The numbers that matter aren't on any protocol's landing page.
On March 5, an agentic checkout pilot that had been quietly wired into more than ten Shopify storefronts generated sales "close to zero." Not close to target. Close to zero. Within weeks the flow was rolled back — in-chat purchase demoted to a plain app redirect, the digital equivalent of admitting the machine couldn't be trusted to finish the transaction. Meanwhile, merchant-survey data moving through the PYMNTS ecosystem says 93% of merchants believe AI providers should absorb the financial loss when an autonomous agent buys the wrong thing. Only 28% are willing to open their full product catalog to those same agents.
Read those two figures against each other and you have the whole thesis in one sentence: the industry has built a magnificent front door and refuses to build the room behind it. Identity is solved. Authorization is solved. Payment is a redirect. Liability — the layer where money actually changes hands when something goes wrong — is an empty chair at a table full of people who each brought their own chair and are now arguing over who owns the empty one.
That is not a bug. That is the product.
The board, as it actually sits
You cannot understand the agentic-commerce race unless you stop treating it as a race. It's a queue. Everyone is standing in the same line, and nobody wants to reach the front, because the front of the line is where you get handed the bill.
Five protocols define the field right now, and they sort into exactly two layers:
- Meta and Sierra's Personal Agent Protocol (PAP) — the newest entrant, still pre-spec at v0.1. It defines which personal agent represents a consumer and what that agent is permitted to do against a merchant's systems. Enterprise visibility plus consumer control. Partner roster already stretching across Genesys, NICE, Instinct, Rocket, Shopify, Stripe, Walmart, and Decagon.
- Visa's Trusted Agent Protocol (TAP) — a signal layer. TAP's job is to tell a merchant "an agent is initiating this transaction." That's it. A flag, not a settlement.
- Google's Universal Commerce Protocol (UCP) — identity, intent, and signal, wrapped in a search-shaped distribution moat.
- Anthropic's Claude Commerce Agents — a blueprint, explicitly labeled as such, defining what the model may and may not touch. Notably conservative: the model never reaches the checkout counter or the card number.
- Stripe and OpenAI's Agentic Commerce Protocol — the only protocol in the set that actually deployed a payment layer to real merchants. Which is precisely why its near-zero result is the most important data point in the entire sector.
Look at the architecture of all five and one structural decision is unanimous, uncontested, and almost invisible. Every single protocol front-loads the identity, authorization, and signal layers, and defers the money-settlement layer indefinitely. Not one of them ships with a liability model attached. Not one of them says: here is who pays when the agent is wrong.
Based on my own experience stress-testing agent-execution protocols, this pattern is never accidental. When a design team can ship the cheap layer and defer the expensive one, it does — every time, and usually with a roadmap slide that promises the expensive layer "soon."
Layer one: the door everyone wants to guard
Identity is the cheap layer. That's the whole reason it's crowded.
Authenticating an agent and scoping its permissions is a well-trodden extension of the Web2 stack you already know — OAuth flows, API scoping, SSO-style trust delegation, enterprise directory lookups. I've audited these patterns for years; they're mature, they're documented, and critically, they carry almost no financial downside for the party that implements them. If your identity protocol misidentifies an agent, the merchant sees a bad request. If your settlement protocol misroutes a payment, someone loses real money and wants it back.
Guess which layer Meta, Google, Visa, and Anthropic all chose to build first.
PAP is the cleanest example because it's the newest and the most candid. Its stated purpose is to give merchants enterprise-grade visibility into which agent is knocking and to give consumers control over what that agent can do. Genesys and NICE — customer-service software vendors, not payment companies — are among its earliest integrations. That tells you something the marketing doesn't: the first genuine pain point for agent identity isn't commerce at all. It's customer service. Who is this entity claiming to be a customer? Can it see the order? Can it change the address? That's the actual beachhead, and it's a B2B support problem long before it's a checkout problem.
Payment, in this reading, is a downstream extension — the thing you bolt on once identity works. And that framing is exactly how you end up with a magnificent front door and no room behind it.
Visa's TAP is even more revealing because it's an incumbent payment network deliberately choosing the signal layer over the settlement layer. TAP broadcasts intent. It does not reassign responsibility for non-fraudulent error. Think about what that means. Visa — a company whose entire business is the adjudication of who owes whom — looked at agent transactions and decided its job was to raise a flag, not to referee the dispute. The most experienced liability-holder on the planet saw the liability question coming and positioned itself upstream of it.
That is the tell. When the incumbent with the deepest risk-management muscle declines to underwrite the new risk category, you are not looking at a technical gap. You are looking at a rational retreat.
Layer two: the money, which is a redirect
Now the part nobody wants to talk about.
The only protocol that shipped an actual payment flow — Stripe and OpenAI's Agentic Commerce Protocol — did so with a feature called the Shared Payment Token. Read the mechanism carefully, because the design choices are the strategy.
The Shared Payment Token scopes payment authorization to a specific merchant and a specific cart total. It never exposes the raw card number. On the surface this is privacy engineering, and it's genuinely elegant: the agent gets the authority to complete one defined purchase without ever holding the credential that could complete any purchase.
But look at what the constraint also does. By binding authorization to a named merchant and a fixed cart total, the token architecture narrows the surface area where an error can even be attributed. It's a scope limiter dressed as a privacy feature. If the agent can only spend against merchant X for amount Y, then the number of ways the agent can be "wrong" collapses to almost nothing — and with it, the number of scenarios in which anyone has to answer for a loss.
That's not a coincidence. That's liability minimization by design.
And it still wasn't enough. The pilot ran, sales came in near zero, and the flow retreated to a redirect. Which means the Shared Payment Token's tight scoping didn't solve the merchant's real fear. The merchant's fear wasn't "the agent spends too much." The merchant's fear was "the agent buys the wrong thing and I eat the return, the dispute, and the support ticket — and nobody compensates me."
Payment access is not payment responsibility. That's the lesson OpenAI just paid to learn in public. Wiring a checkout into a chat window is a two-week engineering task. Deciding who absorbs the loss when the checkout goes wrong is a governance problem that no two-week sprint touches.
The empty layer, quantified
Here is where the merchant survey data becomes a forensic instrument rather than a statistic.
93% of merchants want AI providers to carry the financial loss. 28% are willing to open their full catalog. That 65-point spread is not confusion. It's a precise, rational hedge, and it maps exactly onto the structure I've been describing.
A merchant reasoning about agent traffic is running a simple expected-value calculation. Opening the full catalog to agents raises conversion — more buyers, more paths to a sale. But it also raises exposure, because every additional product category is another way an agent can misfire, and the merchant currently has no mechanism to recover the cost of that misfire. So the merchant does the only thing a rational actor can do when liability is unassigned: it caps its downside by shrinking its offer. It keeps the agent on the safe SKUs. It keeps 72% of its catalog behind a wall that exists not for security, not for logistics, but for liability containment.
Merchants are using reduced sales volume to hedge an unquantified risk. That is a stunningly expensive hedge, and they're paying it happily, because the alternative — full exposure with no recourse — is worse.
I've seen this exact pattern before. During the 2022 collapse of a major exchange, the market's reaction wasn't to demand better fundamentals. It was to withdraw liquidity from anything whose counterparty risk couldn't be priced. When you can't price a risk, you don't take more of it. You take less. You hide.
That's what 28% is. It's a market hiding from an unpriceable risk.
The liability vacuum is a structural stalemate, not a temporary state
The comfortable reading of all this is that agentic commerce is early, the payment layer is coming, and the 93-vs-28 gap will close as the technology matures.
The uncomfortable reading — the correct one — is that this is a structural bargaining deadlock, and it will not resolve on its own.
Run the incentives. Every player in the chain is optimizing to occupy a layer where it does not bear the cost of error:
- The agent framework (the AI model provider) wants to hand off before the transaction completes. Anthropic's blueprint is explicit: the model doesn't touch the till. The model reasons; someone else executes.
- The identity protocol (PAP, UCP) wants to verify and authorize, then step back. It authenticates the actor and defines the permission envelope — and then the actual money movement happens somewhere it doesn't control.
- The payment network (Visa) wants to signal, not settle the dispute. TAP flags intent; the chargeback rules stay exactly where they were, between consumer and merchant.
- The payment processor (Stripe) wants to route the transaction, not underwrite the misfire. The Shared Payment Token scopes the authorization so tightly that attribution becomes nearly moot.
- The merchant wants the upside of agent traffic without the downside of agent error, so it caps its catalog.
Every single participant is standing in the same place: the layer where you don't pay when things go wrong. And because everyone is standing there, the layer where someone does pay — the liability layer — has no occupant.
This is what I mean when I say it's a deadlock and not a delay. Nobody moves first, because moving first means volunteering to be the one who pays. The first player to accept liability inherits an unbounded cost with no established pricing model, no actuarial history, and no regulatory precedent. That's not an attractive first-mover position. That's a first-mover trap.
So the queue holds. Every quarter produces a new protocol announcement at the identity layer, and every quarter the settlement layer stays deferred. The narrative keeps its heartbeat — protocols ship, partnerships get announced, partner logos multiply — while the thing that would actually make agent commerce scale sits unbuilt.
The empty chair is the most strategically valuable seat at the table, and everyone is waiting for someone else to sit in it.
Where the Web3 window actually is
Now the part the crypto-native reader has been waiting for, and I want to be precise, because "Web3 can fix this" is the laziest sentence in the space and I'm not going to write it.
Here's the accurate version. The reason the liability layer is empty in the Web2 stack is that assigning liability requires three things the Web2 stack is structurally bad at providing: a tamper-evident record of what the agent actually did, a programmable rule for what happens when that record shows an error, and a pool of capital that stands behind the rule. Web2 can do all three with contracts and lawyers. It just can't do them cheaply enough to make a $40 misfired purchase worth adjudicating. The transaction cost of assigning blame exceeds the value of the transaction being blamed.
That's the crack. The liability layer isn't empty because nobody wants it. It's empty because the adjudication cost is higher than the stakes. And that is precisely the kind of problem programmable settlement is built to solve.
A verifiable agent-behavior log — identity bound to authorization scope, bound to transaction record, bound to error determination, all written to a ledger nobody can quietly edit — collapses the cost of answering "what happened and who's responsible" from a legal process to a query. An escrow or insurance pool with programmatic payout rules turns "we'll figure out compensation later" into a deterministic function. An oracle or audit trail that feeds the adjudication gives the whole thing an evidentiary spine.
This is where the identity layer's own weakness becomes an opening. Every one of these protocols — PAP, TAP, UCP — relies on centralized trust. The merchant has to believe the agent's identity claim because a company says so. There's no way for a user to self-prove that the agent acting on their behalf is genuinely theirs, and no way for a merchant to independently verify it without trusting the issuing platform. Decentralized identity and verifiable credentials are native strengths in exactly the place these protocols are weakest: portable, self-provable, cross-platform agent identity.
But — and here I'll be colder than the cheerleaders — the Web3 window is real and narrow, and it is not the identity layer. The identity layer is already crowded with better-funded, better-distributed incumbents. Meta has distribution. Google has a search moat. Visa has the rails. A decentralized identity protocol trying to out-identity them is bringing a knife to a rail-gun fight.
The window is the layer none of them will touch: trust-minimized, liability-auditable agent settlement. Not "we verify the agent." Everyone verifies the agent. The unclaimed prize is: we define, in code, what happens when the agent is wrong, and we back it with capital that pays out automatically.
That is a different business. It's a harder business. It's also the only business in this stack that nobody is competing for.
The regulatory clock nobody is watching
The liability vacuum isn't just a market problem. It's a regulatory time bomb, and the fuse is already lit.
Here's the mechanism. When 93% of merchants in a major market say an entire class of provider should bear financial responsibility for consumer harm, regulators read that as an industry consensus signal. It doesn't matter that the merchants are describing their preference rather than a legal standard. It becomes ammunition. The moment a regulator decides that an AI provider acting on a consumer's behalf is a "merchant" in the consumer-protection sense, or that existing wire and card rules extend to agent-initiated transactions, the entire economics of the identity layer change overnight.
Look at the existing frameworks and where the agent sits in each. Reg E in the US governs electronic fund transfers. PSD2 in the EU governs payment initiation. Chargeback regimes under the card networks govern disputes between consumers and merchants. In every one of these, there's a defined human consumer with defined rights. Now insert a non-human agent that initiates a transaction the human never explicitly confirmed, buys the wrong item, and triggers a dispute. Whose chargeback right is it? The human's, for a transaction the human didn't directly make? The agent's, for an entity that has no legal personhood? The provider's, for a system that claims it only "suggested"?
Nobody has answered this, and the reason nobody has answered it is the same reason the liability layer is empty: answering it means accepting a position, and accepting a position means accepting cost.
Visa's choice of the signal layer over the settlement layer now reads differently, doesn't it? By flagging agent-initiated transactions without reassigning non-fraudulent error responsibility, the card networks are buying themselves interpretive room. They're creating a paper trail that says "we identified these as a distinct risk class" while keeping the actual dispute rules exactly where they've always been. That's not innovation. That's hedging — building the ability to say "we told you it was different" when the regulators finally arrive.
The merchant survey number, the 93%, is going to get cited in a hearing someday. And the protocol that shipped with no liability model is going to be asked why it didn't have one.
The signal to watch, and the trap in it
The seductive mistake right now is to read every protocol announcement as progress. It isn't. Protocol launches are the cheapest possible form of activity — a blog post, a partner logo, a roadmap slide. If you're tracking agentic commerce by counting announcements, you're tracking narrative, not adoption, and the ratio between the two is running north of five to one.
The number that actually matters is the one from March 5: real sales from real agent traffic through real merchant storefronts. That number was near zero. Everything since has been commentary.
So here's what I'd actually watch, and why each signal is diagnostic rather than decorative:
First, whether PAP's v0.1 specifies a payment-extension timeline and any liability terms. If it names a date and a responsibility structure, the liability question is officially on the agenda and the vacuum starts to close. If it stays vague, the deferral continues, and the 28% stays 28%.
Second, whether Stripe and OpenAI return with a large-retailer integration. Their early failure was specifically with small and mid-sized Shopify merchants. If they come back with a big-box anchor, it means they found a way to make the unit economics work — or they found a counterparty willing to eat the misfire risk. Either answer is informative.
Third, whether Visa extends TAP into actual responsibility allocation — a version that underwrites or arbitrates agent error rather than merely flagging it. If that happens, the traditional networks consolidate their position and the Web3 window narrows hard.
Fourth, and most telling, whether anyone builds a unifying agent-identity standard — a FIDO-style consortium or a W3C-style working group. Fragmentation right now is the silent tax: PAP, TAP, and UCP are parallel and incompatible, which means every agent re-verifies on every platform. That's not an identity layer. That's an identity maze.
Fifth, the PYMNTS merchant number itself, tracked over time. If the "willing to open full catalog" figure climbs above 40%, the liability problem is genuinely easing and the market is entering an acceleration phase. If it stays pinned under 28%, the narrative is spinning in place and every protocol announcement is noise.
And here's the trap inside all five signals: none of them measures the thing that actually determines whether agentic commerce scales. They measure everything around it. The protocols measure identity. The processors measure routing. The networks measure signaling. The metric that matters — does anyone stand behind the misfire — is still unmeasured, because there's still no one standing there to measure.
I've watched this exact movie before. In 2021 I tracked a 12% divergence between social sentiment and actual wallet activity in the NFT market and published the anomaly within four hours — the gap between what the narrative claimed and what the chain showed. That gap is what killed that cycle, not any single project. Agentic commerce has the same gap today, and it's wider: the narrative says agents are transacting; the data says ten-plus storefronts produced sales near zero. Hype is loud. Volume is quiet. And the quiet number is always the one that's right.
The blind spot in every bullish take on agentic commerce is the assumption that the missing layer is a technical problem waiting for a clever engineer. It isn't. It's a responsibility problem waiting for someone willing to lose money first. Engineers can't solve it, because engineers don't sign the checks. The people who sign the checks are the people who benefit from not signing them, and they are the ones writing the roadmaps.
That's why this deadlock holds. Not because the technology is hard. Because the incentive to leave the chair empty is, for now, stronger than the incentive to sit in it.
The part where the market actually turns
The turn, when it comes, won't announce itself as a liability solution. It'll announce itself as a number — the first merchant survey where "willing to open full catalog" crosses 40%, or the first agent-checkout pilot that posts sales meaningfully above zero. Everything else is preamble.
And the first entity to occupy the empty chair — whether it's a Web3 settlement protocol with an on-chain escrow-and-arbitration stack, a traditional insurer that decides agent-error is an underwritable risk class, or a payment processor that simply eats the misfire cost to unlock the volume — will discover something the current field hasn't priced. The player who accepts liability doesn't just absorb the cost. They capture the entire market that was waiting for someone to absorb it. The 72% of catalogs currently walled off are waiting for exactly one thing: a party willing to be answerable. Whoever becomes answerable becomes the default.
So the real question isn't whether agentic commerce will get a settlement layer. It's which layer of the stack blinks first — and whether it blinks because a Web3-native protocol makes the liability question cheap enough to answer, or because a regulator makes it expensive enough that someone has to.
Speed is the only currency that doesn't depreciate. But speed in the wrong layer buys you nothing. The industry spent two years sprinting at the door. The room is still empty, the check is still unsigned, and the fastest player in the stack is the one who figures out that the money was never in guarding the gate.
It was in being the one who pays when the gate opens wrong.
