TL;DR: AI holiday shopping is moving from search to purchase, with 67% of Americans planning to use AI and 78% comfortable letting it handle at least one step, according to Forter. Retailers now need to govern agent-led discovery, approval and payment as one trust flow, not three separate moments.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Forter's report: AI holiday shopping is shifting control from human browsing to agent-assisted discovery, comparison and purchase, and retailers must govern that path end to end.
Why it matters: This matters because identity, fraud and checkout controls now have to recognise when an AI agent is acting for a shopper and decide what level of authority it should receive.
By the numbers:
- 78% of holiday shoppers are comfortable letting AI handle at least one part of their shopping journey.
- 47% are comfortable letting AI find them deals or the best pricing.
- 20% of holiday shoppers said they are comfortable letting an AI assistant select the product itself.
Context
AI holiday shopping adds a new identity and fraud question to retail: when an automated shopping assistant browses, compares and eventually buys on behalf of a person, who should the retailer trust, and under what scope of authority? That shifts the control problem from simple bot detection to governed delegation, especially when the same journey moves from search to payment.
The practical challenge is not whether AI can recommend products, but whether merchants can recognise legitimate agent activity, bound its privileges and preserve customer intent at checkout. In holiday commerce, the starting point is ordinary consumer behaviour, but the operating model becomes atypical once an agent is allowed to act inside the purchase flow.
Key questions
Q: How do AI shopping agents change retail access control?
A: AI shopping agents turn a consumer journey into a delegated access flow, so retailers have to decide what the agent can search, select and submit on the shopper’s behalf. The key controls are scoped authority, explicit approval for purchase and transaction monitoring that can tell legitimate delegation from abuse.
Q: What is the best way to prevent agent-driven checkout abuse?
A: Prevent agent-driven checkout abuse by requiring step-up authentication, transaction signing, per-agent spend caps, and server-side fraud controls that detect automated basket creation, coupon abuse, and card testing. The strongest control is to keep the payment action behind final approval or spending limits, so an agent can prepare the order but cannot unilaterally commit funds or change shipping details.
Q: How do retailers make product pages usable by AI assistants?
A: Retailers make product pages usable by AI assistants by exposing structured, machine-readable product data such as schema markup, clean titles, prices, availability, variants, and return terms. They also need consistent page semantics, stable URLs, and APIs or feeds for inventory and checkout data so an assistant can parse the offer correctly and compare products without guessing from page layout alone.
Q: When should shopping assistants be allowed to complete a purchase?
A: Shopping assistants should be allowed to complete a purchase only when the delegated scope covers that exact transaction, the basket matches the user’s policy, and the request passes a human approval step for price, merchant, or shipping exceptions. A common control is to require one-time confirmation or JIT approval before payment authorisation, while routine replenishment can be pre-authorised within strict limits.
Technical breakdown
Agent-mediated shopping and delegated authority
Agent-mediated shopping means a software system performs retail tasks on behalf of a consumer, such as discovering products, comparing offers or initiating checkout. The security issue is not the recommendation itself but the delegation boundary: the retailer has to decide what the agent can see, select and submit without confusing that authority with full customer intent. In practice, that turns shopping into a scoped access problem, where approval, spending limits and refund guarantees become part of the trust model rather than post-purchase customer service. See the AI Agent Authorisation Guide.
Practical implication: Treat AI shopping journeys as delegated access flows and define what the agent can do before it reaches checkout.
Recognising legitimate customers behind AI agents
Retailers face a recognition problem when an AI agent is the interface but the customer remains the accountable party. That means the checkout stack has to distinguish between automated browsing, authorised buying and suspicious abuse patterns without overblocking legitimate agent traffic. Identity signals, behavioural context and purchase-risk scoring all matter, but they only work if the merchant can tie the agent session back to a customer relationship and a known spending context. See the AI Agent Observability, Audit and Incident Response Guide.
Practical implication: Correlate agent sessions with customer identity and transaction context before allowing purchase completion.
Product discovery, pricing signals and conversion risk
AI systems tend to rely on structured, machine-readable product data. If descriptions, pricing and availability are incomplete or inconsistent, the agent may choose the wrong item, miss an offer or abandon the path entirely. That makes catalog quality a security-adjacent control surface because it affects whether automated discovery behaves predictably enough to support trusted commerce. For retailers, discovery quality now influences both conversion and abuse resistance.
Practical implication: Publish consistent product data so agents can compare and buy from the same trusted information shoppers see.
Breaches seen in the wild
- AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic commerce creates a delegated access problem, not just a search problem. The point of AI shopping is no longer limited to helping with discovery. Once an assistant can compare, choose and initiate payment, the merchant is dealing with a non-human actor operating inside a customer journey. That means the real governance question is how much authority the agent should inherit, and how that authority is bounded at each step. Retailers that treat this as a UI shift will miss the control implications for identity, intent and transaction approval.
Final approval is the most important trust boundary in consumer agent flows. Forter’s findings show shoppers are more willing to let AI assist than to let it decide everything. That creates a clear policy pattern: let agents gather options, but constrain what they can commit without an explicit human checkpoint. The operational implication is that checkout should be designed as a privilege escalation moment, not a continuation of browsing. Otherwise the retailer cannot separate assisted purchase from unauthorised automation.
Fraud controls now need to understand agent identity as well as customer identity. Retail systems have long been built to identify the person behind the session. AI shopping adds another layer: the session may be executed by software acting for that person. Merchant controls therefore need to distinguish benign delegation from abuse, including bot-driven scraping, credential misuse and transaction laundering. That is where agentic AI identity becomes relevant to commerce governance, even outside traditional IAM programmes.
Catalog quality is becoming a trust control, not only a merchandising task. If product data is inaccurate, incomplete or not readable by agents, the assistant may fail to represent the shopper’s intent accurately. The consequence is not just lost conversion. It is a higher likelihood that automated buying will behave inconsistently across products, brands and channels. Merchants should treat structured product content as part of the commerce control plane, because agents can only operate safely on information they can parse reliably.
From our research library:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- Read next: AI Agent Authorisation Guide
What this signals
Agentic shopping delegation: Retailers should expect more purchase journeys to begin with AI systems that compare and shortlist products before a human ever reaches checkout. That shifts the security design problem toward delegation, approval and fraud detection, because the system has to know when an agent is acting within a shopper’s authority and when it is not.
Consumers are signalling that the next control boundary is no longer the search result, but the transaction step. Merchants that do not distinguish benign assistant behaviour from automated abuse will struggle to preserve both conversion and trust as agentic commerce becomes normalised.
For practitioners
- Define agent purchase authority Set explicit policy for what an AI shopping assistant may browse, compare, select and buy without a human checkpoint.
- Add approval gates at checkout Require a final approval step, spending limits or both before an agent can complete a purchase on behalf of a customer.
- Correlate agent sessions to customer identity Use session, device and behavioural context to decide whether agent traffic is legitimate commerce or abuse.
- Harden product data for machine discovery Keep product descriptions, pricing and availability accurate and consistent so AI systems do not act on stale or ambiguous catalog data.
Key takeaways
- AI shopping changes retail risk by moving automation from discovery into the purchase decision, where authority has to be explicitly bounded.
- Consumer comfort is high enough that merchants should assume agent-led browsing and comparison will become routine, not experimental.
- The most effective control pattern is scoped delegation with a human approval point for purchase, supported by fraud detection that recognises agent sessions.
Related NHI Mgmt Group resources: AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · Agentic AI Identity Guide · Agentic AI Security Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack surface, NIST AI RMF, NIST CSF 2.0 and NIST SP 800-63 set the technical controls, and ISO/IEC 42001:2023 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | AI shopping assistants inherit authority inside retail journeys, which creates identity and privilege questions. |
| ASI09 — Human-Agent Trust Exploitation | Consumers are delegating shopping decisions to agents, so trust boundaries are part of the threat surface. | |
| Recommendation — Bound agent privileges to the minimum shopping task and require approval before purchase completion. Design purchase flows to verify human intent at the point where an agent can commit funds. | ||
| NIST AI RMF | MANAGE — AI Risk Management | Retailers need ongoing governance for AI-mediated shopping risk, not a one-time deployment decision. |
| Recommendation — Establish monitoring, escalation and accountability for AI-assisted purchase flows. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Agentic commerce depends on tightly scoped permissions across browsing, selection and checkout. |
| Recommendation — Define and enforce least-privilege access for shopping agents across the purchase journey. | ||
| NIST SP 800-63 | SP 800-63C — Federation | Retailers must bind delegated agent sessions back to the customer relationship and trusted identity context. |
| Recommendation — Use federated identity signals to connect agent activity to an authenticated customer session. | ||
| ISO/IEC 42001:2023 | Governance of AI Systems — Governance of AI Systems | AI shopping introduces organisational governance obligations around accountability and oversight. |
| Recommendation — Document ownership, policy and review processes for AI-assisted commerce decisions. | ||
Key terms
- Agentic Commerce: Agentic commerce is a buying and transaction model where software agents act on behalf of a person. The identity challenge is not just proving who owns the account, but constraining what the agent may do, for how long, and under what revocation and audit rules.
- Human Approval Step: A human approval step is a required confirmation by a person before an autonomous action is committed. It usually sits between agent decision-making and final execution, so the human can review the order, amount, destination, or permissions before granting authorisation, especially for purchases, data access, or other irreversible actions.
- Delegated authority: Delegated authority is permission given to one identity to act on behalf of another within defined limits. In identity systems, it enables an agent, user, or service account to perform approved actions without owning the underlying rights, using scoped tokens, roles, or approvals to constrain access and accountability.
- Spend Limits: Spend limits are controls that cap how much an AI agent, service account, or other non-human identity can spend within a defined period or transaction. In identity security, they reduce financial abuse by binding usage to policy, tying approvals, thresholds, and anomaly detection to identities, tokens, or workflows.
Deepen your knowledge
The NHI Foundation Level course covers NHI governance, agentic AI identity, machine identity security, IAM and secrets management through a structured practitioner curriculum, including the industry's only accredited NHI security programme. It helps security and identity teams align policy, control design and operational ownership across modern identity programmes.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org