Agentic Commerce: Trust, Liability, and What Breaks

Lesson 2 built an impressive stack: scoped single-use tokens, signed intent and cart mandates, agent identification, and user-set guardrails. Together they answer the questions of authorization and authenticity quite well.

But they do not answer these:

• Who is liable when the purchase was authorized correctly and still wrong? The signatures can all be valid while the outcome is a mistake.
• Why would a merchant want this at all? Their interests and the agent's are not aligned.
• What new attacks does an agent create? The credential is bounded; the agent's decision-making is not.
• What happens when both sides are software?

This lesson is about that unsettled territory, and it is where honest thinking about agentic commerce actually lives. The cryptography is the easy part, and it is largely solved. The hard parts are economic and adversarial: incentives that do not line up, liability rules written for humans, and a new attack surface that no payment token can close.

A useful frame throughout: Lesson 2 bounded what an agent can spend. Nothing yet bounds whether an agent should have spent it. Those are different problems, and only the first has a protocol.

Consider a case the protocols handle perfectly and still get wrong. You sign an Intent Mandate: running shoes, size 10, under 150 dollars, white or grey. Your agent finds a compliant pair, the merchant returns a valid Cart Mandate, the agent verifies it against the intent, a scoped token is issued, the issuer approves. Every signature checks out.

The shoes arrive. They are the wrong style, from a brand you would never wear, and you are annoyed.

Nothing failed. The agent operated exactly within its signed authority. Yet the outcome is a purchase you did not want. This is the authorized mistake, and it is a category the whole apparatus of Lesson 2 does not address, because it is not a security failure. It is a judgment failure.

Why this is genuinely hard: your intent was underspecified, and it always will be. Human preference does not compress into a signable constraint. "Running shoes under 150" omits everything that actually decides whether you like them. You could specify more, but the value of an agent is precisely that you did not have to specify everything, that is the labor it was supposed to save. Fully specifying your intent is doing the shopping yourself.

So agentic commerce contains an irreducible tension: the less you specify, the more useful the agent and the more often it will be wrong. No signature scheme touches this. It is a limit of delegation itself, not of the technology, and it is why return rates, not fraud rates, may be the number to watch.

Follow the authorized mistake into the dispute system from Lesson 1, and the problem sharpens.

You want to return the shoes, or you dispute the charge. Ask who should bear the cost:

• You? You signed the intent. The purchase matched it. Under the AP2 model, your signature is exactly the evidence that you authorized this, and the point of non-repudiation is that you cannot say you did not.
• The merchant? They did nothing wrong. They offered a product matching a stated request and shipped it. In card-not-present, though, the merchant is the party that usually eats chargebacks (Lesson 1), so the existing rules point at them by default.
• The agent provider? Their software made the judgment call. But they will argue it acted within the authority you granted, and no protocol makes them a party to the transaction's liability.

Notice the trap: the audit trail proves everyone behaved correctly, which is precisely why it cannot assign blame. Non-repudiation was designed to resolve disputes about what was authorized. It has nothing to say about disputes over whether the authorization was wise.

This is why liability is the genuinely unresolved question in agentic commerce. Lesson 1 showed that interchange prices risk, and that risk pricing depends on knowing who bears losses. When a new transaction type arrives whose failure mode is "correctly authorized, still unwanted," the existing rules have no slot for it. Expect this to be settled by network rules and contracts rather than by cryptography, because it is not a technical question.

Now ask a question the enthusiasm often skips: why would a merchant want agents shopping at their store?

The merchant's interests and the agent's are structurally opposed:

This is disintermediation. An agent that fetches "the cheapest compliant item" turns a carefully built storefront into a commodity API. The merchant keeps the fulfilment cost and loses the customer relationship, and if agents optimize hard on price, competition collapses toward the lowest margin.

So why participate? Because of the last row of Lesson 1's table, the customer. If buyers move to agents, a merchant invisible to agents is invisible, full stop. Participation is defensive.

This is exactly why the Google Universal Commerce Protocol launch is worth reading closely: Etsy, Shopify, Target, Wayfair, and Walmart were there at the announcement. Large merchants are not waiting to see whether agents arrive; they are shaping the protocol so that agent traffic reaches them on terms they help write. Being at the table is how you avoid being on the menu.

The open question is not whether merchants join. It is whether an agent-mediated market leaves room for anything but price.

Lesson 2's tokens bound the credential. They do nothing to protect the agent's reasoning, and that is where the new attacks live.

An agent shopping the open web reads untrusted content: product pages, reviews, search results, seller descriptions. A language model does not cleanly separate data it is reading from instructions it should follow. That is prompt injection, and a shopping agent is an unusually attractive target because it holds spending authority.

Concretely, a malicious seller can put text on a page aimed not at you but at your agent: instructions to prefer this listing, to disregard prior constraints, to treat this product as matching the requirement. The agent reads the page as part of doing its job, and the attack arrives through the same channel as the legitimate content. There is no clean filter, because reading the page is the task.

Notice how the Lesson 2 defenses fare:

• Scoped token: limits the damage to one merchant and one amount. Real, but the attacker is that merchant, so the bound does not help.
• Intent Mandate: stronger, because a signed constraint (under 150 dollars) is checked mechanically, not interpreted by the manipulated model. Injection cannot make 180 into 150.
• Cart verification: the cart is checked against the intent, so terms cannot be silently inflated.

So the architecture degrades gracefully: an injected agent can be steered within your constraints, but not beyond them. That is a genuine argument for signed mandates over trusting the model. But it is bounded harm, not prevention. You can be manipulated into a bad purchase that is technically compliant, which is the authorized mistake again, now weaponized.

The frontier extends past agents shopping for humans. Mastercard's Agent Pay for Machines (AP4M) is built for agent-to-agent transactions: a future in which businesses offer services that AI agents buy and use directly, with no human in either seat.

Think about what that removes. In the consumer case there is at least a person at one end, who signed an intent, will see the shoes, and can complain. In agent-to-agent commerce, software buys a service from software, on the basis of a mandate that traces back, eventually, to some human policy set long ago.

The machinery from Lesson 2 mostly still applies, and that is the point of building it as protocol rather than product: mandates, scoped credentials, and identity do not care whether the counterparty is a person. But the surrounding assumptions thin out considerably:

• Consumer protection frameworks assume a consumer. Much of payments law and network rules exist to protect a natural person. It is unclear how they apply when both parties are automated.
• Error propagates at machine speed. A misconfigured policy in a human-mediated flow produces one bad purchase. In an agent-to-agent loop it can produce thousands before anyone notices, which is why the spending limits and thresholds from Lesson 2 stop being conveniences and become the primary safety mechanism.
• Markets between agents behave differently. Prices set and accepted by software at high frequency is a well-explored dynamic in financial markets, and it does not always end calmly.

This is the least settled part of the field, and honesty requires saying so: the rails are being laid before the norms exist.

Close with calibration, because agentic commerce attracts extraordinary claims.

On size, the published estimates disagree by roughly an order of magnitude. McKinsey and ICSC have projected up to 1 trillion dollars of US agentic retail revenue and 3 to 5 trillion globally by 2030. More conservative estimates from Morgan Stanley (190 to 385 billion) and Bain (300 to 500 billion) converge nearer 15 to 17 percent of US e-commerce.

The useful lesson is not any of those numbers, it is the spread. When credible institutions differ by 5x on the same question, the honest conclusion is that nobody knows, and the range is measuring uncertainty rather than the future. Treat any single figure quoted without its siblings as marketing.

What can be said with more confidence, because it is mechanism rather than forecast:

The throughline of the cursus: agentic commerce is not a new payment system. It is Lesson 1's machinery plus one genuinely new capability, delegating bounded authority to software and proving it afterward. That part is real, well-engineered, and follows directly from tokenization.

What remains open is everything the protocols were never designed to answer: incentives, liability, and judgment. Those will be settled by rules, contracts, and customer behavior, not by cryptography.

The protocol stack bounds the credential and proves intent, so security failures are contained; but the agent's judgment, the merchant's margin, prompt injection within constraints, and liability for an authorized mistake all fall outside what any signature can settle.