Agentic commerce is commerce in which an AI agent, acting for a buyer, completes the transaction itself. Not a chatbot that recommends a product and hands you to a checkout page. An agent that selects, authorises payment, and buys, while the human sets the intent and the limits. That single shift, from software that advises to software that transacts, is what separates agentic commerce from twenty years of ecommerce personalisation, and it is why every payment network and commerce platform spent 2026 shipping protocols for it.
The term is used loosely, and most definitions on the web are written to sell something. This piece sets out a working definition, the five protocols competing to become the plumbing, and the honest state of the evidence, including which widely-quoted numbers are worth nothing.
What Makes Commerce "Agentic"
Three conditions have to hold. Remove any one and you have ordinary automation.
The agent acts with delegated authority. The buyer grants scope in advance, such as a budget, a merchant set, or a category, and the agent operates inside it without asking again per purchase. This is the legal and practical core: someone must be able to say what the agent was permitted to do.
The agent transacts machine-to-machine. No human fills a form. The agent reads product data, negotiates or accepts terms, and presents payment credentials through an interface built for software, not for eyes.
The merchant can tell it is an agent, and treats it accordingly. This is the condition most commentary skips. A site that cannot distinguish an authorised buying agent from a scraper will either block legitimate revenue or accept fraud. Agent identity is not a nice-to-have layer on top; it is a precondition for the other two.
Agentic commerce is therefore best understood as an identity and authorisation problem wearing a shopping-cart costume. The retail experience is the visible part. The hard part is proving who the agent is, what it was allowed to do, and who is liable when it does something else.
The Five Protocols, and Who Controls Each
Five specifications now claim some part of the stack. They are not straightforwardly competitors: some cover discovery and checkout, others cover payment authorisation, and one covers machine-to-machine settlement at the HTTP layer. Governance matters as much as the specification, because a protocol controlled by one company is a dependency, and a protocol under a neutral foundation is infrastructure.
| Protocol | Origin | Layer it covers | Governance as of August 2026 |
|---|---|---|---|
| ACP (Agentic Commerce Protocol) | OpenAI and Stripe | Product discovery and agent checkout | Company-led, published as an open spec |
| AP2 (Agent Payments Protocol) | Payment authorisation via signed mandates | Google-led, multi-partner | |
| UCP (Universal Commerce Protocol) | Google and partners | End-to-end journey: discovery, purchase, post-purchase | Open standard with a technical council |
| MPP (Machine Payments Protocol) | Stripe | Machine-to-machine payment for API and compute usage | Stripe-led |
| x402 | Originally Coinbase | HTTP-native payments using the dormant 402 status code | Linux Foundation, transferred July 2026 |
The x402 transfer is the one structural change worth watching. On 14 July 2026 the Linux Foundation announced the operational launch of the x402 Foundation, with Coinbase formally handing over the protocol and forty organisations joining as members. The premier roster includes Visa, Mastercard, American Express, Stripe, Adyen, Fiserv, Google, Amazon Web Services, Cloudflare, Circle, Ripple and Shopify. When every major card network and processor sits inside the same neutral body, that body is no longer an experiment.
AP2 is worth understanding in detail because it addresses the authority problem directly. Announced by Google in September 2025 with more than sixty launch partners including Mastercard, PayPal, Coinbase and American Express, it carries three signed mandates as W3C Verifiable Credentials: an Intent mandate, in which the user authorises the agent to shop; a Cart mandate, in which the agent confirms exactly what it is buying; and a Payment mandate presented at settlement.
That design answers the liability question more directly than most coverage acknowledges. Each mandate is cryptographically signed and passed between parties as a verifiable object, which produces a non-repudiable audit trail for every transaction. If an agent buys the wrong thing, the dispute is settled by reading the chain of mandates to establish whether the agent exceeded its granted scope, rather than by argument between merchant, issuer and customer. Whether that record is legally sufficient in any given jurisdiction is untested, and merchants should not assume a signed mandate transfers liability to the buyer. The protocol makes the evidence available; it does not settle who is responsible.
UCP is the broadest of the five. Google describes it in its January 2026 commerce announcement as an open standard covering the entire shopping journey, from discovery and buying through to post-purchase support, and compatible with the existing A2A and MCP agent protocols.
The Numbers Worth Quoting, and the Ones That Are Not
Search "agentic commerce market size" and you will find forecasts. Treat almost all of them as noise. For 2026 alone, published estimates include $7.7 billion (Grand View Research), $60.43 billion (Mordor Intelligence), and a trajectory starting at $547 million (SANBI). These are not refinements of one another. They disagree by two orders of magnitude for the same calendar year, which means they are measuring different things under the same label, and none of them is measuring transactions completed by agents.
A forecast that spans two orders of magnitude is not a forecast. It is a definition dispute with a dollar sign attached. Any article, vendor deck or strategy memo that leads with one of these figures and does not name the definition behind it is telling you nothing.
The numbers that are worth something come from platforms measuring their own traffic, because they are counting observed events rather than projecting a category.
Adobe Analytics, drawing on its own platform data from US retailers, reported in its Q2 2026 AI Traffic Report that AI-referred traffic to US retail sites grew 393% year over year in the first quarter of 2026, and that by March 2026 this traffic converted 42% better than non-AI sources, having converted worse than non-AI traffic a year earlier (analysis via Search Engine Journal). Adobe also reports revenue per visit 37% higher, time on site up 48%, and pages per visit up 13%.
Two caveats belong with those figures. They are Adobe's own platform data, covering retailers running on Adobe, not an independent census. And Adobe published the report alongside a product it sells to fix the visibility problem the report describes. The numbers are the best available on this question and the direction is almost certainly right; the vendor interest is real and should be stated rather than laundered.
Note what that data does and does not say. It measures humans arriving at retail sites from AI assistants. It does not measure agents completing purchases autonomously. The honest position in August 2026 is that assisted discovery is measurable and growing fast, while fully autonomous agent purchasing remains largely pre-revenue. Anyone claiming otherwise should be asked for their instrument.
What Merchants Actually Have To Change
The infrastructure question is not "which protocol do we adopt". Most merchants will end up supporting several, through their platform, without writing protocol code. The question is whether the store is legible to software at all.
Product data becomes the constraint. An agent comparing three products cannot infer from a photograph. It needs accurate stock counts, current pricing, materials, dimensions, delivery windows and return terms as structured data. Catalogues that were merely adequate for human browsing, where the size chart is an image and the fabric composition sits in a PDF, are invisible to an agent. Adobe's own framing of its Q1 data was that retail sites are lagging precisely because they are not machine-readable.
Agent identity has to be handled deliberately. Blocking all non-human traffic is now a revenue decision, not a security default. Visa's Agent Score and agentic directory work, and the Know Your Agent frameworks emerging alongside, exist because merchants need a way to distinguish an authorised buying agent from a hostile bot.
Checkout has to survive without a human. Every step that assumes eyes on a screen, such as an interstitial upsell, a cookie banner blocking the flow, or a CAPTCHA, is a point where an agent transaction fails silently.
Agentic Commerce Versus Adjacent Terms
The vocabulary is muddled, and precision here is genuinely useful.
- Agentic commerce is the transaction layer: an agent buys.
- Agentic payments is the settlement layer beneath it: how value moves and who is liable when an agent authorises a charge.
- Conversational commerce is the previous generation: a human buys through a chat interface. The human is still the buyer.
- Agentic marketing is the demand side: agents planning and running campaigns rather than executing purchases.
The distinction between the first two matters commercially, because they are being solved by different companies with different incentives. Commerce platforms are building discovery and checkout. Card networks, processors and banks are building authorisation and settlement. These two groups are not collaborating toward one stack; they are each trying to own the layer that sets the rules. A merchant needs both halves, they are unlikely to arrive from the same vendor, and the integration gap between them is where the cost lands. Plan for fragmentation rather than for a winner.
Where This Goes Next
The protocol layer will consolidate, and the x402 transfer to the Linux Foundation is the template for how. Standards that stay under single-company control become dependencies that competitors route around; standards that move to neutral governance attract the whole industry, as the forty-member roster shows.
The measurement layer is further behind than the protocol layer. There is currently no widely accepted public metric for "transactions completed by an agent", which is why the market-size forecasts diverge so wildly. Expect that to be the next thing the industry builds, and expect the first credible number to be considerably smaller than the forecasts imply.
For merchants, none of this argues for waiting. The work that pays off regardless of which protocol wins, namely structured product data, a deliberate agent-identity policy, and a checkout that does not assume a human, is the same work in every scenario.
