The agentic commerce playbook: verified agents, bound humans

The threat model: four ways agentic commerce fails

Design against the losses, not the demos. Four failure classes cover the field. First, the synthetic principal: a fabricated or stolen identity passes weak enrollment, and every mandate it issues afterward is formally valid, signed, verifiable, and fraudulent, the agent-era upgrade of synthetic identity fraud, with the new twist that the paperwork is better than ever. Second, the leaked or replayed mandate: a standing intent authority is captured, from a compromised device, an over-logging integration, a malicious agent plugin, and milked just inside its bounds, where every individual transaction looks legitimate and only the aggregate tells. Third, scope creep and interpretation abuse: the fit between a mandate's language and a transaction's reality is probed with boundary amounts, category ambiguity, split purchases, and merchant lookalikes, failures that live in your decisioning rather than in any signature. Fourth, chain laundering: authority propagates through sub-agents until an unattributed hop breaks the lineage, leaving a transaction no one can map to a human, which is both a fraud vector and, for regulated parties, an examination finding on its own. Bot flooding and scalping ride alongside as the volumetric cousin: unverified agents at scale, where the control is admission, not detection after the fact.

Reference architecture: the agent trust engine

One architecture serves merchant, platform, and enterprise variants, with emphasis shifting by segment.

The left spine is identity: humans proofed to enrollment grade, authority issued only against that proofing. The right spine is the agent: its own credential, never a borrowed human session. The middle is the engine: every presented artifact treated as evidence, scored with transaction-time risk, and resolved into approve, step-up, or decline, with the step-up landing on a ceremony the attacker cannot complete and everything writing into an evidence store built for replay. The two design sentences worth memorizing: no protocol is trusted as a verdict, and no action outranks its mandate.

Pull quote

“No protocol is trusted as a verdict, and no action outranks its mandate.”

Phase 0: the agent exposure census (weeks 1-2)

Before controls, inventory. Catalog every point where agents already touch your business: checkout and API traffic that is plausibly agent-driven, measured with honest heuristics rather than wishful bot filters; employee-side delegation, which tools your own staff have connected to which systems, the shadow fleet included; existing credentials that effectively act as standing mandates, stored cards, API keys, OAuth grants with no expiry; and the protocol surface, which of your platforms, processors, and partners already speak an agent protocol or run a registry. Pair the census with a decision inventory: list every action an agent could request, purchase, refund, payee change, data export, account change, and tag each with its worst plausible loss. The census ends with the program's charter sentence, signed by payments, fraud, and compliance together: which agent-initiated actions we will accept, which we will step up, and which no mandate can authorize. Expect the census to surprise: most organizations discover they have been in agentic commerce for months, unpriced.

Phase 1: the principal root (weeks 3-5)

Everything inherits from enrollment, so fix the root first. Define verification grades, what evidence, what liveness, what screening, and map each grade to the mandate ceiling it may hold: a lightly verified account may hold a narrow, low-value intent mandate; payee changes and high-value standing authority require enrollment-grade proofing with structural liveness and document forensics; business principals add entity verification and authorized-representative checks. Wire reuse analytics across the book, the same document, device, or biometric template appearing behind multiple principals is the synthetic-principal tell, and set verification aging policy: authority issuance is a moment of consequence, so stale proofing steps up before new mandates mint. Two traps to close in this phase, because attackers find them first: recovery flows that re-issue mandate-minting capability on weaker evidence than original enrollment, and credential-setup ceremonies that let a social engineer register their own authenticator against a victim's verified identity. The deliverable is a one-page grade ladder your auditors can recite: this evidence, this grade, this ceiling.

Phase 2: mandate design and issuance (weeks 6-9)

Now authority becomes an artifact. Adopt the two-layer pattern the protocols converged on, standing intent mandates plus single-use execution signatures, and write your scope schema before your integration: actions enumerated, amounts and velocity bounded, categories and counterparties named, expiry mandatory, human-presence thresholds declared inside the grant itself, the full discipline from the delegation guide. Decide sub-delegation policy now, prohibited by default, permitted only with full verifiable lineage, because retrofitting chain transparency is miserable. Build issuance as a ceremony: the principal authenticates with liveness appropriate to the grant's ceiling, sees the scope in plain language, and signs; the mandate records the ceremony's evidence. Keep lifetimes short and re-issuance cheap, short-lived authority makes revocation mostly moot, and stand up the status infrastructure for what remains: a status endpoint checked on high-value presentations, revocation lists for the tail. On the receiving side, normalize: whatever arrives, AP2 mandates, x401 evidence objects, verifiable credentials, network registry attestations, parse it into one internal representation with protocol-specific validators, so your decisioning logic is written once. Arc implements this layer as scoped, signed, revocable mandates bound to verified humans; whatever implements yours, hold it to the schema.

Phase 3: transaction decisioning (weeks 10-13)

The engine phase. Build the scope-fit evaluator first, the component that compares a requested transaction against the governing mandate and returns fit, miss, or ambiguous with the specific bound at issue, and make ambiguity a first-class outcome that routes to step-up rather than silently rounding toward approval, because interpretation abuse lives exactly there. Fuse three scores per transaction: artifact validity, signatures, chains, status, expiry; principal weight, the enrollment grade and recency behind the mandate, so a perfect signature from a weak root is priced as the risk it is; and transaction-time context, device, velocity, counterparty history, session signals, the fusion a decision plane exists to perform. Set the aggregate watch: per-mandate cumulative value and velocity tracked against the grant's lifetime bounds, which is the control that catches in-scope milking of a leaked mandate, the quiet failure individual-transaction review never sees. Calibrate thresholds by decision inventory from Phase 0: the worst plausible loss of an action class, not its average, sets its step-up line. And instrument legitimate-agent experience as a product metric from day one: time-to-approve, step-up rate, false-decline rate for verified agents, because the program's business case is opening the door, not decorating the wall.

Phase 4: ceremonies and dispute machinery (weeks 14-16)

The step-up path is where the program earns its keep, so build it as carefully as checkout. The ceremony binds a live human to a specific action: the principal authenticates with liveness through a verified channel, sees the action in plain language, this amount, this counterparty, this change, and approves, with the approval evidence joining the transaction record, the pattern human approval protocols formalize and presence research keeps validating. Design for the attacker in the room: the ceremony must not be completable by the agent that requested it, by a deepfaked call, or by a push-fatigue tap, which argues for in-app, identity-bound approval over anything a conversation can intercept. Then build the dispute spine before volume arrives: a disputed agent transaction resolves by replay, principal, enrollment evidence, mandate, ceremony, scores, outcome, assembled in minutes, and the same packet serves card network representment, regulator questions, and the customer conversation. Close the phase with a full-chain fire drill: one simulated dispute walked end to end, timed, with the gaps it exposes becoming the first backlog.

Phase 5: the refresh engine (ongoing)

Agentic commerce is a moving target, so the program ships with its own maintenance loop. Track the protocol surface quarterly: new mandate formats, registry rule changes from the card networks, status-infrastructure shifts, and the regulatory docket below, with each change landing as a validator update rather than an architecture debate because Phase 2 normalized intake. Re-run the exposure census on a cadence, agent traffic share, shadow delegation, new action classes, and feed drift findings from monitoring back into scope schema and thresholds. Run adversarial drills quarterly, the four threat-model campaigns, leaked intent, synthetic principal, scope creep, chain laundering, executed against staging by a red function, Arbiter's role in deepidv deployments, with findings ranked by loss-per-week if unfixed. And keep a sunset discipline: mandates, validators, and exceptions all carry owners and review dates, because the agent era's compounding risk is not the dramatic breach, it is the quiet accumulation of authority nobody re-reads.

Reading disagreement between the layers

The engine's three scores will disagree, and the disagreements are the diagnostic surface. A valid artifact over a weak principal is the synthetic-root signature: trust the enrollment read, not the cryptography, and route to verification before value moves. A strong principal with a scope miss is usually product friction, a mandate written narrower than the customer's real intent, so step up gracefully and offer a re-issuance path, because this pattern is your consent screens asking for revision, not your fraud models. A strong principal, clean scope, and screaming context, new device, impossible velocity, counterparty churn, is the compromised-session profile: the human is real, the authority is real, and the hands on the agent are not, which is exactly what the ceremony exists to settle. And unanimous passes with aggregate drift is the leaked-mandate signature from the threat model, visible only at the mandate ledger's altitude. Write these four readings into the runbook with their routings, and review the mixed cases weekly: a program that only studies its declines learns half the distribution.

The regulatory and liability map

The agent era's obligations are assembling from existing law faster than from new statutes, and the liability questions are being decided now, in network rules and first disputes.

Two liability notes belong in every program charter. First, the authorized-transaction boundary is the agent era's contested line: when a verified principal's leaked mandate is milked in-bounds, networks and courts will ask who was positioned to detect the aggregate, which is why the per-mandate watch in Phase 3 is a liability control, not just fraud hygiene. Second, evidence asymmetry decides disputes: the party that can replay the chain, enrollment, mandate, ceremony, scores, tends to win the allocation argument, and the party that cannot becomes the insurer of everyone else's design.

The consortium question: join or watch

Registries and consortia are forming around agent identity, card network agent programs, voice-agent registries, protocol governance groups, and each asks for participation before the rules settle. The join calculus is concrete. Join when your traffic already rides the rail, membership gives you dispute standing and early rule visibility, and the registry's admission bar is real, since a registry that admits anything certifies nothing. Watch when the consortium is a format war in progress and your normalized intake can add the winner later for the cost of a validator. Either way, never outsource the root: a registry attests that an agent is known, not that its principal was verified to your grade or that this transaction fits its mandate, so consortium standing complements the engine rather than replacing any layer of it. Assign the watching formally, one owner, a quarterly brief, because the expensive failure is not picking the wrong consortium, it is discovering a rule change at dispute time.

Measurement: the program scoreboard

Run the program on a one-page scoreboard reviewed monthly, split into opening-the-door and holding-the-line. Door metrics: share of agent-initiated transactions admitted with verified mandates, median time-to-approve for compliant agents, step-up rate and completion rate for legitimate principals, false-decline rate on verified agent traffic, and agent-channel revenue accepted. Line metrics: value attempted and blocked per threat-model class, time-to-detection for aggregate mandate abuse, percentage of agent transactions fully attributable to a verified human within one query, ceremony-defeat attempts observed, and dispute outcomes with evidence-packet assembly time. Tie the two halves together with the one ratio boards remember: loss per thousand agent transactions against loss per thousand human transactions, tracked quarterly, because the program's promise is that the agent channel becomes measurably safer than the channel it replaces, not just tolerably worse.

Failure modes: how agent programs actually fail

The post-mortems repeat. The valid-signature trance: teams treat protocol compliance as a verdict and stop scoring, honoring perfect paperwork from synthetic roots. The enrollment bypass: the front door hardens while recovery, support, and credential-reset flows keep minting authority on weak evidence, and attackers enter through the help desk. The scope rounding habit: ambiguity resolves toward approval under conversion pressure until the drill, or the loss, demonstrates where that rounds to. The aggregate blind spot: every transaction reviewed, no mandate watched, and a leaked grant bleeds for a quarter inside its bounds. The ceremony that isn't: step-ups implemented as push notifications a tired principal taps through, defeating the one control built to be undefeatable. The orphan chain: sub-delegation allowed informally because one integration needed it, with the unattributed hop discovered during the first serious dispute. And the stalled census: the program protects the surfaces inventoried in week one while the agent fleet doubles, which is why Phase 5's cadence is the difference between a program and a snapshot.

Segment notes

Marketplaces and merchants: the business case is admission, demand arriving through assistant platforms, so lead with door metrics, integrate the dominant checkout protocols first, and hold the line at account changes and payout flows, where marketplace trust programs already concentrate. Banks and fintechs: the examiner is the second customer; principal verification grades map onto existing CIP machinery, FinCEN's credential posture makes evidence quality the differentiator, and agent-initiated payment flows inherit SCA and dynamic-linking duties intact. iGaming and other licensed operators: agents meet mandatory KYC and responsible-gambling walls, so the posture is narrower, verified-principal agents only, no delegation past the account holder, and affordability and self-exclusion checks bind the human regardless of who clicks. Enterprises: the fleet is internal, procurement and operations agents holding real authority, so emphasize the census, scope reviews on the access-review cadence, and ceremonies on payee and vendor changes, the lesson of executive impersonation losses applied to software colleagues.

The human layer: consent people actually understand

The program's legitimacy rests on principals understanding what they signed. Mandate consent screens are product surfaces: plain-language scope, the usual groceries, up to 150 dollars a week, from these stores, with the bounds visible and editable, not terms-of-service prose. Step-up ceremonies explain why they interrupted: this purchase exceeds the authority you gave your agent. Support teams need a new literacy, reading a mandate, explaining a step-up, initiating revocation, and the revocation path must be one obvious action, kill my agent's authority now, that works at 2 a.m. For employees, delegation is a managed privilege: training covers what may be delegated at which grade, and offboarding revokes agent authority with the badge. The cultural sentence leaders should repeat: the agent is new, the accountability is not, every action still belongs to a person.

The economics: pricing the program

Cost the program against the two numbers it moves. Build and run: verification per enrollment at issuance grades, mandate infrastructure and validators, decisioning compute, ceremony flows, red-team drills, and roughly one engineer-quarter per protocol integration at current maturity, with the normalized intake from Phase 2 amortizing each addition. Returns: the agent channel's accepted revenue, currently being refused by default-blocking competitors; fraud and dispute losses avoided, priced from the threat-model drills rather than industry averages; dispute operations compressed from days of log archaeology to minutes of replay; and the examination readiness that converts a regulator's agent questions from a project into an export. The honest framing for the board: the spend is mostly re-aimed, not new, enrollment verification, risk decisioning, and evidence retention already exist for the human channel, and the program extends them to the channel where the next decade of volume is arriving.

Choosing the partners: the buyer's evaluation grid

Four questions sort the vendor field, and a partner should answer all four in writing. Where does your authority come from: who verified the human principal, against what evidence, with what liveness, and may we audit the enrollment behind a sample of credentials, the question that exposes rails with weak roots. What exactly do you sign: the artifact's contents, scope schema, expiry discipline, status infrastructure, and sub-delegation handling, with a sample object on the table. What happens at transaction time: is presentation validated, weighted, and scored against context, or honored as a verdict, and may we see the decision record a transaction produces. And what survives a dispute: assembly time for a full replay packet, export formats, retention schedule, and who owns the evidence if the contract ends. Run the grid against each layer you are buying, protocol or wallet, rails, decisioning, verification, and resist the vendor who answers a question from another layer's lane; the stack that fails is assembled from confident adjacent answers. Reference checks close the grid: ask an existing customer which threat-model campaign the vendor's layer caught last quarter, and listen for whether drills happen at all.

Day-two operations: running the program

Steady state is a weekly rhythm and three queues. The mandate queue: issuance volumes, grade mix, aging authorities approaching review, and the drift register from Luna-style monitoring, scope breadth against observed use, stale grants, ceremony conformance. The transaction queue: step-up outcomes triaged, ambiguous scope-fit rulings reviewed and folded back into the schema as precedents, and the aggregate watch's flags, mandates trending toward their lifetime bounds, investigated while the value is still small. The dispute queue: every agent dispute replayed, packet assembly timed, and one finding per week pushed upstream, a validator gap, a consent-screen ambiguity, a threshold a basis point too generous. Monthly, the scoreboard reviews with payments, fraud, and compliance in one room; quarterly, the Arbiter drills and the protocol-surface refresh. The operating sentence: the program is a loop, census to controls to evidence to findings to controls, and any week it stops looping it starts aging.

After go-live: the first quarter

Quarter one has three jobs: calibrate, surface, and institutionalize. Calibrate by reading the door and line metrics together, a step-up rate above design with no corresponding catch rate means thresholds are taxing legitimate principals; a quiet line with rising agent share means the heuristics are missing traffic, and adjust with changes logged as versioned policy, because the examiner will ask why a threshold moved. Surface the shadow fleet: publish the agent policy internally, offer amnesty onboarding for unregistered delegations, and watch the census numbers converge toward observed traffic. Institutionalize the evidence habit: sample ten agent transactions weekly and replay them cold, timing the packet, until replay is boring, which is the technical definition of ready. End the quarter with the first full Arbiter campaign against production-shadow configuration and a one-page delta report to the charter: what we admitted, what we caught, what we changed, which becomes the template every quarter inherits.

The board narrative

Boards need the program in four sentences. Customers and employees are delegating real purchasing power to software, and that traffic is arriving at our doors whether we govern it or not. We have chosen to admit it on terms: every agent action traces to a verified human, through authority we issued with bounds, scored at transaction time, with consequential actions confirmed by a live person. The alternative postures, blocking the channel or trusting the paperwork, respectively forfeit the demand and underwrite the fraud. The program's health is two numbers we review monthly, agent-channel revenue admitted and loss rate versus the human channel, and its evidence can be replayed for any regulator, network, or court on request. That framing survives contact with directors because it names the business choice, prices both errors, and makes the control posture auditable rather than aspirational.

The hardest week

Every agent program gets its stress week; this one arrives when a major assistant platform announces your category ships native checkout next month, marketing wants the integration live for the launch window, and the protocol involved is one your intake has never parsed. The pressure will be to wave the new mandate format through on signature validity alone, conversion now, scoring later. The program's answer is the Phase 2 discipline: a new validator is a bounded engineering task against the normalized intake, not a re-architecture, and the launch rides with principal weighting and scope-fit live even if context models need tuning, because the valid-signature trance is exactly how the week becomes a quarter of losses. Run the drill before the launch, the leaked-intent campaign against the new rail, publish the two findings and their fixes, and ship with the aggregate watch set conservatively. The teams that survive the hardest week are the ones whose charter already said what no launch can waive: no protocol is a verdict, no action outranks its mandate.

The ninety-day variant

Compressed for teams that need a defensible posture this quarter rather than the full build. Days 1-15: the census and the charter, exposure mapped, decision inventory tagged by worst loss, the three-lead signature on what agents may do, must step up, and never do. Days 16-40: the root and the artifact, verification grades mapped to mandate ceilings, recovery and credential-setup holes closed, scope schema written, issuance ceremony live for one pilot action class, sub-delegation prohibited. Days 41-70: the engine's core, intake normalized for the one or two protocols that matter to your traffic, scope-fit evaluator with ambiguity routing to step-up, principal weighting live, aggregate per-mandate watch running, identity-bound ceremony on the step-up path. Days 71-90: evidence and adversaries, replay packet assembled for sampled transactions, one leaked-intent and one synthetic-principal drill executed, findings fixed or scheduled, scoreboard published. What the variant defers, breadth of protocol coverage, chain-lineage machinery, full dispute automation, it defers explicitly in the charter with dates, which is the difference between a phased program and a partial one.