In the last eighteen months, the industry has shipped more agent acronyms than most banks ship features. ACP, UCP, AP2, TAP, MCP, A2A, KYA, PAP, PACT (three different ones, naturally). If your security team’s whiteboard looks like a ransom note, this post is for you.
Here’s the short version: there are six questions every agent interaction has to answer, a pile of protocols competing to answer each one, and a big gap between what’s been announced and what’s actually showing up at your front door.
The six questions
Forget the acronyms for a second. Every time an AI agent touches your site or app, someone has to answer six questions:
- Who are you? (identity)
- What are you allowed to do here? (authorization)
- How do you find and buy things? (discovery and commerce)
- What can you call? (tools and context)
- How do you pay? (payments)
- Who sent you, and did they really mean it? (binding to a human)
Most protocol round-ups skip question two. That’s the one a bank should care about most, and we’ll come back to it.
The scorecard
| Question | Main contenders | Status today |
|---|---|---|
| Who are you? | Web Bot Auth, Visa Trusted Agent Protocol (built on it), Agent Name Service, PACT (privacy-pass tokens), MoLE | Partly real. A few platforms sign requests; most agents don’t |
| What may you do? | MCP authorization (OAuth 2.1), OAuth token exchange, Rich Authorization Requests, CIBA, agent-delegation drafts | Real building blocks, no agent standard yet |
| How do you shop? | ACP (OpenAI, Stripe), UCP (Google, Shopify), Personal Agent Protocol (Meta, Sierra), Decagon’s PACT | Live for enrolled merchants, previews elsewhere |
| What can you call? | MCP, A2A, WebMCP | MCP is real. A2A is ready but quiet in consumer apps; WebMCP is early |
| How do you pay? | AP2, Visa Intelligent Commerce, Mastercard Agent Pay, Amex ACE, x402, Stripe’s Machine Payment Protocol | Pilots and live transactions, small volumes |
| Who sent you? | Mastercard and Google’s Verifiable Intent, KYAPay, Experian Agent Trust, device-bound enrollment | Mostly paper |
A quick tour of the highlights.
Identity is the most real, and still thin. Web Bot Auth lets an agent sign its HTTP requests and publish its keys so a site can check them. In an October 2026 survey, 55 of 150 AI crawler operators served a key directory. Among the consumer agents people actually use, though, only ChatGPT’s cloud browser signs consistently, and Google signs only a subset of its agent’s requests.
Commerce protocols are live, and already reshuffling. ACP launched with in-chat checkout in ChatGPT in September 2025; by March 2026 that checkout was scaled back and ACP mostly carries product feeds. UCP checkout went live in Google AI Mode and Gemini for eligible US merchants, and Copilot Checkout runs on its own stack. Meta and Sierra previewed the Personal Agent Protocol on October 6, 2026. Translation: if you picked a winner in January, you already picked wrong once.
Payments have real transactions, at pilot scale. All three US card networks now have agent programs. Mastercard has run live agent payments in several regions, Amex launched its ACE developer kit plus purchase protection for registered agents in April 2026, and Google’s AP2 is still mostly demos for everyday Gemini users.
Binding an agent to a real human is the least mature layer. Mastercard and Google introduced Verifiable Intent in March 2026. Experian announced Agent Trust in April 2026, with no commercial availability date. These are the right ideas, and they are not yet in your traffic.
Announced vs. arriving
Announcements are cheap. Here’s what the ten agents consumers actually use support today.
Legend: Live = in the product today · Pilot = announced, piloted or partner-only · — = no public evidence found
| Agent | Identify | Shop | Tools | Pay | Bind to human |
|---|---|---|---|---|---|
| ChatGPT agent (cloud browser) | Live: Web Bot Auth | Live: ACP (discovery) | Live: MCP | Pilot: Mastercard, Visa | — |
| Google AI Mode / Gemini app | Pilot: some requests signed | Live: UCP checkout (US) | Live: MCP | Pilot: AP2 | Pilot: Verifiable Intent |
| Gemini in Chrome | — | — | — | — | — |
| Microsoft Copilot | — | Live: Copilot Checkout, UCP | Live: MCP | Pilot: Mastercard, Visa | — |
| Perplexity / Comet | — | Live: PayPal Instant Buy | — | Pilot: Visa TAP | — |
| Claude in Chrome | — | — | Live: MCP | Pilot: Visa TAP | — |
| Meta Muse | Pilot: test key published | Pilot: Personal Agent Protocol | — | Live: Stripe Link, Shop Pay, PayPal | — |
| Amazon Alexa+ / Buy for Me | — | — | — | — | — |
| Manus extension | — | — | — | — | — |
| Open-source agents (browser-use, Playwright) | — | — | — | — | — |
Read the last column top to bottom. That’s the state of “who sent you” in production: a dash, nine times.
And here is real world data : less than 5% of the agentic traffic that Transmit Security monitors today is self declared.
So what?
Three things to take away. First, the protocols are real, but they cover the polite path: enrolled merchants, signed platforms, opted-in users. Second, the half of the stack a bank cares about most, authorization and binding to a human, is the least finished. Third, anything you build around a single protocol today should assume it will be renamed, merged or deprecated by next year.
Next time: why even a perfect protocol stack wouldn’t stop agent fraud.
