AI shopping agents force marketplaces to trust identity and intent

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Socure's blog post: AI shopping agents are altering marketplace competition because existing bot and fraud controls cannot reliably distinguish legitimate delegated activity from malicious automation.

Why it matters: IAM, fraud, and marketplace security teams now need controls that recognise agent identity, bind it to a principal, and govern what the agent may do at the point of action.

Context

Marketplaces are running into a governance problem, not just a traffic-filtering problem. When an AI agent acts on behalf of a person or business, the platform has to decide whether the request is delegated commerce or abuse, and those two can look similar at the signal level.

Traditional bot controls assume automation can be classified by behaviour alone. In agentic commerce, the platform has to understand who authorised the agent, what it is allowed to do, and whether the specific action deserves challenge or denial. That is why AI agents vs agentic AI matters here: the governance question is about delegated identity, not merely automated browsing.

Key questions

Q: How should e-commerce teams distinguish legitimate AI shopping agents from malicious automation?

A: E-commerce teams should use layered detection rather than a single signal. Combine device intelligence, behavioural patterns, transaction context, and real-time risk scoring to separate helpful agents from fraud traffic. The goal is not to block automation outright, but to classify it accurately enough to preserve revenue, reduce fraud, and avoid disrupting legitimate customer journeys.

Q: How can persistent agent identity improve fraud controls?

A: Persistent agent identity improves fraud controls by letting each AI agent keep a stable identifier across sessions, so detection systems can correlate behaviour, permissions and transaction history instead of treating every action as anonymous. It also supports revocation, scoped delegation and audit trails for a known agent, reducing impersonation risk and making anomalous purchasing patterns easier to flag.

Q: What is the best way to authorise AI agents for purchases?

A: The best way is action-level authorization, where the agent is permitted to perform only a specific purchase action with tightly scoped limits on amount, merchant, data use and approval path. That control should bind the agent to a human accountable owner, use short-lived credentials or delegated tokens, and require re-authorisation for higher-risk or out-of-scope purchases.

Q: What should marketplaces log when AI agents complete transactions?

A: Marketplaces should log the policy decision, the agent identity, the transaction context, the resources requested, the authorisation outcome and the human or system that granted the decision. Those records support auditability, dispute handling and revocation, and they show whether the marketplace allowed the action under standing rights, delegated scope or a just-in-time exception.

Technical breakdown

Why bot detection breaks down in agentic commerce

Bot detection was built to spot scripted or unsupervised automation, usually through request rate, headless browser markers, or repetitive interaction patterns. AI shopping agents can look similar at the network and session layer while still representing a real customer intent. The control failure is classification: the platform sees automation, but cannot tell whether that automation is acting with delegated authority or with hostile intent. In marketplaces, that creates a false positive problem that is operationally expensive and a false negative problem that fraudsters can exploit. See the Shadow AI and AI Agent Discovery Guide.

Practical implication: Separate delegated agent activity from generic automation using identity, context, and risk signals rather than traffic shape alone.

Persistent agent identity and Know Your Agent

Know Your Agent extends identity binding to software acting on behalf of a person or business. The point is not just to recognise that an agent exists, but to preserve a stable link between the agent and the principal across sessions, devices, and interactions. Without that persistence, the platform cannot build a trustworthy history of behaviour, apply consistent policy, or explain why a transaction was allowed or blocked. That identity binding is what turns an ephemeral request stream into a governable commerce relationship. See the Agentic Commerce Identity Guide.

Practical implication: Establish a durable way to recognise the same agent across sessions and associate it with a verified human or business.

Risk-based authorization at the point of action

Authorization in agentic commerce has to be action-specific. An agent may be approved to search, compare, or purchase, but not to reset account details, initiate refunds, or access sensitive information. Risk-based authorization adds context about the principal, the current action, and the sensitivity of the transaction before the request is completed. That shifts control from static permission assignment to decisioning at runtime, which is necessary when the same agent can legitimately perform low-risk work and high-risk work in the same workflow. Read Zero Trust for AI Agents.

Practical implication: Define separate permissions for searches, purchases, refunds, and account changes, then evaluate each request before execution.

NHI Mgmt Group analysis

Agentic commerce turns delegated identity into a commerce control plane issue: marketplaces are no longer deciding only whether traffic is human or automated. They are deciding whether an agent is acting with valid authority on behalf of a principal, and that distinction determines whether trust can be extended without opening fraud paths. The governance problem is therefore identity binding plus action scope, not traffic suppression. Practitioners should treat agent activity as a first-class identity event, not a nuisance signal.

Static bot rules cannot carry delegated commerce: the same interaction pattern can represent a legitimate shopping assistant or a fraud workflow. That means a rule set that works for scraping, rate limiting, or scripted abuse will not hold once agents can search, compare, and buy on behalf of customers. The control model has to incorporate principal context, risk history, and the specific action being requested. Practitioners should stop assuming behaviour classification alone is enough.

Know Your Agent is the bridge between KYC and runtime authorization: customer and business verification still matter, but they are not sufficient once software executes the transaction. The platform has to connect a persistent agent identity to the verified principal and then decide what that agent may do in each session. This is where marketplace governance moves from account-level trust to action-level trust. Practitioners should design for identity continuity across sessions, not one-off request approval.

Risk-based authorization is the named concept that matters here: the decisive change is not whether an agent can be detected, but whether the platform can safely allow some actions while challenging others. That is a finer-grained governance model than legacy fraud blocking or blanket allowlisting. It preserves transaction flow while limiting sensitive operations. Practitioners should reframe authorization around action sensitivity, not just account status.

From our research library:

• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Agentic commerce will push marketplaces away from binary bot blocking and toward delegated identity governance. The practical change is that platforms will need to know which principal stands behind the agent before they can decide whether a transaction is acceptable.

Action-level trust: the next control boundary is not whether an agent is present, but whether each requested action is within the authority that principal actually granted. That will force marketplaces to separate discovery, purchase, account management, and refunds into distinct policy decisions.

The organisations that adapt earliest will treat agent identity as part of customer experience design, not as a fraud afterthought. That shift will determine who can support AI-driven commerce without forcing legitimate transactions through unnecessary friction.

For practitioners

• Implement delegated-agent identity binding Create a persistent link between each AI agent and the human or business it represents so the same agent can be recognised across sessions and policy decisions.
• Classify agent activity by principal and intent Use identity, behavioural, and contextual signals to separate legitimate delegated commerce from counterfeit listings, promotion abuse, and other malicious automation.
• Apply action-specific authorization Allow search and purchase flows separately from refunds, account changes, and sensitive data access, with a decision made before each high-risk action completes.
• Instrument marketplace audit trails for agent decisions Log who the agent represents, which action was attempted, which policy allowed it, and whether the request was allowed, challenged, or blocked.

Key takeaways

• AI shopping agents create a governance problem because marketplaces must distinguish delegated activity from malicious automation before they can safely permit transactions.
• The control boundary moves from session-level bot detection to persistent identity, principal attribution, and action-specific authorization.
• Marketplaces that cannot evaluate agent trust at the point of action will struggle to balance fraud prevention with frictionless commerce.

Related NHI Mgmt Group resources: Agentic AI Identity Guide · Zero Trust for AI Agents · Shadow AI and AI Agent Discovery Guide · AI Agent Observability, Audit and Incident Response Guide

Key terms

• Agentic Commerce: Agentic commerce is a buying and transaction model where software agents act on behalf of a person. The identity challenge is not just proving who owns the account, but constraining what the agent may do, for how long, and under what revocation and audit rules.
• Persistent identity: An identity approach where trust is maintained across channels and time instead of being reset at each authentication event. It is not a promise of permanent trust, but a mechanism for keeping identity decisions aligned with changing user, device, and risk conditions.
• Risk-based Authorization: Risk-based authorization is access control that changes decisions based on the current risk of a request. It evaluates signals such as user behavior, device health, location, session context, and identity confidence, then grants, limits, steps up, or blocks access. This approach supports adaptive IAM and Zero Trust operations.
• Know Your Agent: A governance pattern for verifying that an AI agent is the intended actor, not a hijacked or impersonating one. It extends identity assurance beyond login by focusing on runtime behaviour, delegated authority, and the integrity of the agent's actions across connected systems.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.