Identity linking is the missing control for agentic commerce

At a glance

What this is: This is a Descope analysis of agentic commerce identity linking, showing that checkout sessions without a verified user identity cannot reliably support buyer data, order history, personalization, or auditability.

Why it matters: IAM and NHI teams should treat identity continuity as a governance requirement for agentic checkout flows, because anonymous agent sessions weaken authorisation, attribution, and downstream record integrity.

Context

Agentic commerce creates a basic governance problem: an automated shopping session may be able to browse, build a cart, and submit a purchase, but the merchant still may not know who it is acting for. In identity terms, the transaction has execution without a verified subject, which breaks continuity across authentication, authorisation, and record keeping.

That gap matters because ecommerce systems depend on a persistent buyer identity for pricing, receipts, order history, shipping, returns, and dispute handling. When the checkout path begins anonymously, existing IAM assumptions about a stable user session stop holding and merchants are left to reconstruct identity after the fact.

Key questions

Q: What breaks when an agentic commerce session is not linked to a verified user?

A: The merchant loses the ability to bind the purchase to a named buyer, which undermines order history, receipts, loyalty pricing, and dispute resolution. A valid token only proves a request came from a client, not that the transaction was authorised by the person whose data and payment relationship are involved.

Q: Why do merchants need identity linking for agent-driven checkout flows?

A: Because checkout is not just a tool call. It is a commitment that depends on a verified subject, approved scopes, and durable record keeping. Without those elements, the merchant cannot reliably apply customer entitlements or prove who authorised the purchase on whose behalf.

Q: How should teams decide when an agent must be linked to a user account?

A: Link the session whenever the action affects money, account history, or customer entitlements. Browsing can remain anonymous, but checkout creation, order lookup, loyalty benefits, and receipt generation should require a verified identity and explicit scope approval.

Q: What is the difference between anonymous agent checkout and delegated checkout?

A: Anonymous agent checkout lets a client interact with the store without proving a user relationship, while delegated checkout binds the agent to a specific user identity and consent record. Delegation gives the merchant a stable subject, scoped permissions, and a defensible audit trail.

Technical breakdown

Why anonymous agent sessions break checkout state

In agentic commerce, the agent may hold a valid token or reach the store through MCP, but that alone does not bind the session to a specific buyer. Without a linked identity, the system can process requests while lacking the user attributes that normally populate checkout state such as name, email, address, and purchase history. The result is not just missing convenience data. It is a state model that cannot safely distinguish between a browse-only session and a payment-authorised session. Once the merchant cannot attach the session to a verified principal, downstream controls like receipting, loyalty application, and dispute tracing become guesswork.

Practical implication: Treat identity linking as part of checkout session design, not as an optional UX enhancement.

How OAuth scopes turn identity into transaction boundaries

The article describes identity linking through OAuth 2.0 Authorization Code with PKCE, where the agent requests scopes such as checkout management or order read. That matters because scopes define the transaction boundary, while identity claims such as sub, email, and name define who is on the other side of that boundary. In practice, the merchant can allow catalog browsing broadly but require verified identity the moment the agent moves into order creation or retrieval. This is a clean separation between discovery and commitment, and it is the right place to make authorisation explicit.

Practical implication: Use scope design to separate anonymous browsing from actions that create financial or account-bearing commitments.

What durable identity records change for downstream systems

Once a linked user identity is embedded in the flow, checkout no longer ends at payment confirmation. The merchant can persist the order against a stable subject, apply member pricing correctly, and reuse verified claims for receipts, fulfilment, CRM, and loyalty logic. The article also shows why this matters operationally: an auditable consent record exists for the agent acting on behalf of the user. That is the real control value of identity linking. It creates a durable association between the transaction and the user, instead of forcing every downstream system to infer intent from an anonymous agent token.

Practical implication: Store the verified subject with the transaction so every later business process can rely on the same identity record.

Breaches seen in the wild

• Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity continuity is now a checkout control, not a convenience feature: agentic commerce fails when the merchant cannot bind a session to a verified user. That failure is broader than missing profile data, because it breaks the chain from intent to authorisation to settlement. The practitioner conclusion is simple: if the merchant cannot name the buyer, the merchant cannot govern the purchase.

Anonymous agent sessions create an attribution gap that traditional ecommerce did not have to solve: web commerce already assumed a person or account sat behind the browser session, so identity could be inherited from the interaction model. Agentic commerce removes that assumption. The implication is that identity proofing, consent, and transaction binding now have to be explicit parts of the commerce architecture, not hidden in the client experience.

Verified claims are the governance layer that makes agentic commerce usable: a user-linked subject, scope-limited authorisation, and durable audit records turn the agent from an opaque request origin into a governed delegate. Without that layer, personalisation is unreliable and dispute handling is weak. The practitioner conclusion is that identity linking defines the boundary between automation and accountable commerce.

Persistent buyer state is the named control gap in this pattern: the article shows that order history, loyalty benefits, and receipt routing all depend on a stable identity that survives beyond a single agent call. That is the exact control merchants need to preserve if they want agentic checkout to behave like a real customer journey. The practitioner conclusion is to govern the session as a user record, not as a disposable API call.

Agentic commerce will force IAM teams to think like transaction designers: the question is no longer whether an agent can authenticate, but whether the system can prove who authorised what, for which scopes, at which point in the flow. That changes the identity programme’s centre of gravity from login assurance to delegated transaction assurance. The practitioner conclusion is to align identity governance with the purchase lifecycle, not just the sign-in event.

From our research library:

• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Authorisation Guide

What this signals

Identity-linked delegation will become the baseline for governed agentic commerce: merchants that treat the agent as the only trusted subject will keep re-creating guest-like flows that cannot support loyalty, receipts, or returns. The programme implication is that user binding belongs in the commerce identity model, not in a later reconciliation process.

Persistent buyer state is the control merchants should design for first: once verified identity is attached to the session, every downstream business process can attach to the same record. That is the practical difference between an agent that merely completes a task and an agent that participates in a governed customer lifecycle.

For practitioners

• Define identity-linked checkout as a required state Make verified user binding a distinct checkout state, not an optional enrichment step, so anonymous agent sessions cannot silently progress into payment or order retrieval.
• Split browsing from commitment scopes Allow catalogue discovery without identity, but require explicit user-linked scopes before checkout management or order history access.
• Persist the verified subject with each order Store the user’s stable identifier, consent context, and approved scopes alongside the transaction record so downstream systems can rely on one identity truth.
• Use consent records as audit evidence Treat the OAuth consent event as the proof that an agent was authorised to act for a named user for a specific set of purchase actions.
• Test anonymous fallbacks against business rules Verify that guest or unlinked agent flows cannot receive member pricing, access past orders, or produce receipts that lack a verified buyer identity.

Key takeaways

• Agentic checkout breaks down when merchants cannot bind the session to a verified user identity, because the transaction loses attribution and customer context.
• The article’s core governance point is that identity continuity, not simple agent authentication, determines whether the purchase lifecycle can be trusted.
• Merchants should require verified identity for commitment actions so that scope, consent, and downstream records all attach to the same subject.

Key terms

• Identity Linking: The process of mapping multiple login methods to one governed user record. It lets a single person authenticate through different providers without creating duplicate accounts, which is essential for lifecycle control, audit consistency, and access decisions.
• Delegated Transaction: A delegated transaction is a purchase or account action performed by software under some level of user authority. In practice, the key governance question is whether the delegation scope is explicit, bounded and revocable, especially when the action touches payment, returns or subscription changes.
• Identity Continuity: Identity continuity is the ability to preserve a workload’s verified identity across proxies, services, and other infrastructure boundaries. It matters because zero trust breaks down when a request loses its original proof of identity and falls back to network trust or header-based assumptions.
• Consent Records: Consent records are the evidence a controller keeps to prove how and when a user consented, rejected, or changed cookie preferences. They typically capture the choice made, the date and time, and the status of each consent decision so the organisation can demonstrate compliance.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.