Agentic commerce is changing checkout, risk and merchant trust

At a glance

What this is: This is an analysis of how agentic commerce differs from traditional ecommerce, with the key finding that AI agents compress the shopping journey and create new risk, fraud and trust signals for merchants.

Why it matters: It matters because IAM-adjacent trust decisions now extend into delegated agent actions, requiring practitioners to think about identity, authorization and fraud together rather than as separate controls.

By the numbers:

• Agent-driven shopping will influence $1 trillion in new revenue in the U.S. retail market alone by 2030, according to McKinsey research.
• 47% of consumers are interested in using AI agents for commerce, according to Visa research.

👉 Read Signifyd's analysis of agentic commerce vs. traditional ecommerce

Context

Agentic commerce is the use of AI agents to carry out shopping tasks on a customer’s behalf. The change is not the introduction of a new channel so much as a shift in who executes discovery, comparison and checkout, which alters the trust model merchants rely on to separate legitimate activity from abuse.

For IAM and fraud practitioners, the important boundary is delegated authority. Once an agent can search, compare, add to cart and sometimes check out, identity questions move beyond the shopper account and into how intent, approval and transaction legitimacy are verified across the delegated flow.

Key questions

Q: How should merchants handle AI agents that place orders on behalf of shoppers?

A: Merchants should treat delegated AI shopping as a distinct trust model, not a normal bot session. The key is to verify shopper approval, record the agent’s allowed scope and preserve evidence that the order was genuinely authorised. That requires tighter transaction logging, clearer delegation boundaries and risk rules tuned for agent-led behaviour rather than purely human browsing patterns.

Q: What breaks when fraud systems are tuned only for human shopping behaviour?

A: Fraud systems that expect human cadence often misread legitimate AI agent activity as suspicious automation. That leads to false declines, unnecessary reviews and lost conversion. At the same time, malicious actors can mimic agent behaviour to hide abuse. The result is weaker detection on both sides unless teams add delegation-aware signals and approval evidence.

Q: Why do AI shopping agents complicate trust and authorization decisions?

A: Because the shopper is no longer the only actor executing the purchase flow. The agent can search, compare, build a cart and sometimes check out, so teams must confirm that the agent was authorised for that specific action. Trust now depends on both identity and delegation scope, not just payment legitimacy.

Q: How can teams reduce disputes in agent-led ecommerce without blocking good orders?

A: Teams should improve product data quality, make shipping and return policies machine-readable and preserve checkout confirmation evidence. Those controls help an agent choose the right item and give support teams enough context when a buyer later questions the order. The goal is fewer misfires and better proof of intent, not more friction.

Technical breakdown

How agentic commerce changes shopping flow and delegated authorization

Traditional ecommerce assumes a person is driving every interaction. Agentic commerce inserts an AI agent between the shopper and the merchant systems, with the agent executing steps such as search, comparison, cart building and, in some cases, checkout. That creates a delegated authorization model: the shopper grants permission, but the agent performs the work within policy limits such as spend caps or final approval gates. The technical issue is that the signal set changes. Behaviour that once looked like automation or bot activity may now represent legitimate delegated commerce, while malicious actors can try to impersonate that delegated pattern.

Practical implication: merchants need controls that distinguish legitimate delegated sessions from abuse without relying only on human-like browsing patterns.

Why fraud and risk signals get harder in AI agent commerce

Risk engines were built around human shopping cadence, device consistency and familiar checkout behaviour. Agent-led sessions can be much shorter, more deterministic and less human in appearance, which weakens rules tuned for consumer behaviour. At the same time, bad actors can train malicious automation to mimic agent flows, making the fraud problem bidirectional. A new class of risk appears when a delegated agent, its session or its credentials are taken over. In that case, the attacker does not need to steal the shopper account itself to place orders or manipulate purchase decisions.

Practical implication: risk teams should revisit velocity, bot and approval signals so delegated commerce does not get mistaken for hostile automation.

Why checkout integrity matters more when AI agents shorten the path to purchase

Agentic commerce compresses the funnel, so small gaps in product data, shipping rules or item descriptions have a larger effect on whether the transaction completes. If an agent cannot reliably parse variant names, availability, returns terms or delivery constraints, it will usually move to the next option rather than ask clarifying questions. That makes the merchant’s operational data part of the control surface. The problem is not just conversion loss. In a delegated flow, poor checkout clarity also creates more post-purchase confusion, more disputes and more questions about whether the final order reflected genuine shopper intent.

Practical implication: product, checkout and returns data must be clean enough for machines to parse without increasing false declines or buyer disputes.

Threat narrative

Attacker objective: The attacker seeks to place fraudulent orders or manipulate purchase outcomes while appearing to act under legitimate delegated authority.

1. Entry occurs when a legitimate shopper delegates shopping authority to an AI agent or when an attacker imitates that delegated session pattern.
2. Escalation happens if the agent, its credentials or its approval flow is hijacked, allowing purchases to proceed under authorised-looking conditions.
3. Impact is rapid-fire ordering, false approvals or disputed transactions that exploit the trust merchants place in delegated AI activity.

NHI Mgmt Group analysis

Delegated AI commerce creates an intent-verification gap, not just a bot problem. The merchant is no longer deciding only whether a session is human or automated. It must decide whether an AI agent is acting with legitimate shopper intent, which is a different governance question entirely. That distinction matters because fraud rules tuned to human behaviour can suppress valid delegated transactions while missing malicious agent impersonation.

Checkout friction becomes a security signal when AI agents compress the purchase path. In traditional ecommerce, small data quality issues are annoying. In agentic commerce, they become control failures because the agent may abandon a purchase rather than ask for clarification. That turns product data, shipping constraints and returns logic into part of the security and revenue control stack. Practitioners should treat machine-readable commerce data as operational trust infrastructure.

Agent-level takeover is the commerce analogue of delegated credential abuse. The article’s most important risk is not generic automation abuse, but the possibility that a trusted delegated system becomes the attack surface. That is a familiar identity pattern in a new domain: once an agent can act on behalf of a shopper, the question becomes who can bind, reuse or hijack that authority. The practical conclusion is that delegated access needs lifecycle control, not just transaction monitoring.

What merchants will need is decision confidence, not just fraud scoring. Fraud models alone cannot answer whether an order was genuinely approved, whether the agent was authorised for that action or whether the session behaved within expected delegation boundaries. That pushes commerce teams toward tighter linkage between identity proofing, approval evidence and risk assessment. The practitioner takeaway is to make intent proof part of the order record.

What this signals

Delegated commerce will force security teams to treat intent as a verifiable control, not an assumption. As AI agents become part of the purchase path, the business question changes from "was the customer logged in" to "was the action genuinely approved within the delegated scope." That is a governance shift with direct consequences for fraud, support, disputes and transaction confidence. The closest identity parallel is not traditional shopper authentication, but the control needed to manage delegated authority across a dynamic session.

Agent-led shopping exposes a new form of governance debt. Merchants that rely on static bot rules or broad fraud heuristics will find that those controls are too blunt for delegated AI activity. The programme implication is that commerce, identity and risk teams will need a shared view of authorisation evidence, not separate definitions of legitimacy. The organisations that adapt fastest will be the ones that can prove who approved what, rather than only scoring whether a session looked unusual. For the broader identity angle, the governance pattern mirrors other delegated access problems documented across AI agent security.

The operational signal is straightforward: if product data, checkout rules and approval evidence are not machine-readable, agentic commerce will convert that ambiguity into dropped orders, returns and disputes. That makes clean commerce metadata part of the control environment, not just a merchandising concern. Teams should expect risk tuning, customer support and identity governance to converge around the same workflow.

For practitioners

• Instrument delegated-order signals Add detection logic for agent-led shopping journeys, including atypical session length, rapid cart creation, repeated approvals and order patterns that differ from human browsing.
• Separate shopper identity from agent authority Model the shopper, the delegated agent and the approval event as distinct entities in fraud and access workflows so you can tell who authorised what and when.
• Tighten machine-readable product data Standardise titles, variants, materials, sizing, shipping rules and return terms so an AI agent can compare products without misclassifying inventory or dropping valid orders.
• Build approval evidence into order records Retain explicit evidence of shopper confirmation, agent delegation scope and checkout handoff details so disputes and reviews can be resolved without relying on inference.

Key takeaways

• Agentic commerce changes the trust model by moving shopping actions from the customer to a delegated AI agent.
• The main security challenge is proving intent and authority when order flows are shorter and less human-readable.
• Merchants need delegation-aware risk controls, cleaner product data and stronger approval evidence to avoid false declines and abuse.

Key terms

• Agentic Commerce: A shopping model where an AI agent performs retail tasks on a shopper’s behalf within defined permission boundaries. The shopper may still approve key steps, but the agent carries out the discovery, comparison and sometimes checkout work, which changes how merchants must verify intent and legitimacy.
• Delegated Authorization: Permission granted to one system or actor to act within a bounded scope for another. In agentic commerce, this means an AI agent can search, compare or purchase only within limits set by the shopper or merchant policy, making approval scope and evidence essential to trust.
• Agent-Level Takeover: A compromise pattern where an attacker hijacks the delegated AI agent or its credentials instead of the human account behind it. This can let the attacker place orders, alter choices or abuse trust flows while appearing to operate under legitimate authorization.
• Intent Verification: The process of proving that an action was truly approved by the intended person or policy, not merely executed by a logged-in session. For delegated shopping, intent verification bridges identity, authorization and transaction evidence so merchants can distinguish valid agent activity from fraud.

What's in the full article

Signifyd's full article covers the operational detail this post intentionally leaves for the source:

• A side-by-side walkthrough of the traditional versus agentic shopping flow with concrete user actions and handoff points.
• The detailed 7-point comparison table that maps risk, checkout and discovery differences across both models.
• Practical examples of how AI-assisted checkout behaves in live purchase scenarios and where the handoff still falls back to the shopper.
• Merchant preparation steps covering product data, checkout friction, fraud tuning and post-purchase handling.

👉 Signifyd's full post breaks down the shopping flow, fraud implications and merchant prep steps in more detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle and secrets management through a practitioner-focused lens. It helps security teams connect delegated access patterns to identity controls across modern systems.