The agent is the buyer
A friend showed me a demo last month. Their AI assistant — an agent running on top of Claude with access to a few tools — was asked to book a hotel in Lisbon for a work trip. Over the next ninety seconds the agent searched three travel sites, compared prices, identified the best option within the principal's pre-set budget, completed the booking, and paid using a virtual card linked to a stablecoin treasury account. Then it submitted an expense report and notified the principal it was done.
The protagonist of that transaction wasn't my friend. It was the agent. My friend never typed a credit card number, never clicked a checkout button, never authenticated a 3DS challenge. The agent did all of it, within constraints my friend had set in advance.
This is what agentic commerce actually looks like in practice. It's happening now in small, contained scenarios. The infrastructure to make it work at scale is being built right now, by a handful of companies whose names you've heard and a few you haven't.
This is the map of that infrastructure.
Why the existing payments stack doesn't work for AI agents
The modern payments stack was built for humans. Card-present transactions assume a person holding a physical card. Card-not-present transactions assume a person typing numbers into a checkout form. Fraud detection assumes a person whose behavior follows recognizable human patterns — they don't make 200 transactions in five seconds, they don't shop in three countries simultaneously, they don't change devices every thirty minutes.
AI agents break every one of these assumptions. They transact programmatically, at machine speed, from cloud infrastructure, on behalf of principals who may not be present at the moment of the transaction. The existing fraud systems will flag every legitimate agentic transaction as suspicious and approve every fraudulent one because the fraud patterns don't apply.
The agentic commerce stack isn't a new feature on the existing payments stack. It's a parallel system being built next to it, with different primitives at every layer.
The five layers of the agentic commerce stack
1. Identity and authentication
The first problem: how does the agent prove who it is and who it represents? When my friend's agent books a hotel, the merchant needs to know that this isn't a random script — it's an agent legitimately authorized to spend on my friend's behalf, up to a specific limit, for a specific purpose.
This is the layer Stripe is investing in heavily. The 2025 annual letter described tools for agents to authenticate with verifiable credentials issued by their principals. Visa has launched Visa Direct extensions specifically for agent transactions. New standards are emerging — including proposals for cryptographically signed agent identities that work across merchants and platforms.
Status: early but accelerating. Standards are still being negotiated.
2. Spending controls
Once an agent can authenticate, principals need fine-grained control over what the agent can spend. Not just dollar limits, but category restrictions, merchant whitelists, time windows, approval workflows for transactions above certain thresholds.
The closest existing analog is corporate card platforms. Brex, Ramp, and Mercury have spent years building spending controls for human employees. Those same primitives — with significant modification — are being adapted for AI agents. Stripe Issuing is being used to create virtual cards scoped to specific agents with specific limits.
Status: ahead of the other layers, because corporate cards already solved most of the conceptual problems.
3. Payment rails
What do agents actually transact on? Cards work but introduce friction at every layer — fraud rules, interchange, dispute mechanisms designed for humans. Stablecoins solve much of this for the right use cases — programmatic, instant, low-fee, cross-border. Real-time payment systems like FedNow and UPI are also natural rails for agents because they're already designed for machine-speed settlement.
The likely answer is multi-rail. Agents will use cards for traditional merchants, stablecoins for B2B transactions and cross-border, and instant payment systems for domestic peer-to-peer.
Status: stablecoin agentic transactions are growing fastest. Cards still dominate by total volume.
The agentic commerce stack isn't a new feature on the existing payments stack. It's a parallel system being built next to it.
4. Merchant acceptance
This is the hardest unsolved layer. When an agent shows up to buy something, how does the merchant know it's a legitimate agent and not a sophisticated bot trying to scrape pricing or commit fraud? How does the merchant handle returns, refunds, and disputes when there's no human on the buyer side?
Most merchants today have no way to distinguish agent traffic from human traffic, let alone authorized agent traffic from unauthorized. They either block everything that looks non-human (and lose legitimate agent business) or accept everything (and become fraud targets).
Solving this requires merchant-side infrastructure that doesn't fully exist yet. Cloudflare, Stripe, and emerging companies are building merchant tools that can verify agent identity, set agent-specific terms of service, and reconcile agent transactions differently from human ones.
Status: significant gap. The biggest opportunity in the stack.
5. Dispute and reconciliation
The last layer is the one nobody talks about: what happens when an agent buys the wrong thing? A human buying the wrong sweater can return it. An agent that books a hotel on the wrong date, in the wrong city, for the wrong number of nights — who handles that?
The legal questions are not solved. Is the principal liable for agent errors? The agent's developer? The merchant who accepted the transaction? Existing consumer protection law assumes humans on both sides of every transaction.
Status: largely unbuilt. Companies operating in early agentic commerce are handling disputes case-by-case rather than through systematic infrastructure.
The companies to watch
Stripe is positioning as the platform layer — identity, spending controls, payment rails for agents. Visa and Mastercard are extending their networks to support agent transactions. Brex and Ramp are extending corporate card primitives to AI agents. Circle and the broader stablecoin ecosystem are building the rails for high-volume programmatic transactions. Cloudflare is building merchant-side identity verification.
On the AI side: Anthropic, OpenAI, Adept, and a handful of agent platform companies are building the agents themselves with native commerce capabilities. Most existing AI assistants can't transact today. The ones that can will define the category.
What to do about it
Three concrete actions depending on what you're building:
If you're building AI products — assume your agents will need to transact within 24 months. Start integrating payments primitives now, even if your initial use cases don't require them. The companies whose AI products can already pay for things in 2026 will have a structural advantage.
If you're building payments — the biggest unmet need is merchant-side infrastructure for agent identity verification and dispute handling. Existing payment companies are building agent-side tools. Merchant-side is wide open.
If you're just trying to understand the space — track Stripe's agentic commerce announcements, watch what Visa and Mastercard ship over the next year, and pay attention to stablecoin transaction volume in B2B use cases. Those three signals will tell you when this market is real at scale.
The takeaway
Agentic commerce is real, not hype. The infrastructure is being built layer by layer right now. The companies that ship the missing pieces — particularly on the merchant side and in dispute handling — will capture significant value in the next decade.
The Stripe letter was the headline. This is the system underneath it. The founders who pay attention to the layers being built now will be the ones building on top of them in 2027.
Want to understand the financial mechanics behind AI commerce? Try the Agentic Commerce and Stablecoins topic packs on Gargiulo — ten scenarios across both, grounded in current market data. Sterling has notes.
Sources: Stripe Annual Letter 2025, Visa Direct documentation, public statements from Anthropic, Brex, Ramp, Circle, and Cloudflare.