Notifications
Clear all
Topic starter
10/07/2026 9:28 pm
TL;DR: Agentic commerce is creating a trust gap because current identity systems were built to authenticate humans in bounded sessions, while agents can act asynchronously, chain decisions, and delegate spending authority across environments, according to Prove Identity. Without a verified human-to-agent binding, identity and authorisation break down before commerce can scale safely.
NHIMG editorial — based on content published by Prove Identity: The Crisis of Identity, Part 1, Why Agentic Commerce Needs a KYA Roadmap
Questions worth separating out
Q: How should organisations govern AI agents that act on behalf of customers?
A: Organisations should require every delegated agent action to remain traceable to a verified human owner, a verified authorisation event, and a controlled session context.
Q: Why do agentic systems complicate IAM and fraud controls?
A: Agentic systems complicate IAM and fraud controls because they blur the boundary between a user, a device, and an executing non-human identity.
Q: What breaks when agent identity is not portable across platforms?
A: When agent identity is not portable, every platform reinterprets trust from scratch, which weakens authorisation and makes fraud detection inconsistent.
Practitioner guidance
- Map delegated agent use cases to identity controls Inventory where agents can transact, negotiate, or change account state on behalf of users, then identify which steps still rely on human-centric session assumptions.
- Require durable human attribution for agent actions Define policy so every material agent action retains a verifiable link to the human owner, the delegation event, and the session context that authorised it.
- Test protocol portability across channels Validate whether agent identity evidence survives movement between apps, merchants, and devices, and flag any flow where assurance resets at each boundary.
What's in the full article
Prove Identity's full blog covers the operational detail this post intentionally leaves for the source:
- The article's breakdown of KYA as a chain-of-custody model for agentic identity and delegated commerce
- The discussion of protocol fragmentation across ACP, AP2, UCP, and related agent identity efforts
- The description of how verified human-to-agent binding is meant to preserve attribution and session integrity
- The vendor's positioning of Prove Verified Agent as an implementation of the KYA framework
👉 Read Prove Identity's analysis of why agentic commerce needs a KYA roadmap →
Agentic commerce identity trust: what should IAM teams do now?
Explore further
10/07/2026 9:50 pm
Agentic commerce is exposing an identity trust crisis, not just a payments problem. The article is right to treat authentication, authorisation, and attribution as one chain of custody. Once agents can transact asynchronously or in swarms, the old assumption that a session maps cleanly to a human actor stops holding. Practitioners should treat delegated agent behaviour as a governance domain, not a feature of customer authentication.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who is accountable when an AI agent makes a bad transaction?
A: Accountability should sit with the human or organisation that delegated authority, but only if the delegation was clearly verified and the agent’s actions were traceable. If the system cannot prove ownership and authorisation, accountability becomes disputed and incident response becomes harder. Governance should make that chain explicit before transactions are allowed.
👉 Read our full editorial: Agentic commerce needs a KYA roadmap to fix identity trust
