Over the past quarter, three numbers kept surfacing in every agentic-commerce deck I reviewed. Fifteen percent of merchants hold normalized, machine-readable product data. Twenty-three percent can reliably distinguish an AI agent from a human shopper. Eleven percent of small and mid-sized businesses describe themselves as "agent-ready."
None of those figures describe a model failure. They describe a plumbing failure. And in a bear market, plumbing failures are where capital quietly dies.
Agentic commerce is the term now attached to a simple proposition: let an autonomous software agent browse, negotiate, and pay on a user's behalf. The infrastructure behind it is not new AI. It is a stack of identity, authorization, and payment-delegation specifications โ Visa's Trusted Agent Protocol (TAP), Mastercard's Agent Pay, Google's Universal Commerce Protocol (UCP), and the Agentic Commerce Protocol (ACP) paired with Shared Payment Tokens (SPTs) that Stripe and OpenAI published.
Read those specifications closely and a pattern emerges. Every one of them is a mandate format, a signed identity claim, or a discovery-to-settlement orchestration layer. Not one is a reasoning breakthrough. The innovation is compositional and standardization-level, not architectural.
This matters because the popular narrative frames agentic commerce as the next frontier of model capability. The protocol layer tells a different story. When Amazon sued Perplexity in November 2025, and when a federal court in 2026 issued โ and an appellate panel later reversed โ an injunction over whether an agent "accessed" Amazon's computers, the dispute was never about intelligence. It was about who is allowed to act, and under whose identity.
What the decks never show is the actual GMV flowing through agent channels. The eightfold growth is impressive; the absolute base is undisclosed. In a bear market, growth rates without denominators are marketing, not data.
Here is the technical reality the marketing obscures. When an agent completes a purchase, four cryptographic questions must be answered simultaneously:
- Who is the agent? (identity)
- Who authorized it? (delegation)
- What is it permitted to spend? (scope)
- Who is liable if it errs? (accountability)
Current protocols answer questions two and three reasonably well. They answer questions one and four barely at all. The missing primitive is agent self-identification โ a cryptographic "I am who I say I am, and I represent this specific principal." Without it, every downstream trust assumption collapses.
The failure data confirms this. When PYMNTS ran its agent test against a shopping assistant, the assistant failed to reorder toilet paper, order a pizza, and book a restaurant. The stated causes were credential friction and application-connection faults โ not hallucination, not reasoning errors. The bottleneck is OAuth flows, session credentials, and cross-domain identity passing, not large language models.
I have seen this pattern before. In my own audit work on payment-delegation systems, the exploitable surface is never the headline feature. It is the token that lives too long. A Shared Payment Token or a signed mandate, once minted, is functionally a standing credit-card authorization. If it leaks โ through a compromised agent runtime, a mis-scoped OAuth grant, or a malicious plugin โ the attacker inherits the user's spending authority for the token's lifetime. The specifications I have reviewed spend pages on how to issue these mandates and almost nothing on revocation latency, replay windows, or blast radius after compromise.
Data normalization is the other invisible cost. Only fifteen percent of merchants publish machine-readable catalogs, and cleaning a mid-sized retailer's product data โ SKU hierarchies, variant logic, real-time inventory, price parity โ is a six-figure engineering project that no protocol specification funds. The mandate layer is solved. The catalog layer is a swamp.
Then there is attribution. Only twenty-three percent of merchants can separate agent traffic from human traffic. That single gap detonates the entire performance-marketing settlement layer. Affiliate networks, comparison sites, and paid-media agencies all price their work on a human-click-to-conversion chain. If an agent bypasses the click, the attribution basis vanishes. eBay's response โ an "any-click" model that charges if a purchase occurs within thirty days of a click โ is not a user-experience decision. It is a defensive attempt to keep the audit trail opaque and the transaction flow captive.
The twenty-three percent figure also hides a coming conflict. Bot-detection vendors โ Cloudflare, DataDome, Akamai โ built their stacks to block crawlers. Now they must separate a malicious scraper from an agent holding a valid user mandate. That distinction is a policy question dressed as a technical one, and it will be litigated.
Retailers have split into three camps. The welcoming camp hands its catalog directly to OpenAI and Google. The cautious camp โ eBay is the archetype โ permits browsing but forbids payment, carving narrow exceptions for favored agents. The gatekeeping camp, led by Amazon, blocks first and negotiates later. Each posture is a bet on whether the platform controls the customer relationship or surrenders it upstream.
The counterexample is instructive. Shopify enabled agent-readiness by default and reported AI-driven traffic up eightfold year over year into early 2026. Openness bought flow. Blocking bought isolation. Two platforms, two strategies, and only one of them is compounding.
Regulators have already signaled retreat. Federal Reserve Governor Christopher Waller framed trust as a market-structure problem, not a regulatory one, and indicated the central bank would not dictate how retailers treat agents. The practical consequence is a governance vacuum: the United States will likely run without unified agentic-commerce rules, leaving the ecosystem to fragment along platform lines.
From an auditor's seat, this is the part that should worry allocators. I don't trust any system where the security budget is justified by "the user will notice." Agents transact at machine speed; humans review at human speed. The gap between those two clocks is where fraud lives.
The blind spot in nearly every analysis is the assumption that this is a capability race. It is not. It is a standards war fought over identity and settlement, and the loudest participants are not the ones who will capture the value.
Consider the incentives. The four parallel protocols โ TAP, Agent Pay, UCP, and ACP/SPTs โ do not interoperate. There is no bridging layer. That fragmentation is not an accident; it is each sponsor protecting its own turf. When standards multiply, adoption slows, and the ecosystem pays the tax. That tax is real, and it is paid by developers who must integrate four incompatible mandates just to reach a fraction of the market.
The quiet winner is the payment network. Whatever protocol prevails, Visa and Mastercard sit underneath as the identity and trust layer. This is the shovel-seller position, and it is the lowest-risk seat in the room. I don't buy the framing that the agent platforms will disintermediate the card networks; the networks are the ones issuing the mandates.
The quieter risk is legal. A court ruling that "the user, not the AI company, accessed the computer" assigns liability to the party with the least real-time control over the agent. That is a responsibility-capability mismatch, and mismatches like this create moral hazard: platforms and agent vendors gain little by investing in safety when the user absorbs the loss. I have learned to distrust any operator's claims of impenetrable security, especially when the same operator is the gatekeeper. Anyone treating that ruling as a clean win for open agents is reading only half the decision.
Watch for one signal above all others: whether an interoperable agent-identity standard emerges โ a verifiable credential or an mTLS-style handshake that all four protocols accept. If it does, agentic commerce moves from pilot to pipeline within two years. If it does not, expect fragmentation into walled gardens, with retailers as the collateral damage. The doors are locked, but the locks are identity locks, not intelligence locks. Whoever holds the keys holds the market.
