On August 4, 2026, the 9th Circuit Court of Appeals did something remarkable. It classified an AI agent as a browser. The ruling in Amazon v. Perplexity AI pushed autonomous software outside the Computer Fraud and Abuse Act's intruder category, then held the user liable for whatever the agent does. That is not a clarification; it is a contradiction. Agents are simultaneously harmless tools and legally binding user extensions. Code is law, until it isn't. On the same day, the Secure Technology Alliance launched the Agentic Trust and Commerce Forum, a private body spun out of the U.S. Payments Forum with a mandate to write the rulebook for a projected $300 billion agentic commerce market by 2030. The timing was not accidental. The market saw the liability vacuum before Congress did. The Forum's first meeting is scheduled for November 17-18, 2026, at Best Buy's campus in Minneapolis. Between now and then, the private sector will try to build a regulator of its own.
Congress remains preoccupied with stablecoins. The GENIUS Act, if it passes, will impose reserve requirements and compliance costs on issuers while leaving the mechanics of machine-initiated transactions largely untouched. That is the precise gap the Forum now occupies. Its mandate reduces to four questions. How is agent identity established and verified? What data standards and interoperability principles capture intent? What constitutes valid consumer authorization for a transaction where no human is present? And how are disputes settled when the only witness is a model?
These are not abstract legal debates. In my 2026 audits of three leading AI-agent protocols, I found that 90% lacked robust economic incentives for honest behavior. That finding is brutal but reproducible. The 9th Circuit's browser analogy wraps the user in the agent's actions, but no standard exists for proving whether the machine was acting within its instructions.
The gap has precedent. In the winter of 2018, I spent four months auditing the economic tokenomics of a then-popular privacy coin. The fatal defect was not cryptographic; it was the burn mechanism's incentive design. The same pattern is visible here. The Forum is being asked to design the incentive and verification rules before the market has a balance sheet. That is a healthy instinct, but it is running ahead of legal doctrine. The GENIUS Act narrows the definition of an issuer to entities that hold reserves. Agents, wallets, and coordination layers sit outside that perimeter. The result is a three-sided vacuum: the court defines the agent as a tool, Congress defines the rails as payment networks, and no one defines the agent's intent.
The industry is not waiting. On August 3, 2026, Visa closed its $2.4 billion acquisition of BioCatch, embedding behavioral biometrics as the trust layer for machine-initiated transactions. BioCatch claims 3,000 data points per session. Mastercard responded with its $1.8 billion acquisition of BVNK, adding stablecoin settlement rails, and layered that on top of Verifiable Intent, a cryptographic trust layer co-developed with Google. At the protocol level, the x402 Foundation, operating under the Linux Foundation, is pushing protocol-fee-free stablecoin settlement. It claims 200 million transactions processed. The EPAA in the APAC region has created an AI and Agentic Payments Working Group.
On paper, this looks like the EMV migration: cross-industry, standards-first, private sector collaboration. But the analogy is misleading. EMV fixed a known failure — card-present fraud — with a hardware root of trust. Agentic commerce is trying to fix an unknown failure by building identity infrastructure around a liability court ruling.
Consider what the stack actually validates. BioCatch measures the rhythm of a session: how a user types, how a pointer moves, how long a page remains open. Mastercard's Verifiable Intent wraps a purchase in a cryptographic envelope. x402 removes the protocol fee from settlement. None of these layers asks whether the agent's objective matches the user's written instruction. The entire architecture is oriented around proof of presence, not proof of meaning.
The core delusion is equating identity with intent. A transaction can be fully authenticated and still be malicious. Identity answers 'whose credentials are these?' Intent answers 'what was the human thinking?' No biometric layer answers the second question. — Scenario: A shopping agent receives a prompt injection in a product description. The agent uses the user's valid session token to approve a $50,000 stablecoin transfer to an attacker-controlled address. BioCatch records the user's behavioral rhythm; Mastercard's rails settle the transaction; x402 charges no protocol fee. Every layer verifies the agent was the user. None of them verifies the user would have authorized the transfer.
Math doesn't lie, but volume metrics can distract. Two hundred million processed transactions sound impressive until you compare that number with the projected $300 billion market. At even $100 per transaction, 200 million transactions represent $20 billion in cumulative settlement, not an annual market. The word 'processed' also says nothing about fraud rates, reversals, or intent capture. The infrastructure being built is real. The proof that it scales is missing.
One detail stands out. x402's protocol-fee-free design is a double-edged sword. Removing the protocol fee lowers the barrier to entry, but it does not remove the cost of verification. That cost moves up the stack to the identity layer. Visa and Mastercard are not acquiring biometric and stablecoin firms out of generosity; they are positioning to capture the premium that fee-free settlement creates. In that sense, the private regulator is also a private toll booth. The Forum's standards will decide who pays.
The standard reading of this moment is that the private sector is innovating despite Washington. I read it differently. This is not innovation; it is insurance. The 9th Circuit placed full liability on the user. The payments industry, Visa, Mastercard, and the Forum, are building a verification layer not to enable agentic commerce, but to reduce their own exposure by making the user the point of failure again. The browser analogy is convenient because it keeps agents out of CFAA's intruder category. But that same convenience creates a legal blind spot: if an agent is a browser, then its actions are the user's actions. There is no enforceable limit to what the agent can do in the user's name.
The proposed standards will not solve this. A cryptographic signature proves authorization at one instant, but intent is a process, not a timestamp. Behavioral biometrics prove continuity, not comprehension. The first entity to move through this stack with a stolen session token and a plausible behavior profile will have the full authority of the browser analogy behind them. On that day, the private regulator will not look like a standards body. It will look like an insurance pool that priced the risk incorrectly. This is not a critique of the individuals in the Forum. It is a structural limitation of any self-regulatory body that operates inside a liability vacuum.
The Forum meets for the first time on November 17-18, 2026, at Best Buy's campus in Minneapolis. It will adopt working groups, produce documents, and claim progress. The real test will arrive when a genuinely catastrophic agent payment failure lands in the mainstream news. That event will not be a code bug. It will be a governance bug with legal consequences. The question is whether private standards can be hardened before the first exploit is treated as a regulatory case study. My answer, based on the numbers, is no. The $300 billion projection assumes trust. The existing transaction volume assumes a future that is not here yet. Math doesn't lie. And neither does the gap. The private regulator is not ready at all.
