Agentic Summer School - Part One

Unless you have been living under a rock, there is no denying that Agentic Commerce is everywhere.

Based on figures shared by OpenAI, Anthropic, and Google, pretty much everyone in the world has used AI in one way or another.

From typing in a question in Google and the top search result being Gemini’s AI-generated answer, to using ChatGPT or Claude. Maybe you asked it to compare two washing machines, plan a weekend, or find a birthday present for someone difficult to buy for.

Now change one thing. Give it a card.

That’s agentic commerce, and it’s what the entire payments industry has spent the past year and a half building toward.

Over the next two editions of this newsletter, I want to walk you through it from the ground up. What an agent actually is, what all the three-letter names like MCP, A2A, ACP, x402 mean, and why a system that handles trillions of dollars a year suddenly needed rebuilding.

This first edition is more about the how; the next one is the who, and the strategies that you need to deploy to ensure you are a part of one of the biggest changes in commerce and payments in decades.

No prior knowledge assumed. Let’s go.

The word gets thrown around loosely, so here’s a working definition you can hold on to.

• A bot follows a script somebody wrote. It checks a price every morning at nine. It can’t do anything else, because nothing else was written down.

• A chatbot talks to you. It answers, suggests, explains. Then it stops, because talking is all it does.

• An agent is given a goal, not a script. You say “find me a decent raincoat under eighty dollars,” and it works out the steps itself. It searches, compares, discards, and decides. Nobody wrote those steps down in advance.

The last one is the one we will be focusing on. A bot does what it was told. An agent works out what to do.

Which is fantastic when it goes well, and is exactly why the payments industry got nervous.

Agentic shopping isn’t one thing. It’s a spectrum, and where you sit on it changes everything about the plumbing underneath.

Most of what exists today is the first kind. The agent finds things, and you buy them. That’s already happening at scale, and it doesn't need any new payment technology at all, because you’re still the one clicking.

The second kind is where it starts getting interesting. The agent does the tedious part and hands you a finished basket. You approve. Still recognizably shopping.

The third kind is the one everything is being built for. You say once, in advance, “book it if the fare drops below four hundred,” and then you get on with your life. The purchase happens later, without you, and the shop has to somehow satisfy itself that you agreed to it.

The keyword here is Later. As it is the root cause for most of the problems I’ll discuss.

It is important to note that when it comes to Agentic Commerce, there are actually two things that wear the same name, and the further we get, the more confusing it can become if you don’t distinguish between them both.

When an agent buys you a raincoat, that’s agentic commerce. A human wanted something, a machine fetched it, a shop sold it. The money ends up where it always did.

When software buys something for its own use, that’s different. An agent needs a piece of data to finish a job, so it pays a few pence for it. No human wanted that data. No human will ever see it.

The tempting mistake is to think that the difference lies in how independent the agent is. It isn’t. A fully autonomous agent buying you a raincoat is still shopping for a person. The same agent buying the computing power it runs on is not.

So it is always important to ask, who the purchase is for.

I wrote about the second kind in detail, called Machine-to-Machine Payments, a few weeks ago; however, let’s focus on the first one here.

For most people who don’t work in payments, this might come as a surprise.

The card system is genuinely good at its job. It’s been hardened over decades against every kind of fraud, and the reason your card mostly works and mostly doesn’t get stolen is a large pile of unglamorous engineering.

But all of that engineering rests on one assumption, and once you see it, it’s hard to unsee.

It assumes a person is there.

Have a look at the list above. Every single one of those checks is asking, in a different accent, the same question: is there a human here, and is it the right human?

Take the human away, and each check either breaks or, worse, fires wrongly. The device isn’t recognized because it’s a data center somewhere. The location makes no sense because the computer is nowhere near you. The shopping pattern looks nothing like yours because it wasn’t made by a person.

The system doesn’t just fail to protect you. It starts blocking things you actually wanted.

And the puzzle is genuinely hard. If you can’t recognize the person, and you can’t recognize the device, and the behavior tells you nothing, what exactly are you checking?

The industry’s answer, which we’ll get to, is a proper change of philosophy. Stop trying to guess. Start asking for proof.

Before we dive into the names, let’s make sure we get at least one bit of vocabulary right, because it’s the word that does the most work in this field and it’s rarely explained.

What is a protocol?

A protocol is an agreement about how two systems talk, that neither of them owns.

Email is the example everyone can feel. Gmail and Outlook are competitors built by rivals in different decades, and a message still goes from one to the other without anybody negotiating. That works because both agreed long ago to a shared set of rules for handing over mail.

Nobody owns those rules. That’s the point of them.

If email had no protocol, every provider would need a private arrangement with every other provider. Ten providers, forty-five separate deals. It would have collapsed under its own weight before it started.

That’s the situation agentic commerce was heading for. Every AI assistant would need a private integration with every shop. So the industry started writing protocols instead.

Rather a lot of them, as it turns out.

If you want to be able to differentiate between the names, I suggest focusing on the job that needs to be done to remember them.

Think about what has to happen for an agent to buy you a raincoat, and you get six distinct tasks.

Every step is a separate job, which is important to know when working with Agentic Commerce. Finding a raincoat has nothing in common with proving you agreed to buy it, which in turn has nothing to do with moving the money.

Different jobs need different agreements. That’s why there isn’t one protocol, and why there was never going to be.

Now, let’s break down the names.

A lot of abbreviations, but essentially, this is where we are right now.

The most interesting part of it is probably the last one. Five jobs have at least one answer, and the third and fourth have several competing. The sixth has nothing at all. We’ll come back to why.

Now they have jobs, the names are easy. One paragraph each.

• MCP lets an agent use tools. Before it existed, connecting an assistant to some outside service meant custom work every time. MCP made that a standard connection, the way a plug fits a socket. Anthropic built it and then handed it to the Linux Foundation in December 2025, a neutral home for shared technology.

• A2A lets agents find and talk to each other. One agent posts a card detailing what it can do; another reads it and passes the work over. Google built it and gave it to the Linux Foundation in June 2025.

• ACP and UCP both do the shop end: read the catalog, build a basket, run a checkout. ACP came from OpenAI and Stripe in September 2025. UCP came from Google and Shopify in January 2026. They overlap heavily, and yes, that means a shop wanting to reach everybody currently supports both. More on that next time.

• AP2 handles permission. It’s the “you said yes” layer, and it’s how a shop can tell, months later, exactly what you authorized. Google built it, then handed it to the FIDO Alliance in April 2026, with about sixty organizations signing on. Mastercard donated a similar piece of its own alongside it.

• Web Bot Auth and Visa’s Trusted Agent Protocol both answer “which agent is this?” They let an agent prove its identity at the door, so a shop can let good ones in rather than blocking everything automated.

• x402 moves money between machines. It revived a status code that the web’s designers reserved in the 1990s, labeled “payment required,” and then left unused for thirty years. Coinbase built on it and handed it to the Linux Foundation in July 2026.

For now, that is all of them. Depending on when you are reading this, it may already have been updated or changed. But as of August 2026, this was the protocol stack. So, if you remember nothing else, remember that they mostly don’t compete. They stack.

Strip away the names, and there are only three real building blocks. Once these click, the rest is decoration.

The signature is the simplest. The agent has a secret key, publishes the matching public one, and signs each request it sends. The shop checks the signature against the published key. Match, and the sender is who it claims.

It’s a wax seal. It proves who sent the letter. It says nothing about what’s inside or whether they were allowed to send it.

The one-shot card number solves an obvious fear. You do not want to hand a card number to software that talks to strangers on the internet.

So nobody does. Instead, the bank issues a stand-in that works exactly once, at a named shop, for up to one amount, and then dies within minutes. If it leaks, it’s worthless. If the agent tries to spend more, it bounces. If it turns up at a different shop, it bounces.

A gift card, essentially, minted on the spot for a single purchase.

The mandate is the newest idea and the most important. It’s a signed record of what you actually agreed to.

Say you tell your agent to buy tickets for under $200. That instruction gets written down and signed with a key on your phone, before anything is bought. Later, when the agent purchases, the signed slip accompanies the transaction. Anybody in the chain can check it.

So when the question comes up months later, and it will, nobody is arguing about what you said. The answer is written down and signed.

One purchase, using all three.

Note what happens at the end. The shop charges the one-shot number the way it charges any card, over the same rails it has always used.

The shop stays the shop. It’s still the one who sold you the raincoat, still the one who owes you a refund, still the one your bank argues with if it goes wrong. The AI assistant is the messenger, not the merchant.

That was a deliberate choice, and a smart one. Rebuilding the world’s payment rules would have taken a decade. Slotting into the existing ones took a year.

Back to that sixth job, because it’s the one I’m keeping an eye on for now.

Counting what an agent used, pricing it, and putting it on a bill. There’s no standard. Not a weak one, not a competing pair. Nothing.

Which is strange when you notice that the other five all got standards fast, and most got donated to neutral organizations that the donors don’t control.

I’ll leave you with the question rather than the answer, because it’s a good one to chew on between now and next time.

Why would fiercely competitive companies give away five pieces of this and not the sixth?

An agent is software given a goal instead of a script. Agentic commerce is that software buying things for you, and it breaks the payment system because every safety check quietly assumes a person is present.

The fix was a set of shared rulebooks, one per job. Six jobs. Roughly eight names, which now, you have a reference to that includes six boxes, and an explanation of what those boxes are and what they do.

Underneath, three ideas: a seal that proves who’s asking, a card number that only works once, and a signed slip proving what you agreed to.

Next time: I’ll dive into who has actually shipped what, what’s running versus what's just a press release, and what an agent purchase costs when the bill arrives.

Enjoy the sunshine, stay hydrated, and share this with someone who needs to step up their Agentic Commerce game.

Thank you for reading.

P.S. If you’re reading this and are looking for the insights to help you improve your own strategy, that’s exactly what I help payments companies figure out.

20+ years in payments data and strategy. From being the First Data Scientist at Adyen, to being the First VP of Data Science & Analytics at Checkout.com, to helping over 50 of the top 150 acquirers and issuers globally through my consultancy.

For Advisory. Speaking. Consultancy. Email me or DM me to set up a call.

Or, if you just want to keep fueling these breakdowns and deep dives, buy me a coffee.