Agentic commerce has a sign-in standard, a bank behind it and millions of users. What looks like a quiet spell is the moment to prepare.
Image by WikiImages from Pixabay
Hi, welcome to the Trusted Agents Situation Room. This week's post captures much of the essence of this blog - storm chasing. AI, Agents and Agentic commerce are moving at unprecedented speed. Enterprises are struggling to keep up with the pace of technology, yet their customers are not. AI voice agents are already pressing on customer service organizations, AI agents are looking for products and claiming refunds. We're here to keep you updated on the latest developments in Agentic Commerce.
In 20 seconds
A hurricane’s eye is the calmest part of the storm. It’s also the most misleading, because the far wall is still coming.
That’s how this month feels for agentic commerce. Three things happened within a few days of each other.
Meta, Sierra and more than 40 companies, including Walmart, Visa and Mastercard, published a draft standard that lets a personal agent sign in to a business on a customer’s behalf.
Revolut said its in-app assistant will start buying from Amazon for UK customers in December.
Meta’s Muse now has millions of US users, who hand it everyday errands like enrolling children in clubs and finding presents.
If you run a consumer business, try this test. Tomorrow, could you tell a customer’s agent from a scraper? Could you decide which account changes it may make on its own? Would you know which company stands behind it?
In this week’s Situation Room I’ve written up what each announcement settles and what it leaves open. I also explain why I expect most purchases this Christmas to go through the old checkout, even though the experiments will be impressive.
What we’re tracking this week
On 6 October, Meta, Sierra and a group of partners including Walmart and Stripe announced the Personal Agent Protocol, a draft standard for how a personal agent identifies itself to a business.
Two days later, Revolut’s chief executive said the bank’s in-app assistant will start shopping on Amazon for UK customers in December.
Meanwhile Meta’s Muse, an agent people use to enrol their children in after-school clubs and to chase appointments they’ve been putting off for months, is already reporting millions of users in the United States.
Taken together, these three developments leave every consumer business with the same question. When your customer’s agent turns up at your website, your contact centre or your checkout, will you know who sent it, what it is allowed to do, and whose interests it is serving?
The answer will shape your pricing, servicing, fraud controls and customer relationships. That work has to start now, because a business that waits until the Christmas returns are counted in January 2027 will be designing its response after the agents are already shopping.
Do you want Situation Room updates delivered to your inbox?
AI is coming of age, the technology is taking a backseat allowing the user experience to come forwards. By this I mean that I don’t need to understand how a car engine works to drive myself to work. We move from technology to the job-to-be-done which will give both the business and the customer a predictable outcome.
Juan Pablo Ortega, CEO of Yunowrote this week about inviting his mother to try Instinct, a personal AI assistant. At first she said she didn’t like it and didn’t want to use it. A week later she told him how much she enjoyed talking to “your friend”, and it took him a moment to realise she meant the agent. It now reminds her about the lasagne in the oven and plans her trips.
Meta’s David Singleton described the same pattern on a much larger scale when he told CNBC how people use Muse. They enrol their children in activities, track down presents and get long-delayed appointments into the calendar, they can then explain it all to Muse, and the agent works out schedules, reminders and kicks off actions.
We’re now building AI to be fully accessible to those who don’t want to write a program to automate something. This is known as the ‘curb-cut effect’: dropped kerbs built for wheelchair users turned out to help everyone pushing a pram or pulling a suitcase. Software that a reluctant first-time user can direct by talking to it is easier for the busy parent and the commuter too. AI adoption is now spreading past the people who enjoy configuring technology.
Meta's Muse Charm
Mark Sage has written about the hardware version of the same idea. Meta’s Muse Charm is a cute $49 keychain that lets you talk to the agent without unlocking your phone, and as Sage puts it, “whoever controls the first tap controls where the request starts”. A request that starts with Meta’s agent may never pass through your homepage on its way to a purchase.
How quickly will this reach spending? In September, Mastercard’s futures report predicted that more than one in ten online shoppers would routinely use agents to shop and pay by 2030. Juan Pablo thinks that is far too cautious and expects much of this year’s Christmas shopping to go through agents. I’m not so sure I agree with him, I think 2026 will see some great experiments in agentic shopping, but the final purchase will be using the old ecommerce checkout in the majority of cases. Confidence won’t be there yet for consumers and for retailers, the trust rails haven’t yet been built into the Standard Operating Procedures.
Cover Genius and Gather survey supports this. Of 1,392 consumers in seven countries found that 78% were open to AI helping them shop, but only 5% were comfortable letting an agent buy on its own. A further 32% wanted it to propose a purchase and wait for their approval. Mastercard’s own survey found that teenagers were far more willing than their parents to use a fully AI-run shopping assistant (27% against 16%). People are handing over the errands first and keeping their hands on the money.
The ease of use that brings new people in also exposes them. Someone who struggled with a banking app is unlikely to read the permissions screen for an agent connected to their card, their email and their calendar. They will also be among the last to notice when it does something they didn’t intend. Consent therefore has to be designed for that customer, and that is the gap this week’s protocol announcement is meant to start closing.
A front door for agents
Until this week a business had two options when a customer’s agent visited its website. It could let the agent pose as the customer, signing in with the customer’s password and clicking through pages designed for people. Or it could block it like Amazon blocked Muse in September, citing scraping. Similar blocks have been reported at Delta, United, Zillow, Yelp and eBay. Meta’s reply on its company blog was that “turning away a personal agent means turning away the customer behind it”.
The Personal Agent Protocol (PAP, a shared way for agents to sign in to businesses) is meant to give both sides some choices in between. Bret Taylor, Sierra’s co-founder and OpenAI’s chairman, compared it to signing in to a website with your Google account. It can be compared to email, which works because everyone uses the same standard.
The agent identifies itself and opens a session as a guest. That is enough to check stock or read the returns policy.
When the task needs account access, the customer signs in. They decide whether the agent can only look at the account (read) or can also make changes (write).
The business chooses how the agent reaches it: through the website, through its APIs (interfaces software can call directly), or by talking to the company’s own agent. Either side can hand over to a person.
Each message is marked as coming from a person or an agent.
Each company sees the customer under a different anonymous ID, so businesses can’t link up what one customer’s agent did across their sites.
Trusted Agents Protocol Timeline for Agentic Commerce
Our timeline of 20 agentic protocols announced since November 2024 shows why this one is coming now. Infrastructure protocols came first, and the last of them was WebMCP in February 2026. Payment protocols filled in through 2025 and 2026, ending with AP4M in June. Identity is the only class still gaining new entrants, and PAP is the latest. The industry has settled how agents move data and money. Agreeing who an agent is and what it may do is still in progress.
On Thursday, Revolut’s chief executive Nik Storonskytold Bloomberg TV that AIR, the AI assistant in the Revolut app, will be able to “browse the internet, browse Amazon, and then do shopping for our customers”. Testing starts in the UK in December and will then extend across Europe. His case for trusting it rests on where the card details are held: “because all the card details stay in our environment, it’s completely secure.”
He went on to explain the advantage behind it. “With 30 to 40 million transactions taking place every day on Revolut, we have a unique dataset to build on,” he said, describing proprietary AI models trained on customer transactions. The first of these, PRAGMA, was built with NVIDIA and announced in August. Revolut reports that, tested on historical data, it caught 65% more fraud and made 41% more relevant product recommendations than the systems it replaced.
Muse knows what you asked it to do. A bank’s agent also knows what you earn, what you have already committed to this month, and whether a purchase will tip you into your overdraft. In the terms Jamie and I use, the bank holds the context, and context is what makes delegation safe. An agent that can see the energy bill due on Friday can decline to buy a second pair of trainers. A retailer’s agent or a general-purpose assistant can’t make that call with the same confidence.
Storonsky’s point about card details deals with one risk, which is credentials being exposed to the merchant or to the agent. It doesn’t settle whether customers can trust the company holding all that context. In September, Revolut accidentally sent customer data to criminals posing as government investigators.
Then there is the question of whose interests the agent serves. Revolut is also a lender. Its US bank will be credit-first. An agent that knows your balance can stop you overspending. The same agent, owned by a bank that earns from credit, can also offer to spread the cost at the moment you are most likely to say yes. Customers and regulators will want to see in writing which of those AIR is designed to do.
Three questions for every consumer business
Go back to the question at the top. Each of this week’s announcements answers part of it and leaves the rest to you.
Who sent it? PAP gives a personal agent a standard way to identify itself and the customer it is acting for. Without that, your bot defences treat a customer’s agent the same way they treat a scraper. Amazon’s block on Muse shows the cost: it stops the scraping, and it also turns away customers who sent their agent to buy something. As I heard at last week’s CTRL-SHIFT Open Finance clinic, agents are already ringing contact centres too.
What is it allowed to do? The protocol offers read and write, and your business has to decide what those permissions mean for each action. Checking an order carries little risk. Changing a booking can be undone. A refund or a purchase moves money, and changing the email address on an account hands over control of it. That list belongs to you, and it needs writing down before agents start testing the gaps. An agent that can ask the same question five different ways will find any action whose rules were never settled.
Whose interests does it serve? Muse works for Meta’s users and AIR for Revolut’s customers, and each company has its own commercial plans. Jamie and I use three points of a triangle to describe what agentic commerce needs: trust (who the agent and its owner are), delegation (what the customer has authorised) and context (the customer’s own data, preferences and intent). Our definition puts context with the customer. This week it was held by a social network and a bank, and your business sees only what they choose to pass on.
The answers reach well beyond the website. In March we wrote about free cancellation, a policy designed for people who get tired, hesitate and forget. We looked at what happens when a travel agent optimises against it, booking, rebooking and cancelling until the window closes. The same logic applies to returns windows, price-match promises, introductory offers and loyalty points: any policy that depends on human patience to keep its cost down. We call the work of preparing operations for this Agentic Resource Planning. It means redesigning forecasting, pricing, servicing and exception handling so that demand coming through agents can be governed and fulfilled.
The timing is already set. The Personal Agent Protocol has a published draft, Muse users are tracking down presents, and Revolut’s shopping pilot starts in December. A business that begins this work after the holiday season will be changing its policies while agents are already finding their weak points.
Before the storm reaches the coast
The forecast firmed up this month, and the preparation now is on your side of the door. That means deciding which actions a customer’s agent may take, measuring how much agent traffic already reaches your website and contact centre, and testing which of your policies still hold when software uses them at scale. If you’d like help working out where to start, Jamie Smith💡 and I can take your team through it in a 30-minute call.
