An age-old question for the AI era: Can I see some ID?

Autonomous agents are offering to take the grind out of shopping by scouring the web to find the best deals, making purchases and organizing deliveries without bothering users for their login details and payment authorization.

The promise of a personal butler might still be in its infancy, but AI giants are rushing to launch their own visions of agentic commerce, and forecasts show that one in 10 people are likely to be delegating their shopping to agents by 2030. According to McKinsey research, revenue from global agentic commerce could reach $5 trillion by the end of the decade.

Yet before consumers hand their thoughts, tastes and personal data over to AI agents, they need to be sure these agents will do precisely as they’ve been instructed. And merchants need to know these agents are legitimate.

“Trust is foundational to every digital transaction, and when an AI agent is operating on your behalf, that trust becomes even more critical,” says Dennis Gamiello, Mastercard’s executive vice president and global head of Identity.

That trust starts with identity: knowing who an agent is and who it is acting for. Is it a trusted agent buying sneakers or a malicious one trying to break into their website? Do they know enough about the human behind the agent to determine whether the transaction is aboveboard? As has long been the case, merchants depend on this kind of transparency to effectively analyze the potential risk involved and crack down on costly fraudulent payments.

Unleashing the full potential of agentic commerce will require evolving digital security and boosting the intelligence surrounding transactions to make it easier to weed out payment fraud and protect both consumers and retailers.

To this end, Mastercard is deepening the capabilities of Agent Pay, the agentic commerce platform it launched last year, which gives agents verified credentials, tokenized payment information, spending controls and proof of user consent to ensure that agent-led retail transactions are smooth and secure.

Now Mastercard is adding identity, fraud and behavioral insights into the platform and giving issuers a probability score that helps them judge whether a legitimate AI agent is scouring their site. The score is a key piece of information that a retailer may combine with intelligence on both the agent and the human behind the transaction as it considers whether to let a purchase go ahead.

This broader foundation, called the Mastercard Agent Pay Trust Framework, combines identity with proof of intent, controls that define an agent’s authority, and secure transaction execution, as well as intelligence that helps keep pace with emerging risks — and lays the groundwork for agent-led transactions to become as everyday as tap to pay.

“Merchants are very excited about the space, and they’re already seeing a lot of agentic traffic coming to their websites. They know it’s potentially revenue-generating traffic, but they don’t know who’s the user behind it,” says Amir Sarhangi, CEO and co-founder of Skyfire, which is helping to build the identity infrastructure to make agentic commerce happen, including identifying AI agents and customers.

“Trust is the number one thing that’s holding them back from being able to scale in the space.”

Skyfire, which recently joined the inaugural Agentic Commerce & Services cohort of Start Path, Mastercard’s startup engagement program, is already working alongside the company to extend its Know Your Agent technology into Agent Pay, giving financial institutions and merchants a trusted way to recognize and verify agents.

Sarhangi explains that the idea for KYA arose from conversations with developers and web security companies about the issues both sides face when agents try to access websites and transact.

Up until now, merchants designed their websites for humans with security systems that would cast out malicious agents. “Bots were traditionally dangerous actors,” explains Sarhangi. “Now we have ‘good bots,’ but they do not have the passports they need to get in.”

Skyfire works behind the scenes to create a KYA token that verifies who the agent is and who it is acting for, and can pair it with tokenized payment information for the amount the agent is authorized to spend. When the agent arrives at a website to buy a pair of sneakers, it can simply present the KYA token to purchase the shoes and send them to the user’s address.

In addition, by including information on the person behind an agent-led purchase, it ensures that merchants are not cut out of the e-commerce chain and remain connected to their customers and their shopping habits, Sarhangi says.

Because KYA is recognized by the security and fraud tools merchants already rely on, many can start accepting trusted agents without rebuilding their websites, he adds.

Increasingly, harnessing solutions such as KYA is helping extend the span of agent-led transactions and adding layers of security to improve trust and transparency at decision points throughout the agentic chain.

By contributing to the multilayered intelligence and tools retailers need to make decisions along the transaction trail, these capabilities encourage them to start opening the doors to agent-led purchases.

“There’s a lot of belief in the potential of agentic commerce,” Gamiello says. “We think it will start to grow exponentially as that trust starts to become inherent.”