Who is liable if an agent buys something the user did not really mean to authorize?

Liability rules are still being defined by individual card networks and are not yet harmonized at the regulatory level: a signed mandate proves what was authorized, but how liability splits between user, merchant and agent provider remains an open question, to be assessed case by case with legal counsel.

What is agentic commerce?

A commercial transaction an AI agent executes for a user: discovery, authorization, payment and proof of mandate.

Agentic commerce is the commercial transaction an AI agent carries out autonomously on behalf of a human user, from product discovery through to payment, with verifiable proof that the user authorized the purchase. Unlike conversational commerce, where an assistant suggests and the user still presses buy, here the agent holds a mandate to search, compare, decide and pay without human approval at every single step. The central technical problem is proof of mandate: how to show a merchant that an agent is acting for a real human, within defined spending limits and scope, rather than on its own behalf or a malicious actor's. Protocols such as Google's AP2 address this with cryptographically signed mandates that record intent, cart and payment authorization as verifiable digital contracts, while card networks build their own trust layers on top of the same principle.

The protocol that made the topic concrete: AP2

On September 16, 2025, Google announced the Agent Payments Protocol (AP2), an open standard with more than 60 launch partners including Mastercard, American Express, PayPal and Coinbase, with Nexi among the Italian partners. At the heart of the protocol are Mandates: cryptographically signed digital contracts, structured as W3C Verifiable Credentials, recording the user's instruction (Intent Mandate), the actual cart (Cart Mandate) and the payment authorization (Payment Mandate). The latest public release, 0.2.0 from April 2026, treats stablecoins as a first-class payment rail alongside cards and bank transfers. AP2 does not define how one agent talks to another or how it authenticates as a non-human actor: that layer of non-human identity remains a separate prerequisite the payment mandate builds on.

The rest of the stack: Visa, Mastercard, Stripe

Other frameworks emerged alongside AP2 in the same window. Mastercard Agent Pay, announced April 29, 2025, extends the Digital Enablement Service with Agentic Tokens bound to a specific agent, merchant and consent policy. Visa introduced the Trusted Agent Protocol in October 2025, to help merchants tell a legitimate agent apart from a malicious bot at checkout. Stripe offers a processor-side agentic commerce suite that makes products discoverable to agents and handles checkout and fraud in a single integration, already adopted by brands such as Etsy and Ashley Furniture. None of these frameworks replaces the others: card networks sit at the payment-rail layer, Google at the open-protocol layer, processors at the merchant-integration layer.

A concrete enterprise example

A retail chain that wants to let an AI agent autonomously reorder recurring stock from several suppliers faces the same problem AP2 solves: the agent receives a mandate with a spending cap and an authorized supplier scope, runs the search and negotiation, but the final payment carries cryptographic proof that this specific order falls within the mandate the company granted. Without that verifiable proof, a supplier has no way to tell a legitimate order apart from a compromised agent spending beyond agreed limits.

Why it matters for decision makers

Agentic commerce is not about agent-run customer service, which is agentic CX's territory, nor about how agents communicate across organizational boundaries, which is the A2A Protocol's territory: it is only about the economic transaction and its proof. For anyone evaluating adoption, the operational question is not which protocol will win, but whether your own procurement systems and suppliers can already verify a signed mandate before it becomes a compliance requirement imposed by the payment networks. Liability rules for agent-executed transactions are still being defined by individual card networks and are not yet harmonized at the regulatory level: nothing here should be taken as legal advice. One layer down, on machine-to-machine payment itself, the protocol furthest along is x402, which revives an HTTP status code left dead for thirty-five years, though it is not the only one in play.