When the Customer Is Software

Visa to Stripe to Shopify, June rebuilt the commerce stack for a buyer that is software. Every layer sells the decision to allow. None sells the answer when an allowed act goes wrong.

Start with two numbers from the same quarter, because together they are the whole situation. Orders arriving at Shopify merchants from AI-powered searches grew nearly thirteenfold year on year. And ninety-five per cent of the e-commerce sales those AI platforms drive still complete on the merchant’s own site: Stripe’s annual letter, not a sceptic’s estimate.

The machines have taken the top of the funnel, and the bottom of the funnel has come home. The agent shops; the transaction still lands on your stack. Whatever agentic commerce becomes, it will be executed, overwhelmingly, on the merchant’s own premises. That makes the question not whether the platforms will own the customer, but whether your stack was built for the customer that is now arriving.

That stack has layers with names on them: the card rails, the processors, the wallet, the platform. June moved every one of them, each layer announcing, in its own launches, exactly what it will and will not be doing for you. Walk them in order, then take two facts from the stack’s edges: a rail in India that already shipped the piece everyone else is asking you to build, and a settlement floor that just turned final.

The rails did the recognising

On 10 June both card networks moved on the same day. Visa announced Agent Scoring, an Agentic Registry, and a Large Transaction Model for machine-initiated payments; Mastercard launched Agent Pay for Machines, a machine-payments product this essay reaches at the settlement floor, while its person-side Agent Pay programme, credentialing trusted agents through Agentic Tokens, has been rolling across its cardholder base since 2025. This is the identity problem being solved where it should be solved, at network scale, by the two institutions with the reach to make an agent credential mean something everywhere at once.

The rails shipped recognition: who is this agent, is it registered, is this transaction inside its declared shape. What no June artifact from either network touches is the question this newsletter put at the centre a month ago: what happens after a correctly credentialed agent completes a valid transaction and the outcome is wrong. The chargeback machinery that made human e-commerce trustworthy adjudicated a binary: did the human authorise this payment. A registered agent inside its mandate producing a mistaken order is a different case, and the new registries are silent on it.

The processors are competing for the decision to allow

One layer up, the two processors that fight for the same merchants have made opposite bets on the same architecture, and each bet is legible in the products. Stripe is betting on owning the surface and the wallet: it co-authored the Agentic Commerce Protocol with OpenAI and Meta and runs the checkout path inside ChatGPT; its Shared Payment Tokens let the agent itself pay; and its stablecoin and machine-payment lanes point at the endgame of software paying software.

Adyen launched Adyen Agentic in June as the opposite posture: launched 16 June as a universal translator across UCP, ACP, and AP2, compatible at launch with Meta’s AI checkout and built to add surfaces as they appear, explicitly preserving the merchant of record, with token portability and its EU banking licence underneath. One wants to be where the agent is; the other wants to be whatever the agent arrives through. The protocol field between them is already four lanes wide: UCP and its council, ACP, Google’s AP2 with its sixty-plus partners now stewarded at FIDO, and x402 for machine-native payments. Adyen’s answer to the proliferation is to speak all of them, while Stripe’s is to write them.

The rails, meanwhile, did not stay on their own layer: Visa, Mastercard, and Amex sit on Adyen’s announced partner roster, the networks distributing their new agent recognition through the neutral processor even as they sell it directly. The early merchant lists make it concrete: Sézane, SharkNinja, and Scheels arriving through one door; Etsy, Coach, and Revolve through the other, with Meta, characteristically, on both.

These are serious products, built with skill, and a merchant should be running one of them. But strip the two strategies to their common element. Moving the money is commoditising. Both stacks, all four protocols, the same rails underneath. What each side is building as the thing rivals cannot route around is the decision that comes before the money moves: whether this agent, for this person, should be permitted to act. Stripe scores it through Radar and token scoping; Adyen through a risk engine built, in its own words, to “distinguish a legitimate AI agent from a bot”; the networks through their registries.

Then read the fine print of the trust layers, because it settles where this essay is heading. In Adyen’s model, liability and disputes sit, by design, with the merchant of record: the neutrality bet’s honest price tag. In the reach model, the wallet and the surface move up the stack while the dispute still finds its way back to whoever sold the thing. Whichever bet wins, the allow-decision is for sale and the answer still is not; the adjudication paths that exist run upward, to the network and the processor’s own programmes, before they run outward to anyone the transaction touched.

The one vendor selling the consequence

There is a fourth party on this layer, running a different play. PayPal’s agentic commerce services lead not with the allow-decision but with what comes after it. Agent Ready extends payments acceptance onto AI surfaces with fraud detection, buyer protection, and dispute resolution attached, on a pitch of no additional technical lift for its existing merchants. Store Sync pushes catalogues into Copilot, Perplexity, and the rest through the engine layer: Wix, BigCommerce, Shopware, and their peers. And its PayPal Agent, built with Google Cloud, speaks A2A to the merchant’s own agent and settles under AP2, down to checking buy-now-pay-later eligibility mid-conversation.

It is the one strategy on this layer whose headline is the consequence machinery, because PayPal is porting the protection programme it already owned. Purchase Protection and Seller Protection were the chargeback era’s consumer institution, and extending them to agent-initiated transactions is real, welcome, and worth pricing into any merchant’s choice of wallet rails. Still, it is the old adjudication carried forward: a programme built to answer was this authorised, now facing transactions where the authorisation is cryptographically impeccable and the outcome is what went wrong. The ported chargeback reaches the new era’s easy cases. The case this series keeps returning to, the valid delegation with the invalid result, is not yet what any programme on this layer decides.

The platform returned the transaction to you

The clearest structural fact of the past year is what happened when the platform closest to the user tried to own the checkout. The in-chat instant checkout experiment was pulled back by its own retail partners within months and retired in March; the platform retreated to powering discovery while the transaction returned to each merchant’s environment. Walmart’s numbers explain why the merchants could insist: purchases inside the chat surface converted at roughly a third the rate of ordinary click-throughs to Walmart.com, with cart abandonment far above the norm. The buyer’s agent now lives across half a dozen surfaces: ChatGPT, Gemini, Meta AI, Claude, Copilot, Perplexity. But discovery is what those surfaces kept. Execution came back to the storefront.

Which is why the quiet plumbing matters more than it looks. Google’s Universal Commerce Protocol, now backed by PayPal, Checkout.com, Adyen, Stripe, and both card networks and moving under neutral stewardship alongside A2A, has a merchant publish a manifest at /.well-known/ucp declaring what the store can do. Its April update filled the declaration out: a Cart capability for multi-item orders, a Catalog capability serving real-time variants, inventory, and pricing, and Identity Linking so loyalty follows the shopper across surfaces.

Your storefront is becoming a machine-readable declaration, and your product data is becoming your merchandising. Shopify’s own figures make the stakes plain: AI traffic to its merchants grew eightfold, and the slice grounded in its structured catalogue converts at twice the rate of AI traffic working from scraped or stale data. The store that describes itself precisely gets selected; the one that leaves the machines to guess gets misrepresented, and then blamed for the misrepresentation.

Two counter-moves from the same weeks show the boundary is still contested. Google’s Universal Cart, announced at I/O for a US summer rollout in Search and Gemini, follows the user across Search, YouTube, and Gmail, watching prices across merchants: the aggregator declining to concede that the transaction has come home, by keeping the basket even where it no longer keeps the checkout. Amazon took the opposite posture toward other people’s agents entirely, securing a federal injunction that blocks Perplexity’s Comet browser agent from purchasing on its platform. Where one class of merchant publishes a manifest, the largest one litigates the perimeter. Neither move is available to the ordinary operator. That is exactly why the manifest, the catalogue, and your own storefront machinery are.

And the deeper adjustment is to the customer’s shape, not its channel. Everything in a storefront encodes a buyer who attends at a moment: the session that expires, the error message written for a reader, the rate limit that treats systematic probing as abuse. In June 2025 I wrote that models provide intelligence at a moment while agents provide presence over an arc; that sentence was about the systems enterprises deploy, and it is now the correct description of the systems that buy from them. An agent holds your catalogue in memory, re-checks your prices on a schedule, retries your failures methodically, and carries authority granted weeks ago into this morning’s order. It does not get annoyed; it also does not notice when it should stop. Authority regenerates from the continuity around it unless decay is designed in: a finding this series established about enterprise mandates that now applies, unchanged, to your standing-order logic.

India already shipped the primitive

One jurisdiction has already built the piece this essay will shortly ask you to build: into the rail itself. NPCI’s UPI Reserve Pay lets a person grant one consent with a per-merchant spending limit; inside that limit an agent transacts without per-transaction PINs or OTPs, while the person keeps real-time visibility and can revoke the standing authority instantly. Bounded standing authorisation, with the revocation held by the principal, shipped at the rail itself rather than as any processor’s product. One precision, because the label matters: UPI is routinely described as public infrastructure, but Reserve Pay ships from NPCI, a consortium majority-owned by its participating banks and the sole authorised operator of the switch. The public actor in this stack is the regulator.

It is already carrying live traffic: agentic UPI piloted on ChatGPT from October and on Claude from February, with Zomato, Swiggy, and Zepto as launch merchants, Razorpay’s MCP server wiring the agents to the rail, Axis Bank and Airtel Payments Bank underneath. The operator has set a domain model, FiMI, against dispute handling and mandate lifecycle on the rail side, and its chief executive says audit systems for the instructions and consent users give agents must come with the scale. With the central bank’s pen open until 24 July, India is currently the one stack where both columns of the ledger below are being drafted in the open at once: the handshake by the rail’s operator, the consequence by its regulator. Read Reserve Pay less as an exotic feature than as an existence proof: these controls run today at the scale of the world’s largest real-time payment system.

The floor turned irreversible

At the very bottom, on 30 June, a hundred and forty-odd institutions launched Open USD, a shared stablecoin under the new US legislation: settlement that clears irreversibly, the holder owed redemption on demand and nothing more. This is the settlement determinism the IMF’s April note on agentic payments put at the base of the stack, and the processors are already wiring themselves to it, Stripe through Bridge, the consortium through the shared coin. The consequence runs upward through every layer. When the floor is final by design, every uncorrected wrongness above it gets more expensive, because the money no longer waits for the argument. The correction window, the time between an action and the last moment a human can still intervene, entered this series as a reliability metric for the systems you deploy. Irreversible settlement makes it a commercial metric for the systems that buy from you.

The same floor is already carrying a second market, one this essay has kept out of frame: machines buying for themselves, compute, model calls, data, from other machines. Mastercard’s 10 June launch, Agent Pay for Machines, gives that lane a full product. The owner authorises a spend limit once, and the authorisation can be recorded on-chain; the agent transacts against lightweight vouchers; the network batches, settles with a guarantee, stablecoin in or out. x402, the payment-required rail built for the same traffic, moved to the Linux Foundation in April with both networks, Google, AWS, and Circle aboard, and AWS wired agent payments into Bedrock in May; card economics, with their thirty-odd cents of fixed cost, cannot reach tickets this small. Note what completes down there. The allow-decision is now literally notarised on a chain, and the one consequence-shaped artifact in the lane is a settlement guarantee: an answer to will you be paid, not to should it have been bought, with no person on either side to write terms against. The merchant lane, whatever else it lacks, still has you and your customer. That is the asset.

Crypto ran this experiment first, and by conviction rather than omission: settlement finality was the product, and the absence of chargebacks is still marketed to merchants as a feature, which states the asymmetry out loud, the buyer’s recourse was the cost saving. Yet even there the demand for reversal regrew its organs: optimistic rollups hold every exit open through a seven-day challenge window, staked juries arbitrate escrowed disputes, stablecoin issuers keep a freeze switch, and when the loss was large enough the community’s only answer was the fork, adjudication by chain split, usable roughly once. A stack that deleted the answer column by design spent the next decade rebuilding pieces of it; the rails now importing its finality should budget for the same bill.

Handshake and consequence

A month ago the argument here was a history lesson worth restating. SSL gave the early web its handshake, and consumers still did not trust it until the chargeback gave the web its institution: a rule for who is made whole when a valid transaction goes wrong. Cryptography bakes in authorisation with great elegance; it cannot bake in redress. The claim was that the agent era had finished its SSL and not begun its chargeback, because every body with the convening power to write the consequence rules had scoped them out.

June was the busiest month this space has had, so sort it into those two columns. The registries, the scoring, the wallets, the manifests, the discovery-provenance spec Google published on 17 June, even the AuthZEN approval profile adopted in May that finally gives an agent a wire-level path after “no” (deny, but escalate), all of it is handshake, and the escalation in that last one runs upward to the operator, not outward to anyone a decision lands on. The nearest industry offerings to consequence machinery prove the rule by their shape: PayPal’s ported protection answers the old question, and where the aftermath appears in a protocol at all (UCP’s order lifecycle does carry fulfilment events and refund adjustments), it is event plumbing, not decision rights.

The trail those events would feed is itself fragmenting. Intent lives with the AI surface, the checkout session with UCP, the authorisation with the network, the cart with the platform, the fulfilment with you: five stages under five stewards. The classic internet stacked responsibility, each layer answering to the one above it; this architecture shards it sideways, across institutions that owe each other nothing. It is the cross-boundary reconstruction problem this series named at the protocol layer, arriving in commerce with money attached.

On the consequence side, the month produced three entries, and their authorship is the finding. Colorado’s reasonable-care standard for high-risk AI took effect on 30 June, and the Reserve Bank of India’s draft directions are open until 24 July: lawmakers and regulators, writing protections toward the person, with the revised Product Liability Directive behind both, reaching national law on 9 December. The third came from a merchant: Target updated its terms to treat AI-agent purchases as “transactions authorized by you,” assigning the agent’s mistakes to the customer. So the consequence column is being filled after all: by legislatures on the person’s behalf, and by terms of service against them, with the standards process absent from both. Your own terms will write an entry in this column within the year. The only open question is which of those two directions yours will face.

What to build this quarter, layer by layer

Until the consequence column consolidates, the merchant’s stack is where its share gets built. What follows is less advice than interim institution-building.

At the storefront: publish a refusal taxonomy. Your error messages are now API contracts. Every decline, hold, out-of-stock, and price change should carry a stable code, a reason class, and a retry policy an agent can act on, declared where your capabilities already are, in the manifest, and mirrored in your processor’s webhooks. A store that answers failures in prose will be reverse-engineered, badly, at machine speed.

At the platform: treat probe policy as merchandising. Systematic price-checking is no longer abuse; it is how you get selected, and the structured-data conversion gap is the proof. Decide explicitly, with an owner, what probing you invite, what you throttle, and what you charge for, because the bot policy you have today is deciding it for you by accident.

On your own API: stand up a re-evaluation endpoint. When you decline or hold an agent’s order, give it one deterministic, logged, rate-limited path to present more context and receive a fresh decision. The AuthZEN approval profile is the working-group rendering of the shape; build to it rather than inventing it. The alternative is the agent hammering the gate while its principal arrives in your support queue already wronged.

In the payment layer: put decay on standing authority. Stripe’s scoped, single-use credential is the right primitive; extend the same property to everything on your side that outlives a session: replenishment, standing orders, price-triggered purchases. A lifetime, a renewal that requires the principal, and a measured window between order and irreversibility. The pattern is not speculative: it runs today at population scale as UPI Reserve Pay, with the revocation held by the person. Authority should decay by default; above an irreversible floor, that is a solvency practice, not a compliance one.

Across all of it: tag the species end to end, and keep your own trail. The registries make agent-initiated transactions identifiable at the rail; whether that identity survives into your order records, your dispute records, and your ledger is your build. And because the transaction’s stages now scatter across five protocols under five stewards, you are the only party positioned to hold a composable record from intent signal to fulfilment. Do it before the dispute volume arrives, because afterwards you will be reconstructing it from other people’s logs, under deadline.

None of this waits on a standards body, and each item lands on a layer with a named vendor already underneath it. The rails have done the recognising; the legislatures have begun the requiring. The layer in between — where a correctly credentialed agent’s permitted act meets the person who has to live with the result — is not waiting on anyone’s charter, because it is already in production, on your stack, taking orders.

---

Notes and sources

1. Shopify, Q1 2026 earnings call: AI-search-originated orders up ~13x year on year; AI traffic up 8x; structured-catalogue traffic converting at ~2x.

2. Stripe annual letter, as analysed by eMarketer: ~95% of AI-platform-driven e-commerce sales complete on the merchant’s own site.

3. Visa, Payments Forum announcements, 10 June 2026: Agent Scoring, Agentic Registry, Large Transaction Model.

4. Mastercard, Agent Pay (Agentic Tokens), announced 29 April 2025, US cardholder rollout from late 2025.

5. Stripe, agentic commerce documentation and Agentic Commerce Suite, announced 11 December 2025: Shared Payment Tokens, Issuing for agents, Bridge; network-token and BNPL expansion, 3 March 2026.

6. Agentic Commerce Protocol (Stripe and OpenAI, September 2025; Meta joining subsequently).

7. Adyen, Adyen Agentic launch, 16 June 2026: Agentic Feed, Agentic Cart, Agentic Payments; partner roster; the risk-engine quote is Adyen’s own language.

8. Google, Agent Payments Protocol (AP2), partner roster; stewardship at FIDO.

9. x402 machine-payments protocol; moved to the Linux Foundation, April 2026.

10. PayPal, agentic commerce services: Agent Ready, Store Sync, and the PayPal Agent with Google Cloud over A2A and AP2. PayPal newsroom; paypal.ai.

11. Walmart, in-chat conversion and abandonment figures, as publicly reported; in-chat instant checkout retired March 2026.

12. Google, Universal Commerce Protocol: backer roster; April 2026 update (Cart, Catalog, Identity Linking; fulfilment and refund events in the order lifecycle); the /.well-known/ucp manifest. developers.google.com/merchant/ucp; ucp.dev

13. Google, Universal Cart, announced at I/O 2026 for US summer rollout in Search and Gemini.

14. Amazon v. Perplexity: federal injunction blocking the Comet browser agent from purchasing on Amazon, via PYMNTS.

15. NPCI–Razorpay, agentic UPI on Reserve Pay and UPI Circle: ChatGPT pilot from October 2025 and Claude pilot from February 2026, with Zomato, Swiggy, and Zepto; Razorpay announcement; Business Standard coverage.

16. Dilip Asbe (NPCI), Mumbai Tech Week 2026 interview: audit systems for agent instructions and user consent.

17. Open USD consortium stablecoin launch, 30 June 2026.

18. Mastercard, Agent Pay for Machines, 10 June 2026: credentialing via Verifiable Intent, permissioning, voucher-based transacting, guaranteed multi-rail settlement.

19. AWS, Bedrock AgentCore agent-payments preview, May 2026, with Coinbase and Stripe.

20. IMF, How Agentic AI Will Reshape Payments (Davidovic and Tourpe), April 2026.

21. Google, Agentic Resource Discovery specification, 17 June 2026.

22. OpenID Foundation, AuthZEN approval profile (deny-but-escalate), adopted May 2026.

23. Colorado Artificial Intelligence Act (SB24-205), reasonable-care standard for high-risk AI, effective 30 June 2026.

24. Reserve Bank of India, draft directions on AI in financial services, comment window to 24 July 2026 (draft ID 4479).

25. EU Product Liability Directive, Directive (EU) 2024/2853, national transposition due 9 December 2026.

26. Target, terms-of-service update treating AI-agent purchases as “transactions authorized by you,” via eMarketer.

The analytical framing is the author’s own.

Anivar Aravind is an Engineering Executive and System Thinker. The Layer 8 is a publication on the power, incentive, and governance layer of digital infrastructure. His structural framework on corrigibility is at anivar.net/corrigibility, with preprints on SSRN.

Earlier in the Layer 8 series

• Beyond Commerce: the SSL of the agent era, and the missing chargeback.

• Building the Signature Surface: the harness, the case file, the correction window.

• Exit Is the Primary Agentic Right: why standing authority regenerates, and what decay-by-default requires.