How a merchant verifies an AI agent, and who decides the rules

The problem nobody had two years ago

Bot management works. That is the difficulty. A merchant that spent years teaching its edge to reject automated traffic now finds that the most valuable new traffic on the internet is automated: shopping agents acting for real buyers with real payment methods. From the edge, an agent that adds to cart and a scraper that lifts your prices look identical. Both are headless, both come from a data centre, neither moves a mouse.

You cannot solve this with heuristics, because the distinction is not behavioural. It is a question of credentials. Which is why the answer arrived as protocol work rather than as better fingerprinting.

Three questions, three different answers

The single most useful thing to understand here is that verifying an agent is three separate problems that get collapsed into one in most coverage.

A merchant whose problem is the first row does not need the third, and vice versa. Getting this wrong is how integration budgets get spent on the wrong layer.

What Visa shipped, and why it starts at the CDN

Visa unveiled the Trusted Agent Protocol on 14 October 2025, developed with Cloudflare. The choice of partner is the tell: TAP is designed to be checked at the edge, before the request reaches your application. An agent presents a cryptographic signature built on HTTP Message Signatures (RFC 9421), aligned with Web Bot Auth. The signature is bound to your domain and to the specific operation, browsing or paying, and carries timestamps, a session identifier and key and algorithm identifiers so it cannot be replayed elsewhere.

Three information layers ride on that signature: agent intent, consumer recognition (an existing account or relationship, with consent) and optionally payment information such as Payment Account References for cards on file. The specification and a full sample implementation, including a CDN proxy that verifies the signatures, are public on GitHub.

Eight months later, at the Visa Payments Forum on 10 June 2026, Visa added the pieces that make verification operational rather than theoretical: Agent Score, which lets a merchant test whether agents can actually complete tasks on its site, an Agentic Directory acting as a trust registry of legitimate agents, and a Large Transaction Model applying AI to authorisation.

What Mastercard shipped, and why it starts at the token

Mastercard announced Agent Pay earlier, on 29 April 2025, and approached the same problem from the opposite end. Rather than proving identity at the merchant edge, Agent Pay registers and verifies trusted agents before they can pay, and issues Mastercard Agentic Tokens built on the tokenisation the network already runs. Consumer controls define what an agent may buy, and the transaction arrives recognisable as agent-initiated to every party in the chain.

On 20 January 2026, Mastercard set out how the pieces connect. It joined Google on the Universal Commerce Protocol the week of NRF, said it was working with Microsoft to bring Agent Pay to Copilot Checkout, and named continuing work with OpenAI, Cloudflare and PayPal. Its framing was explicit: the ecosystem had moved from experimentation to real commercial infrastructure. On 10 June 2026 it extended the program with Agent Pay for Machines for agent-to-agent payments and microtransactions.

Why the third question moved to FIDO

Identity is solvable with signatures. Proving that a human authorised a specific purchase is not, because it is an evidence problem that has to survive a dispute months later. That is why it left the vendors. On 28 April 2026 the FIDO Alliance formed an Agentic Authentication Technical Working Group, chaired by members from CVS Health, Google and OpenAI, and took contributions of Google's AP2 and Mastercard's Verifiable Intent into a Payments Technical Working Group chaired by Mastercard and Visa.

Its three stated work areas map exactly onto the table above: verifiable user instructions, agent authentication, and trusted delegation for commerce. Andrew Shikiar, the Alliance CEO, framed the requirement as needing people to trust that agent actions are secure, authorized and truly reflect their intent. For the governance implications of that move, see AP2 has left Google.

What to actually do

1. Measure before you build. Check whether legitimate agents are being rejected at your edge. If your bot defence is not blocking agent traffic, verification is not your bottleneck and feed quality probably is.
2. Start with the edge, not the checkout. TAP is verifiable at the CDN and built on a published IETF RFC, so the identity layer can be tested without changing your checkout.
3. Treat authorisation as a separate workstream, on a slower clock. It is being standardised at FIDO with the networks in the chairs, and the shape will firm up before you need to commit.
4. Do not bet on one network. Visa and Mastercard are approaching this from different ends and both are converging on the open protocols rather than replacing them, as we set out in card networks vs open protocols.

For the layer underneath, see how AI agents pay. For the part that decides whether an agent finds you at all, see how agents read your products.