Cards, Chains and the Machine Customer: Agentic Commerce Infrastructure

Forty-seven percent of U.S. shoppers use AI tools for shopping tasks, according to a survey Visa ran with Morning Consult on Oct. 14–16, 2025, and published in its Dec. 18, 2025, press release beside a count of “hundreds” of completed agent-initiated transactions across more than 100 ecosystem partners. Jack Forestell’s April 2025 forecast of agents that browse, select, purchase and manage on a person’s behalf has thus met its first measurement, and the measurement splits: usage is mass-market, settlement is a rounding error. That gap is what agentic commerce infrastructure exists to close. Checkout is migrating into the conversation, and the card networks, processors, platforms and merchants are contesting who issues the credential, who holds the mandate, who absorbs the chargeback and who keeps the margin. This article audits the rails, the forecasts and the trust data, and argues that the mandate, the signed record of what a customer authorized an agent to buy, is the primitive on which everything else in the stack depends.

Visa Intelligent Commerce and Mastercard Agent Pay: The Networks Move First

On April 30, 2025, Visa announced Visa Intelligent Commerce with Anthropic, IBM, Microsoft, Mistral AI, OpenAI, Perplexity, Samsung and Stripe as named partners and three building blocks: AI-ready cards that replace card details with tokenized credentials confirming an agent’s authorization and identity, consumer-controlled sharing of spend insights to sharpen an agent’s choices, and consumer-set spending limits paired with real-time commerce signals for transaction control and dispute management. Mastercard had moved a day earlier. Its Agent Pay program, announced April 29, 2025, with Microsoft, IBM, Checkout.com and Braintree, introduced Agentic Tokens as the equivalent credential. By Dec. 18, 2025, Visa reported more than 100 partners, over 30 building in its sandbox, over 20 agents and agent enablers integrating directly, live U.S. transactions executed by Skyfire, Nekuda, PayOS and Ramp, a Trusted Agent Protocol introduced in October 2025 with more than 10 partners, an Aldar partnership for AI-driven fee payments in the UAE, and pilots for Asia-Pacific and Europe in early 2026. Mastercard’s second move came on June 10, 2026, with Agent Pay for Machines: agent credentialing through what the company calls Verifiable Intent, programmatically enforced spending limits, microtransactions down to fractions of a cent, and guaranteed multi-rail settlement across cards, accounts and stablecoins, launched with more than 30 participants including Adyen, Ant International, Checkout.com, Cloudflare, Coinbase, Global Payments, Lovable, Ripple, Skyfire, the Solana Foundation, Stripe and Tempo. Jorn Lambert, Mastercard’s chief product officer, said the platform would allow “services to be bought and sold among agents at fundamentally different scales” than payments today. Hundreds of transactions in the program’s first eight months is the denominator against which that ambition should be read.

Instant Checkout, PayPal and Universal Cart: Platforms Own the Conversation

Stripe and OpenAI open-sourced the Agentic Commerce Protocol on Sept. 29, 2025, and switched on Instant Checkout inside ChatGPT for U.S. Etsy sellers, with more than 1 million Shopify merchants, Glossier, Vuori, Spanx and SKIMS among them, announced as coming soon; the mechanism is a Shared Payment Token scoped to a single merchant and a cart total, so a confused or compromised agent holds a credential that spends once, in one place, up to one amount. Will Gaybrick of Stripe said that day that “Stripe is building the economic infrastructure for AI.” PayPal chose syndication over a new protocol. On Jan. 22, 2026, it announced the acquisition of Cymbio, a multi-channel orchestration platform, with closing expected in the first half of 2026; its Store Sync service, live with Abercrombie & Fitch, Fabletics, Ashley Furniture, Newegg and Adorama, makes product data discoverable inside Microsoft Copilot and Perplexity, with ChatGPT and Gemini listed as coming, and routes orders to existing fulfillment systems while the merchant keeps merchant-of-record status. Google took the protocol route and the storefront route at once. Its Agent Payments Protocol, announced Sept. 16, 2025, with more than 60 organizations including Mastercard, American Express, PayPal, Adyen, Worldpay, Coinbase, Revolut, Salesforce and Etsy, encodes authorization as signed Intent Mandates and Cart Mandates carried as verifiable credentials, and an x402 extension built with Coinbase, the Ethereum Foundation and MetaMask extends the same structure to stablecoin rails. Then, on May 19, 2026, at Google I/O, Universal Cart placed a single cart across Search, Gemini, YouTube and Gmail with Nike, Sephora, Target, Ulta, Walmart, Wayfair and Shopify merchants, on top of the Universal Commerce Protocol released in January 2026 and updated in March with cart management, real-time catalog queries and identity linking. A comparison of the four rail families follows.

Agentic Commerce Market Size: $1 Trillion, $5 Trillion or $17.5 Trillion

Forecasts span an order of magnitude because they measure different things. McKinsey’s QuantumBlack authors wrote on Jan. 28, 2026, that agents could mediate $3 trillion to $5 trillion of global consumer commerce by 2030, along a six-level automation curve that runs from programmed convenience to networked autonomy, where agents negotiate with agents. A McKinsey and ICSC estimate reported by Retail Dive on May 5, 2026, put U.S. business-to-consumer agentic commerce at $1 trillion of revenue by 2030 and found that 68% of consumers had used an AI tool for shopping in the prior three months. Gartner, in analysis presented at its IT Symposium and reported by Digital Commerce 360 on Nov. 28, 2025, projected that agents would intermediate $15 trillion of business-to-business purchases by 2028, that 90% of B2B purchases would be agent-handled within three years, and that 20% of monetary transactions would be programmable by 2030. Deloitte’s U.S. practice set the ceiling at up to $17.5 trillion by 2030. Scope explains the spread. Consumer versus business, influenced versus orchestrated versus completed, and revenue versus transaction value are three different denominators, and each forecast picks its own. The observable numerator today is hundreds of Visa transactions, one live ChatGPT merchant cohort and a Google cart that shipped in May. BCG research presented at Stripe Sessions 2026 bridges the two: 77% of surveyed consumers use answer engines as search, 64% of U.S. shoppers bought after an answer-engine recommendation, 55% of U.S. e-commerce could become agent-assisted and 18% fully autonomous, 42% would let an agent complete a purchase in at least one category, and 25% are comfortable with an agent selecting the payment method, while trust (50%) and control (47%) lead the stated barriers. Forrester’s Emily Pfeiffer wrote on May 28, 2026, that most of the value to date sits in comparison and guidance, and that very few consumers let agents complete purchases with direct oversight removed. Both readings are consistent. Discovery has moved; delegation has yet to.

Mandates, Liability and Chargebacks: Who Holds the Authorization

Every rail above converges on one artifact: a signed record of what the customer authorized. Visa’s tokenized credential carries agent identity and consumer-set limits; Mastercard’s Verifiable Intent carries a credential plus programmatic permissions; Stripe’s Shared Payment Token binds spend to one merchant and one total; Google’s mandates bind intent and cart as verifiable credentials, and AP2 v0.2.0, released in April 2026, added a mode for payments completed while the human is away from the loop. The convergence is expected because the liability question forces it. Card rules allocate fraud loss through authentication and dispute procedures written for two situations, the cardholder at a terminal and the cardholder online, and a purchase initiated by software on a consumer’s behalf falls outside both. A mandate resolves the ambiguity by making the consumer’s delegation itself the authenticated event: the network can verify that the agent held a scoped, time-bound, amount-bound authorization at the moment of purchase, the merchant can present that record in a dispute, and the issuer can adjudicate against it. Chargebacks then turn on whether the agent exceeded its mandate, which is machine-checkable, in place of whether the consumer intended the purchase, which is testimony. Merchant readiness follows the same logic. A merchant that exposes its catalog through UCP, ACP or Cymbio-style syndication and accepts scoped tokens can serve agents at the API layer, and PayPal’s insistence that its merchants keep merchant-of-record status shows where the liability is meant to stay; a merchant that relies on a web storefront receives agents as browser traffic, the subject of this site’s companion article on agentic traffic. Visa’s Trusted Agent Protocol and Mastercard’s Verifiable Intent exist because merchants spent a decade blocking bots, and an agent carrying a valid mandate is a bot the merchant wants to admit.

Cards and Chains: Where the Rails Converge

Mastercard’s June 2026 platform settles across cards, accounts and stablecoins under one guarantee, and Google’s AP2 carries the same mandate over card rails and, through its x402 extension, over stablecoin rails, so the industry has already answered the question of whether chains replace cards: they share a mandate and split by ticket size. Lambert’s phrase about fundamentally different scales points at the sub-cent tier, where compute, data and API calls are bought continuously and card fees set a per-transaction floor; the consumer tier, where the 47% of AI-assisted shoppers live, stays on the credentials issuers already underwrite. The companion article on stablecoin settlement audits the on-chain volumes. Here the relevant fact is structural: every network launch of 2026 has been multi-rail, and every one has placed identity and permission, the mandate, above the choice of rail.

What to Watch

Four measurements will show whether 2026 becomes the year agents complete purchases at scale, as Visa’s Rubail Birwadker predicted on Dec. 18, 2025. First, transaction counts: Visa’s next disclosure against “hundreds,” and whether Mastercard publishes volumes for Agent Pay for Machines. Second, merchant activation: the share of the 1 million Shopify merchants live in Instant Checkout, and Universal Cart’s expansion beyond its launch partners. Third, dispute data: the first published chargeback rates on mandate-backed transactions, which will price the liability model described above. Fourth, trust: whether BCG’s 25% comfort with agent-selected payment methods moves once agents carry verifiable mandates, and whether Forrester’s mid-2026 read changes with it. The infrastructure is built. Delegation, so far, remains the customer’s to give.