the purchase subject to constraints.</p> <p>That compression creates real value. It can reduce repetitive form entry, search costs and procurement administration. It also weakens several controls that relied on a person being present. A conventional checkout can ask the buyer to confirm the amount, recognize the merchant descriptor, pass step-up authentication, accept terms and notice that a product is non-refundable. An autonomous flow must encode those judgments before the transaction or know when to stop and ask.</p> <p>The infrastructure market is responding quickly. <a href="https://investor.visa.com/news/news-details/2026/Visa-Announces-New-AI-Stablecoin-and-Token-Innovations-to-Power-Intelligent-Programmable-Commerce-at-Visa-Payments-Forum/default.aspx" rel="noopener noreferrer" target="_blank">Visa Intelligent Commerce</a> includes agent scoring, a directory of verified participants, transaction controls and token-assurance signals. <a href="https://investor.mastercard.com/investor-news/investor-news-details/2026/Mastercard-Launches-Agent-Pay-for-Machines-to-Unlock-Super-Fast-Always-On-Payments/default.aspx" rel="noopener noreferrer" target="_blank">Mastercard Agent Pay for Machines</a> is designed for programmatic, low-value and high-frequency payments across cards and stablecoins. <a href="https://stripe.com/blog/machine-payments-protocol" rel="noopener noreferrer" target="_blank">Stripe's Machine Payments Protocol</a> coordinates a payment request and delivery of a digital resource, while Shared Payment Tokens let agents initiate supported payment methods without exposing raw credentials.</p> <p>Demand signals are moving faster than autonomous purchasing. Adobe's analysis of more than one trillion U.S. retail-site visits found that AI referral traffic converted below other traffic in three 2025 observations and was 42% above it in March 2026. That is evidence of higher-intent discovery, not proof that agents independently completed purchases.</p> <h3>Chart 1: March 2026 AI referral conversion showed a premium after 2025 deficits</h3> <p><em>Interactive chart placeholder: Chart 1: March 2026 AI referral conversion showed a premium after 2025 deficits. Use the sourced data or framework below without changing its values, method, or limitations.</em></p> <figure class="data-table"> <table> <thead> <tr><th scope="col">Observation month</th><th scope="col">Relative conversion likelihood versus pooled non-AI traffic</th></tr> </thead> <tbody> <tr><td>January 2025</td><td>49% lower</td></tr> <tr><td>April 2025</td><td>38% lower</td></tr> <tr><td>July 2025</td><td>23% lower</td></tr> <tr><td>March 2026</td><td>42% higher</td></tr> </tbody> </table> <figcaption>Source: Adobe Digital Insights, <a href="https://business.adobe.com/blog/generative-ai-powered-shopping-rises-with-traffic-to-retail-sites" rel="noopener noreferrer" target="_blank">August 2025</a> and <a href="https://business.adobe.com/blog/ai-traffic-surge-retail-sites-not-machine-readable" rel="noopener noreferrer" target="_blank">April 2026</a>. Period: January 2025–March 2026; four non-contiguous observations. Unit: relative likelihood of a direct transaction versus pooled non-AI channels, not absolute conversion rate. Method: Adobe analysis of more than one trillion U.S. retail-site visits. Limitations: referral sessions are not autonomous transactions; channel, product and seasonal mix are uncontrolled; the exact crossover date is not observed.</figcaption> </figure> <p>Standards are also decomposing the workflow. Google's <a href="https://developers.googleblog.com/under-the-hood-universal-commerce-protocol-ucp/" rel="noopener noreferrer" target="_blank">Universal Commerce Protocol</a> describes products, checkout sessions and order state. Its <a href="https://developers.googleblog.com/en/developers-guide-to-ai-agent-protocols/" rel="noopener noreferrer" target="_blank">Agent Payments Protocol</a> adds signed intent and payment mandates, including merchant restrictions, amount limits, expiry and escalation. The separation matters: knowing what to buy is not the same as proving permission to pay.</p> <h3>Chart 2: Reported ecosystem activity</h3> <p><em>Interactive chart placeholder: Chart 2: Reported ecosystem activity. Use the sourced data or framework below without changing its values, method, or limitations.</em></p> <figure class="data-table"> <table> <thead> <tr><th scope="col">Provider disclosure</th><th scope="col">Date</th><th scope="col">Reported activity</th><th scope="col">Unit</th><th scope="col">Interpretation and limitation</th></tr> </thead> <tbody> <tr><td>Visa Intelligent Commerce</td><td>Dec. 2025</td><td>100+ partners; 30+ building in sandbox; 20+ direct integrations; hundreds of completed agent-initiated transactions</td><td>Partners, integrations and transactions</td><td>Company-reported milestones; categories overlap and do not establish mass-market volume. <a href="https://investor.visa.com/news/news-details/2025/Visa-and-Partners-Complete-Secure-AI-Transactions-Setting-the-Stage-for-Mainstream-Adoption-in-2026/default.aspx" rel="noopener noreferrer" target="_blank">Source</a></td></tr> <tr><td>Visa Agentic Ready</td><td>Apr. 2026</td><td>20+ partners live in Europe/UK; planned rollout to 85+ partners in Asia Pacific and Latin America</td><td>Program partners</td><td>Readiness participation, not completed purchase volume. <a href="https://investor.visa.com/news/news-details/2026/Visa-Announces-Global-Expansion-of-Agentic-Ready-Program/default.aspx" rel="noopener noreferrer" target="_blank">Source</a></td></tr> <tr><td>Mastercard Agent Pay for Machines</td><td>June 2026</td><td>30+ named ecosystem supporters</td><td>Organizations</td><td>Support or early adoption can range from integration work to endorsement. <a href="https://investor.mastercard.com/investor-news/investor-news-details/2026/Mastercard-Launches-Agent-Pay-for-Machines-to-Unlock-Super-Fast-Always-On-Payments/default.aspx" rel="noopener noreferrer" target="_blank">Source</a></td></tr> </tbody> </table> <figcaption>Source and method: direct transcription of linked company disclosures dated December 2025–June 2026. Units: partners, integrations and transactions as labeled. Limitations: definitions overlap, units are not comparable and values should not be summed. The exhibit shows ecosystem formation, not consumer adoption or payment volume.</figcaption> </figure> <h2>Findings</h2> <h3>Finding 1</h3> <p><strong>The control point moves from the checkout page to the mandate.</strong></p> <p>The mainstream interpretation is that agents make checkout disappear. What disappears is the visible sequence of screens. The economic and legal requirement for authorization remains. In an agentic flow, the most important object may no longer be the cart; it may be the mandate that defines the scope of delegation.</p> <p>A useful mandate answers at least six questions: who authorized the agent, which agent received the authority, which merchants or categories are allowed, how much may be spent, when the authority expires and which conditions require human approval. It should also bind the final cart to the original instruction so that an agent cannot satisfy “buy a refundable economy ticket” with a non-refundable fare merely because the price is lower.</p> <p>This is why protocol designs are introducing signed intent, payment-specific authorization and receipts. It is also why networks are adding richer token context. The authorization decision needs evidence about the actor and the delegated purpose, not only a credential and an amount.</p> <h3>Infographic 1: The control path moves upstream</h3> <p><em>Static infographic placeholder: Infographic 1: The control path moves upstream. Use the sourced framework below without changing its meaning or limitations.</em></p> <figure class="data-table"> <table> <thead> <tr><th scope="col">Control stage</th><th scope="col">Conventional commerce</th><th scope="col">Agentic commerce requirement</th><th scope="col">Failure if omitted</th></tr> </thead> <tbody> <tr><td>Intent</td><td>Buyer navigates and selects</td><td>Machine-readable objective and constraints</td><td>Agent optimizes the wrong variable</td></tr> <tr><td>Authority</td><td>Buyer is present at checkout</td><td>Delegated mandate, amount/category limits and expiry</td><td>Unauthorized or over-broad purchase</td></tr> <tr><td>Identity</td><td>Account, device and payment authentication</td><td>User, agent and merchant identities linked to the transaction</td><td>Impersonation and weak attribution</td></tr> <tr><td>Credential</td><td>Card or wallet presented</td><td>Scoped token inaccessible to the agent</td><td>Credential leakage and reuse</td></tr> <tr><td>Confirmation</td><td>Cart review and step-up</td><td>Policy engine plus exception threshold</td><td>Silent substitution or hidden terms</td></tr> <tr><td>Evidence</td><td>Receipt and customer-service records</td><td>End-to-end event log tied to mandate and order</td><td>Disputes cannot be reconstructed</td></tr> </tbody> </table> <figcaption>Source and method: Blackrock Research functional mapping of AP2, UCP, Visa and Stripe materials published through August 2026. Period: September 2025–August 2026. Units: qualitative control stages; not applicable. Limitation: this is a synthesis of disclosed designs, not a mandated architecture or measured adoption study.</figcaption> </figure> <h3>Finding 2</h3> <p><strong>Merchant readiness begins before payment acceptance.</strong></p> <p>An agent cannot reliably buy what it cannot interpret. Product attributes, availability, total price, delivery promises, cancellation rules and return conditions must be structured and current. A beautiful product page can be illegible to software; a technically accessible page can still create a bad transaction if the agent cannot determine whether a fee is mandatory or a product is compatible.</p> <p>This shifts part of conversion optimization from visual persuasion to data quality and policy clarity. Merchants will need stable identifiers, machine-readable variants, explicit landed cost and deterministic order-state APIs. They will also need rules for agent access: rate limits, bot identification, inventory reservation, price parity and the treatment of personalized offers.</p> <p>The strategic risk is disintermediation. If an external agent controls discovery and choice, the merchant may gain efficient conversion while losing the opportunity to shape consideration, collect first-party signals or sell a higher-margin alternative. Agent readiness therefore needs a contribution-margin test, not only a technical launch checklist. Operators should compare incremental gross profit with new acquisition fees, returns, support contacts, promotion leakage and the value of customer identity retained.</p> <h3>Finding 3</h3> <p><strong>Exceptions, not successful transactions, will determine the operating model.</strong></p> <p>A demonstration usually shows an agent completing the happy path. At scale, value will depend on what happens when inventory changes, delivery is delayed, the price moves, a subscription renews, a hotel requires a deposit, a partial refund is offered or a customer says the result did not match the instruction.</p> <p>These cases cross organizational boundaries. A payment processor can confirm authorization but cannot decide whether a substituted product met the customer's intent. A merchant can issue a refund but may not know which agent interpreted the constraint. An agent platform can retain the conversational instruction but may not control fulfillment. Without a shared evidence chain, each party can be locally correct while the customer remains unresolved.</p> <p>Our inference is that agentic commerce will initially scale fastest in transactions with standardized products, explicit prices, reversible fulfillment and low exception costs. Digital services, replenishment purchases and bounded business procurement fit better than bespoke travel, complex financial products or high-return fashion. Separately, OpenAI's <a href="https://openai.com/policies/commerce-policies/" rel="noopener noreferrer" target="_blank">commerce policies</a> prohibit or restrict several categories with legal, fulfillment or chargeback complexity; the policy establishes guardrails, not adoption order.</p> <h3>Agentic-commerce readiness scorecard</h3> <figure class="data-table"> <table> <thead> <tr><th scope="col">Dimension</th><th scope="col">Executive question</th><th scope="col">Launch evidence</th><th scope="col">Leading KPI</th></tr> </thead> <tbody> <tr><td>Catalog legibility</td><td>Can an agent determine the exact product, price and terms?</td><td>Structured feed and policy schema pass validation</td><td>Product-match exception rate</td></tr> <tr><td>Delegated authority</td><td>Can every purchase be tied to a narrow, expiring mandate?</td><td>Signed mandate and escalation tests</td><td>Human escalation rate by reason</td></tr> <tr><td>Identity and trust</td><td>Can the merchant distinguish approved agents and legitimate users?</td><td>Agent verification and token controls</td><td>Fraud and false-decline rate by channel</td></tr> <tr><td>Reversibility</td><td>Can cancellations, refunds and substitutions be handled through APIs?</td><td>End-to-end exception simulations</td><td>Time to resolution and refund leakage</td></tr> <tr><td>Economics</td><td>Is the channel incremental after returns, fees and support?</td><td>Cohort contribution-margin model</td><td>Contribution margin per agent order</td></tr> <tr><td>Observability</td><td>Can operations reconstruct intent, authorization and outcome?</td><td>Shared event IDs and auditable logs</td><td>Unattributed dispute rate</td></tr> </tbody> </table> <figcaption>Source and method: Blackrock Research framework derived from network, processor and open-protocol materials published December 2025–August 2026. Units: qualitative dimensions and proposed KPI definitions; no values or thresholds. Limitation: no universal benchmarks are supported by public data. Operators should compare agent cohorts with matched human-initiated transactions.</figcaption> </figure> <h2>Implications for operators</h2> <ul> <li><strong>Treat agentic commerce as a governed channel.</strong> Assign an accountable executive across commerce, payments, fraud, legal and customer operations. A checkout-team pilot without post-purchase ownership will optimize the visible transaction and externalize the expensive failures.</li> <li><strong>Start with bounded use cases.</strong> Choose products with reliable availability, explicit terms and inexpensive reversibility. Set low initial limits, short mandate durations and narrow merchant or category permissions. Expand authority only when exception data supports it.</li> <li><strong>Instrument the full decision path.</strong> Store the customer's instruction, the agent identity, catalog version, applied constraints, final cart, authorization evidence, fulfillment events and resolution outcome under linked identifiers. Minimize retained sensitive data, but do not confuse data minimization with the absence of an audit trail.</li> <li><strong>Negotiate data and liability before distribution.</strong> Contracts with agent platforms should specify who authenticates the user, who verifies the agent, who presents terms, who handles service, what data the merchant receives and how disputed intent is adjudicated. These choices affect loss rates and customer ownership more than the payment API.</li> <li><strong>Measure incrementality.</strong> Track whether agent orders bring new demand or merely redirect existing high-intent customers through an additional intermediary. Compare contribution margin, return rate, support cost and repeat behavior against equivalent direct orders.</li> </ul> <h2>Risks &amp; open questions</h2> <p>The thesis would weaken if agents remain primarily discovery tools and consumers continue to approve most final purchases. It would also weaken if a small number of interoperable standards converge quickly, fraud and dispute rates match human-initiated commerce, and merchants retain customer identity without additional economic concessions.</p> <p>Evidence is still early and largely vendor-reported. Public disclosures count partners, pilots and integrations more often than payment volume, approval rate, fraud, disputes or incremental conversion. Network, processor and platform announcements demonstrate investment, not inevitability. Regulation and card-network rules may also assign responsibility differently across markets.</p> <p>Three questions deserve continued monitoring: whether mandates become portable across agents and payment methods; whether consumers understand and actively manage delegated authority; and whether the party controlling the agent interface captures a durable share of merchant economics.</p> <p>Existing fraud controls also set an important boundary. The EBA and ECB found strong customer authentication remained effective against the fraud it was designed to stop, even as total reported payment fraud in the European Economic Area rose from €3.5 billion in 2023 to €4.2 billion in 2024 and payer manipulation increased. Authentication can establish who acted; it cannot establish that an instruction was wise or free from manipulation. <a href="https://www.eba.europa.eu/publications-and-media/press-releases/joint-eba-ecb-report-payment-fraud-strong-authentication-remains-effective-fraudsters-are-adapting" rel="noopener noreferrer" target="_blank">Source</a></p> <h2>Appendix / methodology notes</h2> <p>This report reviewed primary announcements and technical materials published from December 2025 through August 2026 by Visa, Mastercard, Stripe, Google and OpenAI. Company-reported ecosystem counts were retained in their original units and were not combined. Product descriptions were compared at the functional-control level because public performance data remain insufficient for statistically valid cross-provider comparisons.</p> <p>No synthetic transaction, adoption or fraud data are presented. The recommended scorecard is a management framework, not an industry benchmark. A future quantitative update should add agent-initiated payment volume, approval and false-decline rates, fraud loss in basis points, dispute reason, refund rate, support cost and 90-day repeat purchase, segmented by merchant category and compared with matched human-initiated transactions.</p>