From niche to mainstream: Agentic Commerce

In the first of our 'From niche to mainstream' series, we explored what might be the tipping point for stablecoins. We now turn our attention to AI. Now AI itself is clearly very much mainstream, having transformed the world in which we live in over the past few years. Our focus in this article will be about agentic commerce, and AI agents making payments. 

Most payment controls still assume a person is at the other end of the transaction. Banks and processors have spent years trying to work out which person: the real customer, someone using a stolen card, or the customer themselves being walked through a payment by a criminal on the phone.

The question underneath has stayed much the same: Is this the customer, and does this payment fit what we know about them?

Software acting on the customer’s behalf changes that. When an agent makes the payment, the customer can be entirely genuine and nowhere near the transaction. What matters is what they told the agent it could do, and whether it stayed inside that.

The first signs of that change are already appearing. Earlier this year, Santander and Mastercard reported Europe's first live end-to-end payment executed by an AI agent, using Mastercard Agent Pay in a controlled environment. Google has also taken agentic commerce into retail through its Universal Commerce Protocol, built with Shopify, Etsy, Wayfair, Target and Walmart among others. Visa  now runs an Agentic Ready programme to get issuers and partners prepared.

Retail will probably get there first, with agents helping people find products, build baskets and check out. Business payments could follow in areas where the same tasks happen again and again, such as matching invoices, reconciling accounts and paying suppliers.

Not every agent gets to spend

The simplest setup is one where the agent can help with the purchase but cannot complete it. It can find products, compare them and suggest what to buy, with the customer still approving the payment. Existing controls such as authentication, confirmation and transaction monitoring can then work much as they do today.

The harder case is when the agent can act by itself. It might use stored credentials, spend within a set limit, renew a subscription or pay an approved supplier from a company account. At that point, the payment system needs to know whether the customer is genuine and whether the agent was allowed to make that payment.

Both of those can be fine and the payment can still be wrong. The agent might have misunderstood the task, followed a manipulated prompt or ended up dealing with a fraudulent merchant.

A permission is something you can enforce

For agent-led payments, I think the starting point should be an explicit permission that the firm can see, change and enforce. Models can still help judge the behaviour around that permission, but they should not have to infer the permission itself.

If an agent has authority to spend, someone has already set the terms. That could include how much it can spend, how long the permission lasts, who it can pay and when a person needs to approve the transaction.

Those limits can be checked while the payment is happening and examined afterwards if something goes wrong.

A decision still has to be explained

Financial services is still working through this with the AI it already uses. In the Bank of England and FCA's most recent survey of AI in UK financial services, 34% of firms said they fully understood the AI they were using. Another 46% said they had only a partial understanding. Just 2% of use cases were fully autonomous.

If a payment is blocked, challenged or allowed through in error, someone has to be able to show how that decision was reached. That is one of the practical advantages of controls that can be inspected and changed, rather than relying solely on a model output.

Agent-led payments will not look like ordinary customer behaviour

Subscriptions renew automatically and merchants can already initiate certain transactions. Plenty of payments happen without a customer actively clicking through every stage.

Agents will add more of that activity, and some of it may look unusual by today's standards. They can move faster than people, transact at unusual times and spread activity across different providers.

Those behavioural signals still have value, but an agent needs another piece of context: the permission it is operating under.

That information then has to be available to the issuers, acquirers, merchants and processors that need to act on it while the payment is still live.

You need to be able to reconstruct the payment

If an agent makes a payment, the firm should be able to show who authorised it, what it was told to do, what limits applied and why the transaction was allowed, stopped or sent for review.

That depends on the infrastructure around it. Rules need to be configurable, authority needs to be clearly defined, and there needs to be a record of what happened. Simply identifying that an agent was involved does not help much if the payment platform cannot respond to that information.

The limit has to exist before the payment does

Firms can use models to assess behaviour, spot anomalies and decide where a transaction deserves a closer look. But an agent's authority should not have to be inferred after the event. It should already be defined in terms the payment system can enforce.

That is the part of agentic payments I think the industry needs to get right early. Once software can spend on someone's behalf, knowing exactly what it was allowed to do becomes part of the payment itself.