AI Agents Are Becoming Your Customers: What Agentic Commerce Means for Builders

Agentic commerce means an AI agent holds delegated authority to complete a purchase on your behalf, not just recommend one. The mechanism that makes this possible is the cryptographically signed "mandate": a digital record that proves a human authorised an agent to spend up to a set amount, on specific terms, without that human approving every individual transaction. This is a meaningful step past the recommendation engines and shopping assistants you already know. A chatbot that suggests three products for you to buy yourself is not agentic commerce. An agent that holds your payment credentials, checks a mandate's terms, and completes the purchase itself is. The practical consequence for anyone building software: your customer might no longer be a person clicking "buy." It might be a piece of software acting on a person's signed authority, and your checkout, your API, and your fraud checks all need a way to tell the difference between that and a stolen credential.

Google's Agent Payments Protocol (AP2), announced 16 September 2025, is the largest of several competing standards for how an AI agent proves it has authority to spend. AP2 launched with more than 60 partners including Mastercard, PayPal, Coinbase, Salesforce, and Etsy, and had grown past 100 partners by October 2025. It works by having the human sign a mandate cryptographically, which the agent then presents to a merchant as proof of intent rather than as a raw credential. AP2 is not the only option. OpenAI and Stripe have their own Agentic Commerce Protocol (ACP), aimed at letting agents complete purchases inside chat interfaces. Coinbase's x402 takes a different route entirely, built around instant stablecoin micropayments rather than mandate verification (more on that below). Visa and Mastercard have each announced their own agent-facing standards too: Visa's Trusted Agent Protocol and Mastercard's Agent Pay. None of these have consolidated into a single standard yet. If you are building anything that might need to accept agent-initiated payments, treat this the way you'd treat any early-stage protocol war: build the payment logic behind an interface you can swap, and don't hard-wire your checkout to one vendor's mandate format.

Yes, and two live mechanisms already do this: Coinbase's x402 and Cloudflare's Pay Per Crawl. This is worth spelling out because it is the exact question a 13Labs buildDay registrant asked us directly: a way to make AI agents pay for content, given how much of the internet's traffic is now AI agents rather than people. x402, launched by Coinbase in May 2025, revives the long-dormant HTTP 402 "Payment Required" status code. When an agent requests a page or API endpoint gated behind x402, the server returns a 402 response with payment terms attached, and the agent settles it instantly in stablecoin. There is no account to create and no API key to issue. It is a machine-to-machine micropayment, handled inline with the request. Cloudflare's Pay Per Crawl works from the publisher's side of the same problem. It entered private beta on 1 July 2025 and lets site owners charge AI crawlers per page fetched instead of blocking them outright. Cloudflare has announced it will move to default-blocking AI crawlers on ad-supported pages from 15 September 2026 unless a payment or crawl agreement is in place, which will push more publishers toward pay-per-crawl style arrangements rather than an outright block. For builders, this means the old choice between "let crawlers scrape everything for free" and "block them entirely" is no longer the full menu. There is now a metered middle option, and it is live, not theoretical.

Gartner projects that AI agents will intermediate USD 15 trillion (roughly AUD 23 trillion) of B2B purchases by 2028 (Gartner, November 2025). That is a B2B procurement figure, not a consumer retail one, and it describes agents sitting in the purchasing workflow rather than agents making every decision unsupervised. The same research house is also the source of the most useful counterweight to that number. In a separate report from 25 June 2025, Gartner predicted that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear business value, and inadequate risk controls as the main causes. Both numbers came from Gartner, and both are worth holding at once. The direction of travel toward agents handling more purchasing is real and well-funded. The rate of failed pilots inside that same trend is also real. If you are building for agent customers, plan for the market described by the first stat while budgeting for the churn described by the second: this is early infrastructure, not a settled category.

Agentic security is the practice of protecting a system where an AI agent, not a person, holds standing authority to act, and the OWASP GenAI Security Project's Top 10 for Agentic Applications (published 9 December 2025) is the clearest map of what can go wrong. Two categories matter most for anyone touching payments: ASI01, Agent Goal Hijack, where an attacker manipulates what the agent believes it is trying to achieve, and ASI03, Identity and Privilege Abuse, where an agent's credentials or permissions get used beyond their intended scope. The OWASP GenAI Security Project has said its Top 10 for Agentic Applications was built from observed real-world incidents rather than theoretical risk, which is a meaningful distinction: this is a list of things that have already happened to production systems, not a hypothetical threat model. The scale of the problem is growing quickly. Unit 42, Palo Alto Networks' threat intelligence arm, reported a 32% rise in malicious prompt-injection payloads targeting agent purchases between November 2025 and February 2026 (Unit 42, 3 March 2026). Some of the payloads Unit 42 documented hid full PayPal transaction specifications inside content an agent was reading, redirecting a legitimate purchase to an attacker's account without the agent (or the human behind it) noticing anything unusual. As Callum Holt, Founder of 13Labs, puts it: "The interesting shift isn't that agents can browse for you. It's that they can now hold a mandate to spend your money without you in the loop. That changes the security model completely. You're not authenticating a person anymore, you're authenticating a delegated authority with a spending cap."

Australia's first fully authenticated agentic transaction has already happened: an AI agent bought Event Cinemas tickets using a Commonwealth Bank debit card over Mastercard's Agent Pay rail, processed by Melbourne payment-tech firm IPSI (reported by Mi3, 28 January 2026). This puts agentic commerce infrastructure inside an Australian bank and an Australian payment processor, not just in overseas pilot programs. The regulatory picture is still open. The Reserve Bank of Australia's Review of Payments System Regulation Issues Paper (June 2026) explicitly discusses AI agents acting in e-commerce, but it raises questions rather than settling them: who is liable when an agent's mandate is exploited, how existing consumer protections apply when no human clicked "confirm," and where agent-initiated payments sit within the current licensing regime. That combination (a working transaction alongside an open regulatory review) is the honest state of play. Agent payments are technically live in Australia. The rules governing who bears the risk when they go wrong are still being written.

Treat AI agents as a new customer segment with their own authentication model, not as a variant of your existing human users. Three things to put in place now, before the volume of agent traffic forces the issue. - Set spending caps at the mandate level, not just the account level. A compromised or misdirected agent should hit a hard ceiling well before it can do meaningful damage, regardless of what the linked account normally allows. - Verify identity and authority separately. Knowing which agent is making a request is not the same as knowing it still holds valid authority to spend. Check both, every time, rather than trusting a session that authenticated once. - Log everything an agent does with enough detail to reconstruct a dispute. When something goes wrong (and per Unit 42's data, prompt-injection attempts against agent purchases are rising) you need a record that shows what the agent was told to do versus what it actually did. None of this requires ripping out your existing checkout or API. It requires treating "the requester is an autonomous agent with delegated authority" as a condition your system can detect and handle differently to a normal logged-in user. If you're building software that might need to handle agent traffic, agent payments, or the security model that comes with both, 13Labs can help you work out what actually needs building now versus what can wait.

Can I actually charge AI agents to access my content or API? Yes. Coinbase's x402 (launched May 2025) revives the HTTP 402 status code for instant stablecoin micropayments with no account or API key needed. Cloudflare's Pay Per Crawl, in private beta since 1 July 2025, lets publishers charge AI crawlers per page instead of blocking them, and Cloudflare moves to default-blocking ad-supported pages from AI crawlers on 15 September 2026 unless a payment arrangement exists. What's the difference between AP2, ACP, and x402? AP2 (Google, launched 16 September 2025) uses cryptographically signed mandates to prove a human authorised an agent's spending. ACP (OpenAI and Stripe) focuses on completing purchases inside chat interfaces. x402 (Coinbase) skips mandates entirely and settles instant stablecoin micropayments per request. None has become the single standard yet. Is agentic commerce live in Australia yet, or still experimental? Both, at once. A real transaction has happened (an AI agent buying Event Cinemas tickets via a CBA debit card on Mastercard Agent Pay, processed by Melbourne firm IPSI, reported January 2026), but the Reserve Bank's June 2026 Issues Paper raises open questions about liability and consumer protection that are not yet resolved. What is "agentic security" and how is it different from normal API security? Agentic security protects systems where an AI agent holds standing authority to act, not just a session token. OWASP's Top 10 for Agentic Applications (December 2025) flags goal hijacking and identity or privilege abuse as the top risks, both built from observed incidents rather than theory. Unit 42 documented a 32% rise in prompt-injection attacks targeting agent purchases between November 2025 and February 2026. Do I need to support agent payments now, or is this premature for most builders? For most builders, not yet, but the groundwork is worth doing now. Gartner projects agents will intermediate USD 15 trillion (roughly AUD 23 trillion) in B2B purchases by 2028, but also predicts more than 40% of agentic AI projects will be cancelled by end-2027. Build with spending caps and identity verification in mind so you're not retrofitting security once agent traffic actually arrives at your door.