How Does an AI Agent Actually Pays a Merchant?

An AI agent pays a merchant in four moves: it discovers the product through a commerce protocol, it carries a cryptographically signed mandate proving a human authorised this kind of purchase and set limits on it, it checks out using a scoped payment credential rather than the buyer's real card number, and the money settles on the same card rails everything else settles on. The merchant never sees a card. What the merchant sees instead is a claim of authority, and the entire industry is currently arguing about how to verify it.

• Why the absence of a human breaks a system nobody realised depended on one
• The anatomy of an agent purchase, step by step
• The protocol map as of August 2026, and how the pieces compose
• The trust signals that vanish, and what is being built to replace them
• Why an agent buying from an Indian merchant is harder than one buying from a US merchant
• The questions nobody has answered yet

The empty chair

For thirty years, every rule in card payments has rested on an assumption so obvious that it was never written down as an assumption: a human being was present at the moment of purchase.

That person typed a card number. Their device had a fingerprint. Their session had a history. Their behaviour had a rhythm. When a bank wanted more assurance, it pushed a challenge to the phone in their hand. When something went wrong afterwards, the dispute rules asked whether that person had authorised the charge, and the answer was findable because that person had been sitting there.

Agentic commerce removes the person from the chair. Not from the decision, but from the moment. The human says "order trail running shoes under a hundred and fifty dollars that arrive by Friday" on Monday, and something else does the buying on Wednesday.

Everything built between 2025 and 2026 (ACP, UCP, AP2, Verifiable Intent, Trusted Agent Protocol, Agentic Tokens) is the payments industry retrofitting an answer to one question it never had to ask before: Who was in the chair, and what were they allowed to buy?

Once you see the protocol landscape that way, it stops being alphabet soup. Each standard is one attempt at one part of that answer.

The anatomy of an agentic purchase

Six steps. In practice they blur, and different stacks do them in different orders, but every complete agentic purchase contains all six.

The first step happens with the human present. Steps two through six happen with the chair empty.

1. Mandate (human present) — Human sets scope, limits and consent. *AP2, Verifiable Intent.*
2. Discovery — Agent reads your catalogue. *UCP / MCP.*
3. Recognition — Buyer, scraper, or competitor? *Visa TAP.*
4. Credential — Scoped token, not the card. *Agentic Tokens.*
5. Authorisation — Existing rails, new metadata. *ACP / card.*
6. After the sale — Refunds, returns, disputes. *Unsettled.*

The human authorises once, at step one. Everything after that happens without them.

1. Mandate. Before anything is bought, the human gives the agent authority, and that authority is recorded. Google's AP2 does this with signed mandates. Mastercard's Verifiable Intent does it with an intent artifact recorded on Mastercard infrastructure. Both capture the same things: who the human is, what they asked for, what limits they set, and what they consented to. The mandate is not a permission slip. It is evidence, and that distinction turns out to matter enormously later.

2. Discovery. The agent finds candidate products. Structured product data, feeds, and MCP-style tool access live here. If your catalogue is not machine-legible, you are not in the consideration set. This is the part most merchants have already heard about, and the least interesting part of the problem.

3. Recognition. The agent arrives at your checkout and you have to decide whether it is a legitimate buyer, a scraper, or a competitor's price checker. Visa's Trusted Agent Protocol, introduced in October 2025 with Cloudflare as the reference bot-management implementation, exists for exactly this. Your bot defences were built to keep automated traffic out. Now some automated traffic is your customer.

4. Credential. The agent presents something chargeable, and it is not the buyer's card. Mastercard's Agentic Tokens are scoped tokens carrying a policy: per-transaction cap, monthly cap, allowed categories, expiry. Stripe and OpenAI's ACP uses a shared payment token so the agent transacts without the buyer's credentials being exposed. The consumer can revoke the agent's token from their banking app without touching the underlying card.

5. Authorisation. The transaction hits the rails. Under Mastercard's model the token presents to your existing processor much as a normal card does, with additional metadata flagging it as agent-initiated. Where policy is enforced at the network layer, a transaction outside the mandate's scope fails before it reaches the issuer.

6. Settlement, fulfilment, and everything after. The money moves on existing rails. Then the interesting problems start, because refunds, returns and disputes were all designed around a customer who can be contacted, and the entity that placed the order is software.

The protocol map, August 2026

The single most common mistake is treating these as competitors. They are layers. Most production flows touch two or more.
The FIDO Alliance formed an Agentic Authentication working group on 28 April 2026, drawing on contributions from both AP2 and Verifiable Intent. Read that as the industry deciding this should be one neutral standard rather than several vendor ones. It is the most important governance signal in the space so far.

``` ACP, UCP → how an agent buys AP2, V. INTENT → proof it was allowed to VISA TAP → whether you let it in AGENTIC TOKENS → what it pays with x402, MPP → when the buyer is not a person at all ```

The trust signals that disappear

This is the part of the problem that gets the least attention and matters the most operationally.

Every fraud model in production today was trained on human traffic. When an agent transacts, most of the inputs those models depend on are not there. Not suspicious. Absent.
Look at that third column and you are looking at a transaction profile that every legacy fraud system was trained to distrust. This is the real reason the networks moved so fast. Not because agent payments were hard to execute, but because good agent payments looked exactly like bad human ones.

Your fraud stack's instincts are now actively wrong on a growing share of legitimate traffic, and they stay wrong until it is retrained on transactions that arrive without a person attached.

Why this is harder if you are selling from India

Here is the part nobody has written, and it is the part that matters most if your customers are abroad and your business is not.

A cross-border card-not-present transaction already arrives at the issuer with fewer trust signals than a domestic one. Now stack an agent-initiated transaction on top, which strips out most of the remaining behavioural signals. You are not dealing with one context-poor transaction. You are dealing with two context-poor conditions compounding.

The mandate becomes your primary evidence

In a domestic dispute you have device data, session logs, delivery confirmation, and a customer you can reach. In an agent-initiated cross-border dispute, the signed mandate or intent artifact may be the strongest thing you hold. Merchants who treat these artifacts as protocol plumbing rather than as evidence to be retained and retrievable will discover the difference at the worst possible moment.

Ambiguity is fatal in a way it never was before

A human shopper tolerates "shipping calculated at checkout" and "import duties may apply". An agent comparing you against three alternatives against a hard constraint does not tolerate it. It cannot price you, so it drops you. For an Indian merchant selling globally, final landed cost, in the buyer's currency, exposed early and machine-readable, is the difference between being selectable and being invisible.

Fulfilment certainty becomes a ranking factor

Agents optimise against stated constraints, and "arrives by Friday" is a constraint. A merchant who cannot commit to a delivery window in structured form loses to one who can, regardless of price. Cross-border sellers are structurally disadvantaged here and should be over-communicating certainty, not hedging it.

Refunds have nowhere obvious to go

The order came from an agent. The money came from a scoped token that may since have been revoked. The human may never have looked at the confirmation. Every merchant selling into this channel needs an answer to "who do we refund and how do we tell them" before the first refund, not after.

What you actually have to expose to be agent-payable

Ranked by how much they matter and how few merchants have done them.

1. Structured product data. Complete attributes, real pricing, real inventory. Agents do not guess in your favour.
2. Final landed cost, early. Total price including shipping and any duties, in the buyer's currency, before checkout rather than at it.
3. A checkout an agent can traverse. Either a protocol implementation or, at minimum, a flow that does not depend on a human eye.
4. A bot policy that distinguishes buyers from scrapers. Your defences currently treat both as the same thing.
5. Structured fulfilment terms. Delivery windows and return terms as data, not prose on a policy page.
6. Retention of authorisation artifacts. Mandates and intent records stored, indexed, retrievable by order.
7. A refund and contact path that does not assume a human placed the order.

Items one to three decide whether you are in the running. Items four to seven decide whether the channel is profitable once you are.

Five things nobody has settled

I would rather write these honestly than pretend the picture is complete. Anyone telling you it is settled is selling something.

Who pays when the agent is wrong. As of 2026 no jurisdiction has enacted regulation specifically assigning liability for autonomous agent purchases. Card network frameworks and issuer decisions are filling the gap case by case. Where scoped tokens are validly issued and policy is honoured, network liability rules for tokenised transactions apply, but "the agent bought the wrong thing" is not fraud and does not fit cleanly anywhere. In the absence of a rule, the default falls where defaults usually fall.

What "authorised" means when authority was delegated once and used many times. A consumer authorising an agent to shop is not the same as authorising a specific purchase. How far a mandate stretches is precisely what the mandate standards are trying to pin down, and precisely what will be litigated.

How far up the chain accountability reaches. Modern agent stacks have planners spawning specialists calling tools. Recognition at the merchant boundary tells you which agent arrived. It tells you nothing about which component in a chain made the decision.

What happens to dispute ratios. Agent transactions are growing, dispute infrastructure for them is not yet built, and merchants absorb losses first as a matter of structure. Anyone modelling the economics of this channel without a variable for elevated dispute rates is modelling optimistically.

Whether the standards converge. The FIDO move suggests convergence. Visa's protocol-agnostic on-ramp suggests the networks expect fragmentation to persist and are hedging. Both can be true for years.

What I would do if I were running an Indian business selling globally

Twenty-eight years in payments, and I have watched this shape before. E-commerce in the late nineties, mobile in the late 2000s, tokenisation after that. The pattern repeats: a new initiation channel appears, the existing risk infrastructure treats it as anomalous, approvals suffer, and then over a few years the models absorb it and it becomes ordinary. The merchants who did the unglamorous plumbing early ended up owning the channel while it was cheap.

Do the data work now, because it is the only part that is definitely not wasted. Whichever protocols win, structured product data, real landed cost and machine-readable fulfilment terms are required. That work has a positive return even if agentic commerce grows slower than the forecasts.

Do not implement protocols directly yet. The layer is moving too fast and the translation between standards is still lossy. Get this through a payments partner whose job it is to absorb that churn, or through a platform that will. The exception is if you are large enough that being early is itself the strategy.

Decide today what you will keep. Every mandate, intent artifact and agent identifier that touches your orders should be retained and retrievable, starting with the first agent transaction you take. The cost is a schema change. The alternative is having no evidence in a dispute category whose rules are being written right now, against transactions you already accepted.

In a human checkout, the merchant's job was to persuade. In an agentic checkout, the merchant's job is to be verifiable. Persuasion was a marketing capability. Verifiability is an engineering one.

That is a genuinely different business to be in, and most of the companies that will win it have not noticed yet.