From Chatbot to Checkout: What the Agentic Commerce Protocol Actually Changes for a Merchant

What an agentic commerce protocol actually is

Strip away the branding and an agentic commerce protocol is a shared rulebook. It defines how an AI agent, acting for a shopper, can talk to a merchant's systems to discover a product, assemble a cart, and pay for it, in a way both sides can trust. The reason this needs a protocol rather than clever prompting is that money and authorization are involved. A merchant has to know the request is genuine and paid; a buyer has to know the agent did what it was told and nothing more. A protocol is the contract that makes those guarantees legible to software on both ends.

The shift for a merchant is where the transaction begins. For thirty years the sale started with a human arriving at your site: they searched, clicked, browsed, and checked out. An agent-initiated checkout inverts that. The buyer states an intent to an assistant, the assistant does the finding and the transacting, and your storefront is engaged through an interface rather than a web page. You are still the seller. What changes is that your first customer is increasingly a piece of software reading a structured surface, not a person reading your homepage.

That these standards exist as shipped specifications is the load-bearing fact. ACP is published under an Apache-2.0 open license with a public specification and code repository. AP2 arrived with named payment-network partners. UCP is being built with named retail platforms. This is infrastructure with signatures on it, which is reason enough to take it seriously now rather than later.

Three protocols, one shift: ACP, AP2, and UCP

Three efforts dominate right now. They overlap in ambition and differ in origin, and it helps a merchant to hold them apart without over-reading the differences, which are still settling.

The shared payment token: how an agent pays without holding the card

The obvious objection to letting software buy things is the one about the card. Nobody wants an autonomous agent holding their payment credentials or spending without limit. ACP's answer is the Shared Payment Token, and understanding it removes most of the fear from the mechanics.

Rather than handing the agent a card number, the buyer's payment provider issues a token that stands in for the payment and carries the scope of what is permitted. The agent presents that token to complete a specific purchase; it never sees the underlying card. The merchant is paid through the normal rails, and the authorization is bounded to the transaction it was minted for. In plain terms, the token is a single-purpose permission slip, not a copy of the wallet. That design is what makes agent-initiated checkout something a payments network is willing to stand behind rather than an obvious fraud vector.

For a merchant the practical consequence is reassuring and specific: an agentic sale settles through the same payment infrastructure you already use, and the novelty sits in how the payment is authorized, not in who ultimately gets paid or how the funds move.

Mandates: how AP2 makes an agent-initiated purchase provable

AP2's central idea is the mandate. Every agent-driven purchase is represented as three signed, verifiable digital credentials, each capturing a distinct step so that the whole transaction can be audited after the fact. The three are the intent mandate, the cart mandate, and the payment mandate.

The intent mandate records what the buyer authorized the agent to do, the boundary of the shopper's instruction. The cart mandate records the specific items and prices the agent assembled to satisfy that intent. The payment mandate records the authorization to pay for that exact cart. Because each is cryptographically signed, a dispute has an evidence trail: you can show what the buyer asked for, what the agent chose, and what was authorized, rather than arguing about it. This matters because agent-mediated purchases raise an accountability question that ordinary checkouts do not, and the mandate structure is AP2's attempt to answer it before it becomes a problem.

A merchant does not need to implement the cryptography to grasp the point. The design intent is that an agent-initiated checkout should be at least as provable as a human one, and arguably more so, because the chain of authorization is recorded rather than inferred from a session.

Share of answer becomes share of transaction

There is a structural requirement hiding inside all three protocols, and it is the part a merchant should internalize even if the acronyms fade. To be transacted with by an agent, a business has to expose a machine-legible, policy-declared, and verifiably authorized surface that the agent can read and act on. An agent cannot buy from a storefront it cannot parse, cannot price against a page it has to interpret like a human, and cannot check out through a flow it was never given structured access to.

This is the direct commercial twin of a lesson search already taught. A business can rank first in classic results and still be absent from the AI answer written above them, because being ranked and being cited are different achievements. The same decoupling now reaches the cart. A business can have a perfectly good website that converts human visitors well and still be effectively un-buyable by an agent that never sees a structured product or booking surface. Share of answer, the question of whether an engine names you, gains a sibling: share of transaction, the question of whether an agent can actually complete a purchase with you.

The framing here is preparatory. The protocols are live, but whether and how fast buyers route real purchases through agents, especially for small local and service businesses, is not yet a settled or measured fact. The defensible conclusion is narrower: the surface an agent needs is the same kind of clean, structured, machine-readable surface that already governs whether you are visible in AI answers, so preparing one is not a bet on a single protocol winning. It is a bet on the direction, which the evidence supports, rather than the timeline, which it does not.

Who is liable when an agent buys the wrong thing?

Agent-initiated checkout inherits an accountability principle that is already established in law, and a merchant should not miss it in the excitement about mechanics. A business owns what its deployed AI says and does in public.

The reference case is Moffatt v. Air Canada (2024 BCCRT 149), in which a tribunal held the airline liable for negligent misrepresentation after its website chatbot gave a customer wrong information, and rejected the argument that the chatbot was a separate legal actor. The damages were modest, around 650 Canadian dollars, but the precedent is now cited as foundational: the company is responsible for its bot, whether the words came from a static page or a model. Move that principle into commerce and the implication is plain. When an agentic surface represents your prices, your policies, or your inventory to a buying agent, errors in that representation are yours to answer for.

The regulatory posture points the same way. The FTC's Operation AI Comply, launched in 2024, brought simultaneous actions against companies making unsubstantiated AI capability claims, and its finalized order against DoNotPay required consumer redress and barred professional-grade claims the company could not support. The lesson for an agentic-commerce merchant is not to fear the technology but to describe it accurately: what your agent-facing surface promises must be what it delivers, because overstated capability is itself an enforcement risk.

What is established, what is emerging, and what nobody can measure yet

Reading this topic well means keeping three tiers of certainty separate, because the temptation to collapse them into a single confident story is strong on both the hype and the skeptic side.

What is established is the infrastructure. The specifications shipped on dated, public timelines, under named licenses, with named payment-network and platform partners. ACP, AP2, and UCP exist, and their core mechanisms, the shared payment token and the three mandates, are documented rather than rumored. What is emerging is behavior. Anthropic's own usage telemetry shows business use of AI tilting heavily toward full-task delegation over collaborative chat, and its sales-workflow API use roughly doubling over a recent winter window, which is directionally consistent with agents doing more transactional work; but that is a signal about trajectory, not a measurement of agentic retail. What nobody can yet measure is small-merchant reality. There is no reliable data, in the research surfaced for this piece, on how many small and mid-size merchants are actually being transacted with through these protocols, as opposed to the enterprise Etsy and Shopify partners named in the launch announcements.

That final gap is the one to hold onto, because it is exactly where confident numbers get invented. Anyone quoting a precise share of small-business sales flowing through AI agents today is asserting, not measuring. The correct posture is to treat agentic commerce as shipped-but-early: real enough to prepare for, too young to size.

Reading the evidence: prepare the surface, not the hype

The useful conclusion for a merchant is not to rush to integrate a specific protocol before its winner is clear, nor to dismiss the whole thing as vendor theater. It is narrower and more durable.

First, understand that the readiness these protocols demand is mostly readiness you already need. A clean, structured, machine-legible representation of your products, prices, policies, and booking or checkout surface is the same asset that governs whether an AI answer can cite you and whether an agent can transact with you. Building it is not a speculative bet on ACP over AP2. It is the shared prerequisite underneath all of them.

Second, decide deliberately where an agent may act on your behalf and where a human stays in the loop, using reversibility as the dividing line, the same discipline published autonomy frameworks apply to any AI system. Letting an agent surface your catalog is low-stakes; letting one accept a booking, take a payment, or promise a policy exception is not, and those steps deserve a check.

Third, resist the invented number. The direction of agent-mediated commerce is well evidenced; the timeline and the small-business volume are not. A business that prepares its surface, scopes agent autonomy honestly, and refuses to act on figures nobody can source is positioned correctly for whichever way the protocols consolidate. That is the difference between reacting to hype and reading the evidence.