Topic starter
22/07/2026 4:35 pm
TL;DR: The growing governance gap around agentic commerce and trust infrastructure is underscored by questions over who is responsible when an AI agent completes a transaction on a consumer’s behalf, according to Prove Identity. The deeper issue is accountability: existing identity controls were built to verify people, not autonomous transaction execution.
Editorial analysis by NHI Mgmt Group, based on content published by Prove Identity: “Identity Sector Moves to Close Trust Gap in Agentic Commerce”.
Key questions
Q: What breaks when an AI agent is allowed to complete transactions on a consumer’s behalf?
A: The control that breaks is accountability.
Q: Why does agentic commerce increase identity risk for customer accounts?
A: Agentic commerce increases risk because the actor performing the transaction may not be the customer who authenticated.
Q: What are the signs that delegated commerce controls are failing?
A: The warning signs are missing approval records, vague transaction ownership, and fraud reviews that cannot distinguish human intent from agent execution.
Practitioner guidance
- Define delegated transaction authority Specify which actions an AI agent may take, which require confirmation, and which remain human-only so consumer intent is not inferred from login alone.
- Separate proofing from execution Keep identity proofing, consent capture, and transaction execution as distinct controls so audit records show who authorised the agent to act.
- Log action-level accountability evidence Record the principal, the agent, the transaction purpose, and the approval path so disputes can be traced back to a governed decision.
Bottom line: Agentic commerce creates an accountability gap when AI agents can complete transactions that were once tied to a human actor.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/07/2026 4:40 pm
Agentic commerce exposes an accountability model that current identity programmes do not yet govern. The core problem is not whether the consumer was authenticated at session start, but whether the system can prove who authorised the downstream transaction. That gap sits between IAM, fraud operations, and legal accountability, which is why it persists across teams. Practitioners should treat delegated transaction authority as a first-class control surface, not an edge case.
A question worth separating out:
Q: What should IAM and fraud teams do together for agentic commerce?
A: They should define a shared delegation policy that ties consumer consent, transaction scope, and evidence retention to the same control model. IAM owns who may act, fraud teams judge whether the action is suspicious, and both need a common record of what the agent was allowed to do.
👉 Read our full editorial: Agentic commerce trust gaps are exposing identity accountability