TL;DR: Agentic commerce shifts buying, negotiation, and payment from human users to AI agents, making verified, privacy-preserving, interoperable identity the control plane for trust, payments, and customer experience, according to OneSpan. Passwordless access, machine-readable catalogues, and agent delegation controls become necessary because shared credentials and CAPTCHA do not scale to agent-to-agent commerce.
At a glance
What this is: This is an analysis of how agentic commerce shifts trust, payments and identity verification from human-centered checkout flows to agent-mediated transactions.
Why it matters: It matters because IAM, fraud, and customer-identity teams will have to govern delegated agent actions, not just human logins, if commerce is to remain secure and usable.
Context
Agentic commerce changes the identity problem by moving purchase decisions, payment authorization and fulfillment into agent-mediated flows. In that model, the control point is no longer only the customer login. It becomes the identity assertions, delegation rights and trust signals that accompany the agent across merchants and assistants.
The article’s core claim is that existing human-first controls do not scale cleanly to agent-to-agent commerce. Passwords, shared accounts and CAPTCHA are weak fits when the buyer may be a software agent acting under defined guardrails, so identity has to become portable, verifiable and privacy-preserving across the transaction chain.
Key questions
Q: What breaks when merchants rely on shared credentials for agentic commerce?
A: Shared credentials destroy provenance and make delegation unverifiable. A merchant cannot tell whether the credential belongs to a person, a benign assistant or an overreaching agent, which undermines accountability and consent. In agentic commerce, the control has to shift to verifiable delegation and scoped authority instead of reusable secrets.
Q: Why do agent-mediated payments require privacy-preserving identity verification?
A: Because the merchant needs assurance without collecting unnecessary personal data. Agentic commerce works only if the relying party can verify authority, issuer trust and transaction scope while limiting exposure of sensitive customer attributes. That balance supports usability, fraud reduction and cross-platform interoperability at machine speed.
Q: How should teams design for machine-readable trust in commerce flows?
A: Treat catalogue data, terms, identity assertions and policy statements as consumable inputs for software agents. If those signals are not structured and authenticated, the agent cannot reliably shortlist, compare or act, and humans are forced back into manual checks that defeat the whole model.
Q: What is the difference between passkeys and delegated agent credentials in commerce?
A: Passkeys verify a human or device at login, while delegated agent credentials prove what a software agent is allowed to do after login. Both reduce reliance on passwords, but only delegated credentials express transaction scope, issuer confidence and ongoing authority for autonomous purchasing workflows.
Technical breakdown
Why agentic commerce breaks human-first identity controls
Agentic commerce is commerce in which software agents can compare offers, negotiate, initiate payment and coordinate delivery on behalf of a user. That changes the authentication problem because the relying party is no longer only trying to identify a person at login. It must decide whether an agent is legitimately delegated, what scope that delegation covers, and whether the credential presented can be trusted across systems. Human friction controls such as repeated logins, shared passwords and interactive CAPTCHA do not answer those questions well when transactions happen at machine speed.
Practical implication: model agent access as delegated authority, not as a proxy for a human session.
FIDO, passkeys and verified credentials in agent-mediated transactions
The article frames passkeys and FIDO as the bridge from human login to machine-verifiable trust. In practice, the important detail is not just password replacement. It is the cryptographic binding of an authenticator to an identity assertion that can be evaluated by the relying party. For agentic commerce, the next step is portable credentials that carry issuer attributes and can be presented by either a human or an agent. That is how merchants can verify claims without forcing users back into password sharing or brittle fallback flows.
Practical implication: extend passwordless design into verifiable credentials and delegation-aware authentication flows.
Machine-readable catalogues and trust signals for agents
The article also shifts attention from customer identity to merchant readability. If agents are making shortlist and purchase decisions, merchants need catalogues, terms and claims that software can parse, compare and trust. That means machine-readable product data, authenticated merchant assertions and transparent policy signals become part of the identity plane. This is not just search optimization. It is the trust fabric that determines whether an agent can safely act on behalf of a buyer without manual intervention at every step.
Practical implication: publish machine-readable offers and authenticated claims that agent systems can evaluate automatically.
NHI Mgmt Group analysis
Agentic commerce turns identity into the control plane for buying. The article is right to treat identity as infrastructure rather than a back-office control. Once agents can negotiate and transact, the trust question moves from who logged in to what authority the agent carries, how far that authority extends and whether the merchant can validate it. Practitioners should read this as a delegation-governance problem, not a checkout UX problem.
Shared credentials are an identity anti-pattern in agent-to-agent commerce. The convenience logic that tolerated password sharing in legacy automations does not survive delegated purchasing. Shared credentials erase provenance, blur accountability and make consent unverifiable, which is exactly the opposite of what merchant trust requires. The practical conclusion is that commerce systems need identity assertions that survive handoff without becoming reusable secrets.
Identity verification in commerce is becoming interoperability work. The article’s emphasis on standards is important because agentic commerce fails if every participant invents a closed trust format. Verified credentials, delegation APIs and privacy-preserving attestations are becoming the minimum viable interoperability layer for payments and customer trust. For identity teams, this signals that the programme boundary is expanding beyond IAM into merchant acceptance logic and transaction policy.
Verified, privacy-preserving delegation is the new fraud boundary. Fraud controls built around detecting human misuse will not be enough when an agent is acting within user-defined guardrails. The category needs controls that verify intent, scope and issuer trust without exposing unnecessary personal data. That means practitioners should treat consent, delegation and claim verification as core security design inputs, not legal afterthoughts.
Machine-readable trust signals will separate commerce that scales from commerce that stalls. Agentic systems need more than a login they can complete. They need merchant data, policy and proof that can be consumed by software at decision time. The organisations that make claims machine-verifiable will be easier for agents to use, while those that leave trust signals human-only will create friction and drop out of agent-driven buying paths.
What this signals
Delegation scope becomes the new boundary: agentic commerce will force identity teams to separate authentication from transaction authority. If the same credential can both log in and spend, merchants lose the ability to reason about consent, revocation and liability in a machine-to-machine flow.
The next governance gap is not whether an agent can authenticate, but whether its claims can travel across merchants without turning into reusable secrets. That pushes programmes toward verifiable credentials, policy-aware delegation and machine-readable trust signals that software can consume directly.
For practitioners
- Define delegated agent authority Map which purchase, payment and fulfilment actions an agent may perform without human re-approval, then tie each action to a separate delegation scope instead of a shared customer session.
- Replace shared credentials with verifiable credentials Stop treating agent access as a password-sharing problem. Use cryptographically verifiable credentials that carry issuer attributes and can be checked by the relying merchant or platform.
- Publish machine-readable commerce signals Expose catalogues, terms and policy signals in a format software agents can parse so that shortlist, compare and purchase flows do not depend on brittle screen scraping or manual review.
- Design for privacy-preserving verification Minimise the personal data an agent must reveal while still proving that the actor is authorised, bound by guardrails and trustworthy for the transaction context.
Key takeaways
- Agentic commerce shifts the security problem from user login to delegated transaction authority.
- The article links that shift to fraud pressure, with ecommerce losses projected to reach about 44 billion dollars in 2024 and more than 100 billion dollars by 2029.
- Practitioners should respond by replacing shared credentials with scoped, verifiable and privacy-preserving identity assertions that agents and merchants can both evaluate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63C — Federation | The article depends on portable identity assertions and trust across parties. |
| SP 800-63B — Authentication | Passkeys and phishing-resistant login are central to the article’s trust model. | |
| Recommendation — Design delegated commerce flows around federation and verifiable assertions instead of shared credentials. Adopt phishing-resistant authentication for user and agent entry points. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core issue is scoped authority for agents in commerce transactions. |
| Recommendation — Map agent actions to explicit entitlements and revoke any authority that exceeds transaction scope. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agentic commerce relies on agent authority that can be overextended or misused. |
| Recommendation — Harden agent delegation paths so identity and privilege cannot be reused outside approved scope. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article rejects passwords and weak trust checks as fit-for-purpose for agentic commerce. |
| Recommendation — Replace password-based agent access with verifiable authentication and scoped credentials. | ||
Key terms
- Agentic Commerce: Agentic commerce is a buying and transaction model where software agents act on behalf of a person. The identity challenge is not just proving who owns the account, but constraining what the agent may do, for how long, and under what revocation and audit rules.
- Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.
- Verifiable Digital Credential: A verifiable digital credential is structured identity data that can be checked cryptographically by a relying party. Instead of relying on visual inspection, the verifier validates issuer signatures and presentation rules, which gives the control a clearer trust basis than an image-based document.
- Machine-Readable Trust: Machine-readable trust is trust expressed as structured, verifiable signals that systems and people can evaluate automatically. It replaces static documents with live evidence, but only works when the underlying assertions are current, attributable, and validated.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 7, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org