Agentic commerce turns identity into the checkout gate

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Forter's blog post: Agentic commerce is shifting checkout control toward identity, policy, and real-time trust decisions as scraper agents and assistants start ordering at scale.

Why it matters: IAM, fraud, and commerce teams now need rules for software acting on behalf of customers, because checkout policy and identity verification are becoming inseparable.

By the numbers:

• Within the first three weeks, 40% of Instinct users gave it their credit card.
• Protocol-based journeys are 10x faster and use 5x fewer tokens.

Context

Agentic commerce changes the trust model for checkout because software can now initiate purchases, present itself through infrastructure rather than a person, and move faster than existing merchant policy can react. The core gap is not payment processing alone but identity, authorisation, and the decision to treat an autonomous buyer as a distinct actor.

When agents shop on behalf of consumers, traditional customer rules stop being enough. Merchants need a way to distinguish a legitimate delegated action from automation that is simply scraping, testing, or abusing checkout flows, and that decision has to happen before the transaction completes.

The foundational issue is agentic AI identity: who the software is, what it is allowed to do, and how that permission is verified at runtime.

Key questions

Q: How should merchants handle AI agents at checkout without increasing false declines?

A: They should treat AI agents as delegated identities and pass agent metadata, permissions, and session context into fraud systems. That lets the engine distinguish authorised automation from hostile bot activity. Without that context, legitimate agent-led shopping can look indistinguishable from account abuse.

Q: Why do scraping agents create fraud risk in commerce?

A: Scraping agents create fraud risk because they can mimic shoppers, enumerate products or prices at scale, and automate account abuse, inventory hoarding, or credential stuffing. When they reuse cookies, tokens, or rotated proxies, they blur legitimate traffic and can bypass rate limits, bot controls, and anomaly detection. Commerce teams need session controls, bot management, device fingerprinting, and transaction abuse rules.

Q: What is the difference between protocol-based agents and scraping bots?

A: Protocol-based agents use the merchant-defined interaction path, such as a documented API or structured feed, so their access is explicit and controllable. Scraping bots drive the public website or app interface, infer state from rendered pages, and are harder to distinguish from human browsing, which increases abuse and fraud risk.

Q: When should loyalty rewards be delayed for automated buyers?

A: Loyalty rewards should be delayed when automated buyers can rapidly create, test, or resell accounts, or when purchase behaviour needs review for abuse signals. Holding periods let fraud controls inspect the order, device, payment instrument, and account history before points or benefits become redeemable, reducing abuse from scripted checkout flows and bonus harvesting.

Technical breakdown

How agent identification changes checkout control

Agentic checkout is not just faster automation. It introduces a software actor that may browse, add items, and submit orders without a human present at each step. That matters because merchants often infer trust from device signals, session continuity, or customer history, but those signals are weaker when the buyer is an assistant running in a cloud environment. Identity therefore becomes an input to authorisation, not a post-transaction label. The practical question is whether the merchant can recognise the actor early enough to apply different rules before payment or loyalty decisions are made.

Practical implication: Treat agent identity as a pre-authorisation signal and decide policy before checkout completes.

Why scraping agents and protocol journeys behave differently

Scraping-based agents simulate normal browsing, which gives them broad reach but also makes them compute-heavy, error-prone, and difficult to distinguish from abuse. Protocol-based journeys move the interaction into a structured exchange where the merchant can define the allowed actions and verify the requesting party more cleanly. The difference is architectural: one path adapts to whatever site exists, while the other depends on merchant and platform participation. That is why the control problem is not merely bot detection. It is whether the merchant wants to govern an unstructured visitor or a declared software principal.

Practical implication: Use structured agent journeys where possible, because policy is easier to enforce when the interaction is declared.

Why identity and delegation now sit inside the payment flow

Agentic commerce collapses the old separation between identity proofing and transaction execution. A software assistant may hold credentials, payment details, and delegated intent in one runtime environment, then act quickly enough that human review never becomes meaningful. That creates a governance gap around entitlement scope, chargeback responsibility, and customer intent. If the merchant cannot tell whether an action came from the customer or the agent, then policy enforcement, fraud review, and dispute handling all become ambiguous. The checkout stack now has to carry identity semantics, not just payment mechanics. See the Agentic Commerce Identity Guide.

Practical implication: Build checkout controls that preserve intent, identity, and authorisation context through the full transaction path.

Threat narrative

Attacker objective: The objective is to complete purchases or abuse rewards at scale while blending agent activity into ordinary commerce traffic.

1. Entry occurs when a web-scraping or assistant-driven agent reaches the checkout flow without a prior merchant relationship or explicit integration.
2. Credential access follows when the assistant uses stored customer credentials, payment details, or delegated account access to progress through login and purchase steps.
3. Impact appears as unauthorised, disputed, or policy-breaking orders, with loyalty abuse and fraudulent purchases becoming harder to separate from legitimate delegated shopping.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity is now the control plane for agentic commerce: checkout no longer starts with product selection and ends with payment. It starts with deciding whether a software actor is recognised, what delegation it carries, and whether the merchant will accept the action at all. That makes identity verification a business-policy decision, not just a fraud signal. Merchants that delay this choice until after the order is formed will keep reacting to traffic they should have governed earlier.

Merchant policy must precede automation, not chase it: the article shows that agents will take the path of least resistance, which means they will exploit whatever checkout path is easiest unless policy is explicit. When the merchant has no declared software-actor rules, the default is ambiguity. That ambiguity is where abuse, overreach, and customer disputes begin. The practitioner takeaway is that policy must be defined before agent adoption scales, because the control surface appears before the business has a formal model for it.

Agentic commerce exposes a new trust boundary between intent and execution: the most important governance shift is not who paid, but whether the person’s intent survived the handoff into software action. The article’s examples show that assistants can hold credentials, interpret instructions, and move fast enough to blur consent. That creates a named concept we need to track: checkout intent drift, where delegated software action no longer matches the original customer purpose. Practitioners should treat that drift as a governance failure, not a user-experience nuisance.

Protocols will not replace governance by themselves: merchant-controlled APIs and registry-style identity signals improve observability, but they do not remove the need to decide what software may do, when it may do it, and when human involvement must return. Standardisation helps with interoperability, yet the real issue is policy consistency across channels, returns, loyalty, and disputes. The field is moving toward shared declarations, but the merchant still owns the risk decision. The practical conclusion is that protocol adoption without delegation policy merely automates uncertainty.

From our research library:

• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Checkout intent drift: as assistants become a normal buying channel, the governance problem shifts from recognising the agent to proving that the agent’s action still matches the shopper’s intent. Organisations that keep policy at the account level will miss the point, because the risky event now happens inside the delegated session, not after it.

Payment, loyalty, and returns teams will need one shared decision model for software principals, because the merchant cannot safely treat checkout, reward crediting, and dispute handling as separate problems once agent traffic is normalised.

The strongest control will be the one that can distinguish legitimate delegated action from opportunistic automation before the transaction is finalised, not the one that merely spots suspicious traffic after the fact.

For practitioners

• Define software-actor checkout policy Set explicit rules for which AI assistants, bots, or declared agents may browse, log in, and buy on behalf of customers, including the risk thresholds for step-up checks.
• Separate identity signals from device signals Require a policy decision that combines declared identity, request context, and session signals before checkout, rather than relying on fingerprinting alone.
• Instrument agent-specific checkout telemetry Log agent declarations, credential use, basket changes, payment attempts, and return requests so disputes can be traced back to a software actor.
• Gate loyalty actions by identity confidence Delay points earning, redemption, or tier changes until the merchant can distinguish a customer-directed action from delegated or automated behaviour.

Key takeaways

• Agentic commerce turns checkout into an identity and policy problem because software can now act with customer-like reach and speed.
• The article’s evidence shows that assistant-driven ordering is already growing, which makes merchant governance decisions immediate rather than speculative.
• Practitioners need declared agent identity, policy-based checkout rules, and stronger intent verification before automation becomes the default channel.

Related NHI Mgmt Group resources: Agentic AI Identity Guide · AI Agent Observability, Audit and Incident Response Guide · Agentic AI Security Guide · Shadow AI and AI Agent Discovery Guide

Key terms

• Agentic Commerce: Agentic commerce is a buying and transaction model where software agents act on behalf of a person. The identity challenge is not just proving who owns the account, but constraining what the agent may do, for how long, and under what revocation and audit rules.
• AI Agents: AI agents are autonomous software entities that act within organisational environments and make runtime decisions within assigned boundaries. They can hold identities, authenticate to systems, and exercise permissions, which makes them comparable to other non-human identities that require inventory, governance, and continuous activity monitoring.
• Delegated authority: Delegated authority is permission given to one identity to act on behalf of another within defined limits. In identity systems, it enables an agent, user, or service account to perform approved actions without owning the underlying rights, using scoped tokens, roles, or approvals to constrain access and accountability.
• Web Scraping: Web scraping is the automated collection of information from websites. In identity and security contexts, it can support threat intelligence, exposure monitoring, and data discovery, but it also creates risks when used to harvest usernames, emails, secrets, or other sensitive identity data from public or semi-public sources.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.