Topic starter
10/07/2026 9:17 pm
TL;DR: FIDO’s new AP2 and Verifiable Intent standards define how AI agents can act within cryptographic limits, but they leave the root identity question unresolved: how to verify the human and business behind the delegation chain, according to Prove Identity. Without that anchor, agentic commerce becomes a trust problem disguised as a protocol problem.
Editorial analysis by NHI Mgmt Group, based on content published by Prove Identity: “FIDO's Agentic Commerce Blueprint Is a Major Step Forward. Here's What Comes Next.”.
Key questions
Q: What breaks when agentic commerce can authorise actions but not verify the root identity?
A: The failure is that a cryptographically valid delegation can still originate from a synthetic, fraudulent, or weakly verified identity.
Q: Why does agentic commerce create a trust problem as much as a payment problem?
A: Because the agent is only one part of the transaction chain.
Q: How should security teams govern delegated control in autonomous AI systems?
A: They should treat delegated control as a first-class identity problem, not a by-product of application integration.
Practitioner guidance
- Define the root identity signal Specify what evidence is required before an AI agent is allowed to act on behalf of a person or business, including identity proofing, consent, and binding to the delegating account.
- Separate delegation from assurance Map where your current controls prove authorisation only, and where they prove the underlying identity is real, current, and appropriate for the transaction.
- Build a trust registry model Establish how identity attributes, payment authority, and consent records will be resolved and retained across the full transaction lifecycle.
Bottom line: Agentic commerce protocols can constrain what an AI agent does without proving who truly stands behind the delegation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:40 pm
Cryptographic delegation does not solve identity assurance: AP2 and Verifiable Intent can define what an agent is allowed to do, but they do not prove whether the originator of the delegation is the right human or business. That means the protocol can be formally correct while still carrying synthetic or fraudulently claimed identity into the transaction. The practitioner conclusion is that trust in agentic commerce starts before authorisation, not inside it.
A few things that frame the scale:
- The agentic AI market is already worth $5 billion and is projected to reach $50 billion by 2030.
A question worth separating out:
Q: What is the difference between agent authorisation and identity verification in commerce?
A: Authorisation answers what the agent may do within limits. Identity verification answers whether the person or business behind that delegation is real, trustworthy, and appropriate to initiate the action. An organisation can have strong authorisation rules and still accept bad identity at the root of the chain.
👉 Read our full editorial: FIDO's agentic commerce blueprint exposes the identity gap