Identity and Authorization Gaps Threaten Agentic Commerce Scale
AI-generated image · Bay Street Wire
Mastercard's recent Canadian pilot highlights the critical need for verifiable intent and trust frameworks to prevent automated checkout from becoming a liability.
The shift from AI agents recommending products to executing purchases requires a foundational layer of trust to scale, according to reporting from BetaKit. A Mastercard report estimates that by 2030, over 10% of online shoppers will routinely utilize agents for shopping and payment.
For merchants and financial institutions, the primary challenge is the identity and authorization gap. Amisha Parikh, vice-president of security solutions at Mastercard, Canada, told BetaKit that transactions must be "human-led, agent-executed," meaning the human sets the budget and guardrails while the agent executes. Without verifiable intent, businesses face risks such as "prompt injection" attacks—where agents are redirected by malicious instructions—or fraudulent merchants designing scams to lure AI agents.
To address these liabilities, Mastercard recently completed its first Canadian transaction using its Agent Pay service, collaborating with credit card issuer Rogers Bank and AI company Flybits. The pilot aimed to verify that the agent was legitimate, possessed the necessary permissions, and adhered to the consumer's authorized spending amount.
Parikh noted that existing fraud controls must evolve to distinguish authorized AI agents from malicious bots. Mastercard is utilizing its Agent Pay Trust Framework to synthesize data on identity, behavioral patterns, and customer intent. This allows banks and retailers to determine who an agent represents and whether the merchant is trustworthy, reducing friction while maintaining security.