AI agents are moving from finding products to taking actions, and payments are exposing a new trust problem: merchants need to know whether an automated request is a legitimate agent acting for a real customer or an untrusted bot. On September 10, 2026, Visa, Mastercard and Ant International said they were working toward a common framework for identifying and verifying AI agents in commerce.
Why agentic payments need a trust layer
Normal online checkout assumes a person or a known software client is making the request. An AI agent changes that model. It may browse product pages, compare prices, choose an item and start a payment flow on a user's behalf.
The merchant still needs answers to basic questions: Which agent is this? Is it authorized? Which customer is behind it? What is the agent allowed to do? Can the payment be traced and controlled?
What the new industry work is about
Reuters reported on September 10 that Visa, Mastercard and Ant International announced a joint effort around standards for identifying and verifying agents. The goal is not simply to let more bots pass checkout. It is to create a common trust framework so legitimate agents can be distinguished from malicious automation.
This builds on work already happening across the payment industry. Visa's Trusted Agent Protocol, for example, defines ways for approved agents to identify themselves and carry signed information about agent intent, consumer recognition and payment data.
What Visa's protocol already shows
Visa's published specification describes a trust model based on multiple signed elements. These include an agent recognition signature, a linked consumer or device identity and a linked payment container. The merchant can use these signals to understand who is interacting with it and whether the request has been altered.
The important idea is that an agent should not be treated as an anonymous browser session. It needs a verifiable identity and a reason for being there.
Consumer trust is still the hard part
Visa's September 9 Trust Index found that only 23% of surveyed U.S. consumers said they trust GenAI to handle payment transactions for them. Visa says trust increased when the payment brand itself was considered.
This is useful context because the technical problem and the consumer problem are connected. A protocol can prove that a request came from an approved agent, but users also need clear controls, limits and ways to intervene.
What merchants should prepare for
| Area | What to prepare |
|---|---|
| Agent identity | Recognize trusted agents separately from generic automation. |
| Authorization | Record what the agent is allowed to do. |
| Customer identity | Keep visibility into the customer behind the agent. |
| Payment | Use controlled tokens or payment containers where supported. |
| Fraud controls | Apply risk checks to agent activity instead of bypassing them. |
Agent identity is not the same as user approval
A trusted agent can still make a bad decision. Merchant systems therefore need to separate two questions: is the agent authentic, and is the requested action authorized by the user?
A useful design could allow a customer to set spending limits, restrict categories or require confirmation for high-value transactions. The exact control model will differ by payment provider and merchant, but the principle is stable: identity does not replace authorization.
Why open standards matter
Merchants cannot build a custom integration for every agent provider. Interoperability is the real challenge. Visa's protocol documentation already points toward standards such as HTTP message signatures and work with standards organizations.
The September 10 industry announcement matters because several large payment players are now discussing common trust infrastructure. That does not mean a universal standard is finished. It means the market is moving toward shared rules rather than treating every agent as a one-off integration.
Security checks that should remain
Agents should not become a shortcut around normal fraud controls. Merchants still need rate limits, anomaly detection, authentication, transaction risk checks, logging and clear dispute processes.
Agent traffic should also be monitored for behavior that looks automated but is not properly authenticated. A signed identity field is valuable, but the server still needs to validate signatures and enforce its own authorization rules.
What this means for ecommerce and SEO
For ecommerce teams, agentic traffic creates a new technical relationship with the storefront. Product pages need clear product facts, prices, availability and policies because agents may retrieve and compare these details before a purchase.
That does not mean SEO teams should hide important information in scripts or create agent-only content. The better approach is to make the normal page clear and machine-readable while keeping pricing and inventory data accurate.
What to watch next
The next meaningful milestones are likely to be protocol adoption, merchant tooling, agent certification, stronger customer controls and evidence that these systems reduce fraud without blocking legitimate automation. The existence of a framework is not proof that agentic commerce is solved.
For now, merchants should treat agent payments as a security and identity problem, not simply another checkout channel.
Related ToolBoxKart guides
For the wider agent architecture, read the AI Agent Architect guide. For permissions and approvals, see How to Audit AI Agent Permissions and Human Approval Gates for AI Agent Workflows. For operational tracking, see AI Agent Audit Logs: What You Should Record.
Frequently asked questions
Why do AI agents need payment trust standards?
Merchants need to distinguish legitimate agents acting for customers from malicious bots and need reliable signals about identity, authorization and payment context.
Does Visa already have a trusted-agent protocol?
Yes. Visa publishes a Trusted Agent Protocol and technical documentation describing agent recognition, consumer recognition and payment information.
Does an authenticated agent have permission to buy anything?
No. Authentication and authorization are separate. A merchant or payment system still needs to enforce the limits and permissions that apply to the transaction.
Sources
- Reuters — Visa, Mastercard and Ant International AI agent trust framework
- Visa Developer — Trusted Agent Protocol
- Visa Developer — Trusted Agent Protocol specifications
- Visa — Trust Index for agentic commerce