AI shopping agents expose a trust gap in autonomous commerce

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Riskified's research: Consumers are already using AI for shopping discovery, but most are not ready to let AI agents complete purchases autonomously.

Why it matters: IAM, fraud, and platform teams need to treat agentic commerce as an authentication and accountability problem, not just a user-experience change, because consumer expectations are already moving toward stronger safeguards.

By the numbers:

• 61.5% of consumers have used AI tools for product discovery and recommendations.
• 55.0% are not comfortable allowing AI agents to complete transactions on their behalf.
• 73.9% expect strong safeguards such as biometric verification or one-time passwords for every transaction.
• 50.8% believe AI platforms should be responsible for unauthorized purchases.

Context

Agentic commerce is the point where shopping assistants begin acting, not just recommending. That shift creates a governance gap because traditional ecommerce controls assume a human remains the final approving actor, while the article shows consumers are already testing AI across the purchase journey.

For IAM and fraud teams, the important issue is not whether AI can assist a buyer, but whether the trust model can prove who initiated the action, who approved it, and who is accountable if a purchase goes wrong. In agentic commerce, authentication, transaction integrity, and liability have to be designed together rather than treated as separate problems.

Key questions

Q: What breaks when an AI shopping agent can act without clear purchase limits?

A: Without clear purchase limits, an AI shopping agent can move from convenience to delegated financial risk. It may complete purchases the customer would not approve, accept manipulated offers, or reuse account and payment details in ways that are hard to unwind. The control failure is scope, not speed, so teams need explicit authority boundaries and step-up checks.

Q: Why do consumers expect stronger authentication when AI agents are involved in buying?

A: Because the risk shifts from simple account access to transaction integrity. When software can act on behalf of a person, consumers want proof that the specific purchase was intentional, which is why biometric verification and one-time passwords become more important at checkout than at login alone.

Q: How do security and fraud teams know whether agentic commerce controls are working?

A: They should measure both fraud loss and customer friction. If controls block too many legitimate delegated orders, the programme is overfitting to automation. If suspicious agent-driven transactions still pass without auditability or escalation, the controls are too weak. Effective governance shows up in lower false positives, clear delegation records, and consistent review outcomes.

Q: What is the difference between a human checkout session and an AI shopping agent session?

A: A human session assumes the customer is the final actor, while an AI agent session introduces delegated authority that may outlive the original intent. The practical difference is that the agent needs its own governance, including scoped permissions, stronger transaction binding, and separate audit evidence.

Technical breakdown

Why agentic commerce breaks traditional checkout trust

Agentic commerce changes the trust boundary by inserting a software intermediary between discovery and purchase. In a normal checkout flow, identity proofing, authentication, and authorisation are anchored to a person making an explicit purchase decision. When an AI agent acts on a user’s behalf, the system must decide whether the agent is a delegated actor, a proxy session, or a separately governed non-human identity. That distinction affects how merchant systems evaluate risk, how payment flows are challenged, and how fraud controls interpret intent. The core issue is not automation itself, but delegated authority without a mature identity model.

Practical implication: Treat AI shopping agents as governed delegated actors, not as simple UI automation.

Authentication expectations are moving toward step-up controls

The survey’s strong preference for biometric verification and one-time passwords shows that consumers expect higher assurance when AI is involved in a purchase. That makes sense because the more autonomous the action, the more valuable transaction binding becomes. In practice, this shifts control design from static login assurance to transaction-level authentication, where the purchase itself needs evidence of approval. For identity teams, that is a familiar principle from high-risk access, but the challenge here is making it work across consumer checkout journeys without breaking conversion or trust.

Practical implication: Use step-up authentication for high-risk transactions and bind approval to the specific purchase event.

Accountability gaps will shape merchant and platform liability

The article shows a clear accountability split: many consumers expect the AI platform to carry responsibility for unauthorized purchases. That matters because liability expectations influence control design, dispute handling, and consumer trust. If merchants cannot show who authorised the transaction, they inherit ambiguity even when AI was only an intermediary. This is the same governance problem identity teams face when delegated access is granted without enough logging, attestation, or revocation clarity. The control objective is to preserve an audit trail that can answer who acted, under what authority, and with what assurance.

Practical implication: Build transaction logging and delegation evidence so disputes can be resolved against a clear authorisation trail.

Threat narrative

Attacker objective: Exploit delegated shopping trust to complete unauthorised transactions or shift liability after an erroneous purchase.

1. Entry occurs when a consumer authorises an AI shopping agent to browse, select, or place items on their behalf.
2. Credential or session abuse becomes possible when the agent operates inside a weakly governed trust boundary that can be reused across merchants or transactions.
3. Impact appears when an unauthorised or erroneous purchase is completed and the accountability model cannot clearly prove who approved it.

Breaches seen in the wild

• Twitter source code leak 2023: Twitter source code and internal tools were posted to GitHub by "FreeSpeechEnthusiast" and stayed public for months before a 2023 takedown.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic commerce introduces a delegated identity problem, not just a fraud problem. Once an AI agent can move from recommendation to transaction, the trust boundary changes from user intent to delegated authority. That means merchants and payment flows need to know whether the agent is acting under explicit, scoped permission or simply leveraging a reused session. Practitioners should design for delegation proof, not assume the human remains the only meaningful actor.

Transaction authentication becomes the control plane for autonomous buying. The survey’s strong consumer preference for biometric verification and one-time passwords shows that checkout will increasingly need proof at the point of purchase, not only at login. That pattern is especially relevant to IAM teams because identity assurance has to bind to the action, amount, and context of the transaction. Practitioners should expect higher demand for step-up controls on delegated commerce flows.

Accountability is the missing governance layer in agentic commerce. Consumers are already assigning responsibility to the AI platform when purchases go wrong, which means control design and dispute resolution are now linked. Without reliable audit trails, merchants will struggle to separate user intent, platform action, and fraud. Practitioners should treat attribution, logging, and liability mapping as core requirements, not post-incident paperwork.

Agentic commerce will force identity teams to define where delegation ends. That boundary is currently too vague in most ecommerce journeys, especially where AI tools are mixed into discovery, cart building, and checkout. The issue is not whether AI can assist shopping, but whether organisations can govern when that assistance becomes authorised action. Practitioners should map delegated purchase authority before AI agents become routine in revenue flows.

From our research library:

• Global e-commerce fraud losses are projected to reach $107 billion a year by 2029.

What this signals

Agentic commerce will push identity governance into the shopping funnel. Merchants cannot rely on login alone if autonomous tools are completing parts of the purchase journey. The programme question is how to bind authority to a transaction without turning every checkout into a friction point.

Trust gaps will become an operational design issue, not a consumer sentiment issue. As users become more comfortable with AI discovery but less willing to surrender buying control, practitioners will need clearer delegation rules, stronger assurance steps, and better dispute evidence. That shift matters for both fraud teams and IAM teams.

Auditability is the control that turns delegated shopping into governed shopping. If an agent can act, the organisation must be able to show what it was allowed to do, when approval occurred, and how a disputed order can be reconstructed. Without that, accountability stays rhetorical.

For practitioners

• Define delegated purchase authority Document when an AI shopping agent may browse, shortlist, add to cart, or place an order, and require explicit scope for each step.
• Bind authentication to the transaction Use step-up controls such as biometrics or one-time passwords for higher-risk purchases, and tie approval evidence to the specific checkout event.
• Log agent-driven purchase evidence Capture which identity initiated the action, what scope was granted, which prompts or approvals were present, and how the final order was authorised.
• Rework dispute and liability workflows Align fraud, customer support, and IAM records so unauthorised or erroneous purchases can be traced to the accountable party without ambiguity.

Key takeaways

• Consumers are using AI widely for shopping discovery, but the trust boundary collapses once those tools are allowed to complete purchases autonomously.
• The article shows that authentication, fraud prevention, and liability are converging into one governance problem for merchants and platforms.
• IAM and fraud teams should define delegation scope, step-up controls, and auditability before AI agents become routine in ecommerce checkout.

Key terms

• Agentic Commerce: Agentic commerce is a buying and transaction model where software agents act on behalf of a person. The identity challenge is not just proving who owns the account, but constraining what the agent may do, for how long, and under what revocation and audit rules.
• Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.
• Step-up Authentication: Step-up authentication is an additional verification step triggered when a session becomes higher risk or a user attempts a sensitive action. It is used to reduce exposure without forcing extra friction across every interaction, which makes it useful for runtime access governance.
• Transaction binding: Transaction binding links a user's identity, the document they approved, and the workflow state into a single evidence record. This matters in digital lending because a signature alone is not enough to prove the right person approved the right version at the right stage.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and agentic AI identity. It helps practitioners translate delegated access concepts into controls that fit real operating models.