Consider a ledger entry that does not balance. In the emerging market for "agentic commerce" — autonomous software transacting on behalf of humans — the protocols are live, the capital is deployed, and the failure rate is near-total.
Three consecutive agent tasks: reorder toilet paper, order a pizza, book a restaurant. Three failures. None of them involved a reasoning error. All three died on credential friction and application connectivity. The bottleneck is not intelligence. It is identity.
That single data point reframes an entire industry narrative. The consensus story — repeated in every bull-market pitch deck I have read this cycle — is that agentic commerce is the next frontier of AI capability. The evidence says otherwise. It is a story about plumbing: authentication flows, session credentials, and cross-domain identity propagation. When I spent four months in early 2017 reverse-engineering the Ethereum whitepaper's VM logic, I learned that the most important variables are usually the ones nobody puts on the slide.
The agentic commerce stack has assembled with remarkable speed. Visa's Trusted Agent Protocol (TAP) provides cryptographic signatures and identity declarations. Mastercard's Agent Pay and Stripe's Shared Payment Tokens (SPTs) formalize payment delegation. Google's commerce protocols orchestrate discovery-to-settlement. These are not model architectures. They are specifications — identity, authorization, and payment-mandate layers.
The legal scaffolding is following. When Amazon moved to block an external agent — citing its failure to self-identify and its scraping of sensitive account data — the dispute became a test case. A district court issued a preliminary injunction. An appellate panel later reversed it, reasoning that under the Computer Fraud and Abuse Act, it was the user who accessed the computer, not the AI company. That single sentence reclassified agent traffic as human traffic and weakened the legal basis for unilateral platform blocking.
Meanwhile, readiness data exposes the gap. Only 15% of merchants maintain normalized product data. Only 23% can distinguish AI from human traffic. Only 11% of small businesses are agent-ready. The protocols are ready. The plumbing is not.
The macro frame matters here, because it explains the timing. In a bull market, capital flows to narratives before infrastructure. This is the same pattern I documented in 2020, when DeFi Summer's yield-farming APYs were, in substance, the protocol subsidizing its own TVL number. Stop the incentive and the users vanish. Agentic commerce has the same tell: the incentive is the narrative, and the user is still hypothetical.
Let me deconstruct this from first principles, because the surface complexity conceals a simple structure.
Agentic commerce is not a model-capability competition. It is an identity and integration problem, and the failure modes prove it.
Consider what the protocols actually do. Visa TAP is cryptography plus a declaration of identity. Mastercard Agent Pay and Stripe SPTs are delegation tokens — mandates. Google's protocols are orchestration. None of these is an inference innovation. The innovation tier is compositional and standardizing, not architectural. That distinction is not semantic. It tells you where the value accrues and where the risk concentrates.
Now read the readiness data as an audit trail. The 15% figure — merchants with normalized product data — is the most underweighted number in the entire sector. Machine-readable catalogs require a full data-engineering pass: SKU normalization, attribute schemas, pricing integrity, inventory reconciliation. For a mid-market retailer, that is a six-to-nine-month project, not a checkbox. The protocol can be adopted in a week. The catalog cannot. The real cost of agentic commerce is data cleaning, and nobody is pricing it.
Then there is the traffic-detection problem. If only 23% of merchants can distinguish AI from human traffic, the entire settlement basis of performance and affiliate marketing degrades. Attribution — the click-to-purchase chain — assumes a human clicked. An agent does not click. It calls. This is not a rounding error. It is a structural collapse of the measurement layer. My work on cross-border payment rails taught me that when the unit of account breaks, every downstream contract breaks with it.
The trust data is equally blunt. Only 3% of consumers view chatbots as autonomous purchasers. Only 14% trust an agent to transact on their behalf. One in three active AI users say they will never hand over their wallet. Read that as a hierarchy: discovery is a low-stakes trust problem; payment is an order of magnitude higher. Consumers will let an agent browse. They will not let it spend.
And here the crypto-native framing fails. The instinct in my own industry is to reach for verifiable credentials, zero-knowledge identity, and on-chain settlement as the answer. But the agentic commerce stack as it exists is TradFi-native. TAP, Agent Pay, SPTs — these are extensions of card-network rails, not blockchain rails. The omnichain pitch — deploy your contracts on twelve chains — is, as I have argued before, a VC-manufactured metric. Users do not care how many chains your contracts touch. They care whether the agent can prove who it is.
Which brings me to the technical death-knot nobody names. Agent self-identification is the missing standard, and everything downstream depends on it. The platform block was justified by the agent's failure to declare identity. That is not a bug in the agent. It is a gap in the standard. We need something analogous to mutual TLS or an OAuth extension for machines — a cryptographic proof of "who I am, and who I represent." No such universal standard exists. Without it, every downstream trust primitive — fraud detection, liability allocation, data-access scoping — is unbuildable.
The fraud exposure follows directly. Existing risk systems are calibrated to human behavioral patterns — mouse movement, session duration, device fingerprints. An autonomous agent operates at machine speed and machine volume. A stability-fee-style anomaly detector cannot see it. In my 2020 simulation of MakerDAO liquidation cascades, I modeled exactly this class of failure: systems that behave correctly under normal volatility and catastrophically under correlated shocks. Agentic fraud is a correlated shock. The rate-and-volume detection is not there.
Then there is the mandate-token attack surface. A Shared Payment Token or an Agent Pay mandate is, functionally, a long-lived credit authorization. If it leaks, the exposure is not a single transaction — it is a standing permission. The industry has not modeled revocation and traceability for these tokens. The ledger remembers what the mind forgets, and a leaked mandate remembers for a very long time.
Let me synthesize the economics, because this is where my cross-border research is most relevant. The value will migrate upstream — from the retailer to the agent platform, the payment network, and the identity layer. If the agent becomes the default entry point for shopping, the retailer degrades into a replaceable fulfillment provider. Customer relationship and advertising value are captured upstream. That is the real source of platform anxiety. The blocking behavior is not protectionism for its own sake; it is a defensive moat around the transaction flow.
Now layer in the regulatory vacuum, which is the part most analysts skip. When I spent four months in 2024 analyzing the SEC's final rule text and the custody requirements reshaping liquidity providers, the lesson was that policy design determines who holds the pipes. Here, the signal is the opposite. Central bankers have indicated that trust in agentic payments is a market-structure problem, not a regulatory one — that no federal mandate will tell retailers how to handle agents. The governance is being outsourced to the platforms and protocol vendors, who have an obvious conflict of interest. That is a vacuum, and vacuums fill with whatever is cheapest, not whatever is safest.
Cross-border fragmentation compounds it. If the United States declines to legislate, the European Union classifies autonomous transactions as high-risk, and other jurisdictions write their own rules, global agentic commerce does not scale — it balkanizes into agent-friendly and agent-blocked zones. For anyone in cross-border payments, that is the scenario to plan for.
Here is the counter-intuitive read, and I want to state it plainly because it cuts against my own industry's instincts.
The low-risk winner in agentic commerce is not the AI company. It is the payment network. Whoever wins the protocol war — TAP, Agent Pay, or SPTs — Visa and Mastercard sit in the middle as the identity and trust layer. This is the shovel-seller logic, and it is nearly risk-free. The highest-risk position is the agent entry point, where the standard is unsettled and consumer trust is unproven.
But I want to flag my own skepticism about the evidence base. The most-cited readiness and trust data — the 15%, the 23%, the 14% — come from sources that are stakeholders in agentic commerce. Card-network indexes, ecosystem-funded research, and vendor-adjacent consultancies all have an incentive to conclude that readiness is low and trust is scarce. Why? Because scarcity of trust is an argument for accelerating adoption and building the infrastructure they sell. I have audited enough marketing claims to know that a low-readiness statistic can be a sales tool. Treat the trust gap as real but the precise numbers as contested.
The deeper contrarian point concerns liability. The appellate ruling placed responsibility on the user. On its face, that legitimizes agents. In practice, it creates a moral hazard: if the user bears the risk, the platform and the agent vendor have no incentive to invest in safety. And the user has no real-time control over an autonomous system. Responsibility has been assigned to the party least able to exercise it. That is not a stable equilibrium.
Agentic commerce is a policy and trust problem wearing the costume of a technology problem. The pipes are ready. The doors are locked. The hinges are rusted by an identity standard that does not yet exist.
The signal to watch is not a model benchmark. It is whether a universal agent-identity standard emerges in the next six to twelve months, and whether the payment networks begin disclosing per-transaction pricing for delegated mandates. Until then, the honest position is patience. In a bull market, patience is the contrarian trade. The question is not whether agents will transact. It is who will be legally and cryptographically accountable when they get it wrong — and whether that answer arrives before the first billion-dollar mandate leak.