Agentic Commerce: How AI Agents Will Buy from Your Store

In the space of two weeks this autumn, AI agents started paying real B2B invoices and checking out on Shopify stores, while Amazon kept locking them out. Agents are now buying for people, and the web is splitting into places that welcome them and places that don’t. Here is what has changed, which protocols matter, and what a growing brand should fix first.

What Is Agentic Commerce?

Agentic commerce means an AI agent, not a person, finds the product, compares the offer, and completes the purchase or payment, inside limits the person or company has set. The agent might be a consumer assistant such as Meta’s Muse, OpenAI’s Dots or Anthropic’s Claude Duet, which all launched autumn 2026 with their own cloud computers and browsers. It might also be a finance agent paying supplier invoices for a company.

The change is not that AI can recommend products. Search engines and chatbots have done that for years. The change is that agents now act: they hold a scoped payment credential, log into a portal or checkout, and finish the job. Claude Duet, for example, shows its planned actions and waits for approval before paying, signing or sending anything (The New Stack).

That raises three questions every merchant and supplier now has to answer: who is this agent, what is it allowed to do, and how does it pay?

The Web Is Not Open for Your Agent

In his video “The Future of the Internet Isn’t Open for Your Agent”, Nate argues that the open web agents were promised is not what they are getting. Instead, access is being negotiated site by site and platform by platform. He describes three zones an agent moves through. We find the framework useful for any brand deciding how to show up.

The no-go zone is not hypothetical. In September 2026, Amazon blocked Muse from shopping on Amazon.com, saying Meta never asked permission, and that Muse did not identify itself as an agent (TechRepublic, Forbes). Earlier, a federal judge sided with Amazon against Perplexity’s shopping agent and barred it from password-protected parts of the site. Amazon is betting on its own agent instead: it says more than 400 million customers used Alexa for Shopping in the past year (The Next Web).

Challengers Open Up, Incumbents Close Down

The strategic divide is easy to read. Platforms that own the customer relationship, such as Amazon, block third-party agents so they keep credentials, data and ad revenue. Challenger networks, such as Shopify and Walmart, open up to agents because every agent is a new storefront for their merchants.

Shopify’s Fall ’26 Edition on October 28 made this explicit. Its developer layer, Shop.dev, connects agents and apps to catalogue data, Shop sign-in, carts, checkout and Shop Pay, and Shop Pay checkout now works inside third-party agents (Anatta). This built on September’s move to open checkout to browser agents through WebMCP (TechCrunch, The Paypers). It also follows Shopify embedding the agentic payment technology of Visa, Mastercard and American Express into Shop Pay (PYMNTS).

For a Shopify brand, that means agents can reach your products, policies and checkout in a structured way, without scraping the page.

Emerging Protocols for Identity, Authorisation and Payments

Under the headlines, a set of protocols is forming that answers the three questions above. None of them is the standard yet, but together they show how trusted agent commerce will work.

B2B Clearing: Agents Paying Invoices

On October 20, 2026, Visa, BILL and Billtrust launched what they call the first live pilot of trusted AI agent payments between buyer and supplier platforms (Visa). It targets the last manual step in accounts payable: after an invoice is approved, someone in finance still logs into the supplier’s portal and types in payment details.

In the pilot, BILL’s Payment Agent is registered through Visa’s Trusted Agent Protocol and Agentic Directory, and it pays with tokenised credentials that follow the buyer’s approved instructions. On the supplier side, Billtrust uses the same protocol to recognise and authenticate the agent before letting it into the portal. Each payment is tied to a specific invoice, and both sides can track authorisation and completion (PYMNTS, Fintech Magazine).

This is the partnership zone at work. The agent operates inside the vendor’s portal, but only because both sides agreed in advance who it is and what constraints it runs under. The catch is scale: it only works between companies on the same network, and broader adoption depends on more portals and processors accepting the framework.

That gap, between two companies that have never connected before, is where a neutral trust layer is needed. Certlio, an EU agentic security company based in Tallinn, is building a secure partnership layer for agents. The idea is that businesses can verify an agent and agree its permissions before it touches their systems, without being on the same payments network.

Identity Verification: Signed Agents

Websites cannot set rules for agents if they cannot tell them apart from bots and scrapers. Cloudflare’s signed agents programme, built on its Web Bot Auth scheme, has agents attach a cryptographic signature to every HTTP request, using the HTTP Message Signatures standard (RFC 9421). The operator publishes a public key at a well-known address, so the site can verify which agent is calling (Cloudflare docs).

Once a site knows who the agent is, it can grant different permissions: let a known agent view prices and stock, but only let a partner agent place orders. Browser-automation providers such as Browserbase already sign their sessions this way (Browserbase).

Restricted Tokens: Spending With Limits

The scariest part of agent commerce is handing an agent your card. Restricted tokens solve this by giving the agent a credential that only works under set conditions.

• Google’s Agent Payments Protocol (AP2) uses signed “mandates” that record what the agent may buy: spend caps, allowed merchants and an expiry time. Google has since handed AP2 to the FIDO Alliance for neutral governance (RisingWave, The Batch).
• Stripe’s Shared Payment Tokens, part of the Agentic Commerce Protocol it built with OpenAI, let an agent pass a payment to a seller without exposing the card. Each token is scoped to one seller and limited by amount and time (Stripe docs).
• Visa’s Trusted Agent Protocol, used in the BILL pilot above, and the card networks’ own agent tokens do the same job on the network side.

The Standardisation Gap

There is no single protocol for agent identity, authorisation and payment. Visa, Mastercard, Google, Stripe and OpenAI, Shopify and Cloudflare each have a piece, and they overlap. Cloudflare frames the goal as an internet that stays “readable, discoverable, callable and payable” for agents (Cloudflare). Today, merchants face a patchwork. The practical answer for most brands is to use a platform that integrates these protocols for them, rather than pick a winner.

Your Product Data Is Now Your Shop Window

An agent does not see your hero banner or your lifestyle photos. It reads specifications, prices, stock, delivery promises and return terms, then compares them with every other store in seconds. Plain, precise terms win and vague marketing copy loses.

This is where logistics stops being back office. Many of the things an agent ranks you on come from your fulfilment operation:

• Delivery windows: “Delivered in 1–2 business days to Germany” beats “fast shipping”. It has to be true per country, or agent orders turn into complaints.
• Stock accuracy: an agent that buys an item you don’t have will learn to avoid your store. Live, accurate stock levels from your warehouse matter more than ever.
• Return policy: a clear, machine-readable policy (days, cost, method, country) is a ranking factor, not small print. Shopify now surfaces return policies and delivery windows to agents.
• Cut-off times and carriers: agents compare “order by 15:00 for same-day dispatch” across stores. If your warehouse can’t keep the promise, don’t publish it.
• Clean product data: weights, dimensions, materials and variants, kept the same in your store, your marketplaces and your warehouse system.

Where Mid-Sized Businesses Should Start

Most of the protocol work happens at the platform level, so a growing brand doesn’t need its own agent strategy team. It does need to be ready when agent orders arrive. In order of effort:

1. Make your policies machine-readable. Write delivery times, costs, returns and cut-offs as clear facts, per country, and add them to your structured data and your platform’s policy fields.
2. Turn on the agent channels you already have. If you are on Shopify, check your Shop Pay and agent channel settings. If you sell B2B, ask your AP and AR platforms about agent payments.
3. Connect stock to reality. Make sure your store reads live stock from your warehouse, not a nightly export.
4. Decide your zone. Which agents do you welcome, which may only view, and which do you block? Tools like signed-agent rules let you set this deliberately instead of by accident.
5. Automate one internal workflow. The same agent technology that buys from you can run your own repetitive work: order exceptions, supplier emails, invoice matching. Pilotic builds exactly this for mid-sized companies: a fixed-price 30-day sprint that puts one working AI workflow live on your own data, with a trained owner in your team.

Frequently Asked Questions