The Identity Gap: Why Agentic Commerce Will Fail Without Verifiable Intent
AI-generated image · Bay Street Wire
Retailers are racing toward a future of AI-driven shopping, but without a framework to distinguish legitimate agents from malicious bots, the 'black box' of automation threatens to break the checkout experience.
### The Promise of the Agentic Checkout
Imagine a consumer in the middle of a critical meeting who dispatches an AI agent to secure tickets for a favorite artist's performance. As first reported by BetaKit, this shift toward agentic commerce—where AI actively executes transactions rather than just recommending products—is expected to scale rapidly. According to Mastercard, it is projected that by 2030, over 10% of online shoppers will regularly use agents for shopping and payments.
### The 'Human-Led, Agent-Executed' Model
Amisha Parikh, vice-president of security solutions at Mastercard, Canada, describes the ideal framework as "human-led, but agent-executed." In this model, humans set the guardrails—such as a $500 budget for a Toronto show—while the agent is granted the autonomy to find tickets that fit those specific criteria.
### The Authorization Gap
(Opinion) The primary hurdle for retailers is distinguishing legitimate, authorized AI agents from malicious "black box" shopping bots. Currently, retailers rely on multifactor authentication and biometrics to verify humans, but these are insufficient for agents. BetaKit reports that "verifiable intent" must be established in real time so sellers can confirm an agent is legitimately acting for a consumer.
### New Frontiers of Fraud
The risks include "prompt injection," where actors redirect authorized agents, and fraudulent merchants who lure agents into scams. Parikh notes that as merchants deploy their own AI, the landscape will shift to software-to-software interactions, making the identity of the underlying person or business paramount.
### Testing the Framework in Canada
Canada is currently testing these hurdles. BetaKit reports that this fall, Mastercard, credit card issuer Rogers Bank, and AI company Flybits executed the first Canadian transaction via Agent Pay, Mastercard's agentic commerce service. Parikh noted the pilot successfully verified that the agent was legitimate, possessed permission to act, and aligned with the consumer's authorized intent.
To support this, Mastercard introduced the Agent Pay Trust Framework, which brings together insights on identity, intent, behavioral patterns, and fraud risk to help banks and merchants recognize legitimate agents.
### The Path Forward
Scaling this technology will require cooperation between payment networks, retailers, government, financial institutions, and academia. Parikh points to the Global Intelligence and Cyber Centre of Excellence in Vancouver as a hub for advancing this digital trust. As Parikh told BetaKit, "Trust is foundational to agentic commerce being able to truly scale."