Agentic Payments Explained: Rails, Protocols, Liability

An AI agent never holds the shopper's card. It carries a credential someone else scoped: a single-use card from Link, a wallet grant from Shop Pay or Google Pay, a Stripe token with an amount and an expiry, or the shopper's own card typed into your checkout. Here is each rail, the protocol that describes it, who sets the limits, and who pays when it goes wrong.

Agentic payments are purchases an AI agent completes for a shopper using a scoped credential: a single-use card, a wallet, or a token carrying an amount and expiry. The shopper approves the total and the merchant stays merchant of record.

Last updated: 13 October 2026.

Rails and credentials: how an agent actually pays

The agent is the buyer's browser or API client. The money moves on rails that already exist; the only new object is the credential the agent carries to your checkout. Six are live.

The shopper approves first: "For every purchase, consumers are asked to approve the transaction total directly in the chat interface, and Muse never sees their underlying payment details" (Stripe, 8 September 2026). More in AI shopping agents, how Meta Muse pays, Stripe vs Adyen vs PayPal and PayPal in agentic commerce.

The protocols and what each one specifies

Protocols do not move money. They describe the messages around it: what the shopper agreed to, which agent is asking, and how the credential is handed over.

MCP (Anthropic, November 2024) sits underneath: it is how a tool-calling agent reads stock and price before any payment message, and what we expose at our MCP server. AP2 runs as "an extension of the Agent2Agent (A2A) protocol" (Google, 17 September 2025), where agent-to-agent payments will sit. The network layer is in Visa, Mastercard and the agent trust frameworks; the payments primitive in Stripe and agentic commerce.

Limits, policies and who sets them

Every rail above caps what the agent can do, and the merchant sets none of the caps.

The shopper. On Muse, "It will always ask for your approval prior to completing a purchase" (Meta Help Centre, read 26 September 2026). ChatGPT agent asks permission "before taking actions of consequence" (OpenAI, 17 July 2025). Under AP2 the shopper signs the Intent Mandate, including "price limits, timing, and other conditions" (Google, 17 September 2025).

The agent platform. A Shared Payment Token is granted "with usage and expiry limits": currency, max_amount and expires_at. "The agent sets the maximum amount to match the total amount of the transaction." The platform can revoke it; a token is deactivated once "consumed, expired or revoked", and your webhook receives shared_payment.granted_token.deactivated. Tokens run in "the US, Canada and select European countries" (Stripe docs, read 10 October 2026).

The regulator. In India the caps are in flux. NPCI's Reserve Pay blocks funds "at 10,000 rupees ($105.44) for up to 90 days" (Reuters, 1 September 2026); a separate report has it "currently capped at Rs 15,000" (Medianama, 3 September 2026). The two are unreconciled. The CERT-In Digital Threat Report 2025-26 (13 July 2026) recommends mandatory human-in-the-loop controls for agent actions above defined financial thresholds, with full audit trails; the thresholds are unspecified.

Liability, returns and chargebacks

The merchant of record does not move. Shopify: "You remain the merchant of record, and you continue to manage fulfillment, returns, and customer service for these orders" (Shopify Help Center, read 26 September 2026). OpenAI: "OpenAI is not the merchant of record in the Agentic Commerce Protocol" (OpenAI Developers, read 10 October 2026). Microsoft: "You are the merchant of record" (Microsoft Advertising, read 10 October 2026).

So an agent order settles as card-not-present, and those disputes land on you. Above the dispute sits a new layer. Meta tells its users: "You're responsible for all transactions that your Muse makes on your behalf", and on the Link rail "Stripe offers coverage for eligible purchases for damages, theft, loss, price drops and returns" (Meta Help Centre, read 26 September 2026). The two point in different directions; neither is a merchant contract.

Refunds do not change. Stripe: "your existing refund flow works without changes for agentic checkouts" and for a Shared Payment Token "Subsequent events, such as refunds and reporting, behave as if you provided the PaymentMethod directly" (Stripe docs, read 26 September and 10 October 2026). The gaps are evidence and identity: dispute evidence sits with the agent platform or does not exist, and a returning shopper may hold no account with you. Record which agent placed each order and which authorisation reference it carried; neither can be reconstructed later. Full treatment: who is liable when an AI agent makes a fraudulent purchase and returns, refunds and chargebacks on agent orders.

What a merchant has to change

Less than the protocol list suggests; the rails are your existing ones.

1. Choose your channels. Shopify documents two switches per agent channel, Catalog access and Direct checkout (Shopify Help Center, read 26 September 2026). On Google, add native_commerce(checkout_eligibility) to the Merchant Center feed or the Buy button never shows. On Copilot, Shopify stores are enrolled "following an opt-out window"; PayPal and Stripe merchants apply (Microsoft Advertising, 8 January 2026).
2. Accept the token. On Stripe: agree to the agentic commerce seller terms, create a Stripe profile, confirm a PaymentIntent with payment_method_data[shared_payment_granted_token], and subscribe to the deactivation webhook (Stripe docs, read 10 October 2026). OpenAI expects merchants to "bring their own PSP".
3. Retune fraud rules for one card type. The Link single-use card is a fresh number, card-not-present, from a data centre, with a real billing name. Velocity and new-card rules written for card testing decline it.
4. Make the checkout finishable. Recorded agent failures include blocked autonomous clicks at checkout and a licence-number gate (CNN, 23 September 2026). A guest path and no captcha at the pay step are the floor; this is the work we run under enable agentic checkout.
5. Expose stock and price to tool-calling agents. An MCP server lets an agent read variant availability directly; ours is at /docs/mcp, and we connected it from Muse.
6. Record the agent on the order. Agent or surface, authorisation reference, price and policy presented. A Link card order carries no marker and Meta's direct checkout fires no pixels, so GA4 files both as Direct; see dark agentic commerce traffic.

India: the GFF report

India runs the one agentic payments stack built on a bank rail rather than a card. Pine Labs' P3P executes on NPCI's UPI ReservePay and One-Time Mandate rails inside RBI's e-mandate framework, with Grantex as the identity, authorisation and audit layer. Detail in India's agentic payments infrastructure.

Our GFF 2026 report, India's Agentic Payments Stack, maps the money, the eight players and the regulation across 18 pages. Its headline numbers: an estimated 100 million agent-initiated transactions worldwide in 2026, about 0.04% of UPI's 241.6 billion annual transactions (Tru Commerce, 2026); 7× more shoppers finish an agentic checkout than a tap-through one (Paytm, Q4 FY26, as cited in the report); 85 to 95% of AI shopping sessions landing in analytics as Direct, so the true count cannot be measured (Tru Commerce, 2026); and about 5 million grocery orders a day across India's three largest quick-commerce apps, the first agentic beachhead (Tru Commerce, 2026). Its argument: every player has solved how the agent pays and none owns which brand it picks.

Where Tru Commerce fits

We have run this on Gray Porter and a group of US DTC brands: we made the product pages and checkout readable and finishable by an agent, then placed a real Muse order on the store. On measurement, MyMuse is the reference: over a 12-month attribution window GA4 reported ₹11.5K/mo of AI revenue, the real figure was ₹81.2K/mo, 7× hidden, and the Year 1 net surfaced was +₹29.34L. To see which of these credentials your checkout accepts today, book a demo.