I spent an evening doing what nobody in the press release did: I ran the six signatory names against corporate registries.
ASB Bank is a wholly-owned subsidiary of Commonwealth Bank of Australia. The document that landed with six logos contains five independent institutions. Of those five, exactly one โ Bank of America โ carries the Financial Stability Board's G-SIB designation. Not one of the world's twenty largest banks by assets sits at the table. Not JPMorgan. Not HSBC. Not Citi. Not a single institution from the EU, mainland China, Japan, Singapore, or the Gulf.
Then I did what I do with any spec sheet: I traced the numbers. The framework arrives trailing five headline statistics โ 89% of merchants "preparing," 3% of transactions actually agent-mediated, 24% consumer trust, a 144:1 non-human-to-human identity ratio, 78% of organizations running no machine-identity policy. Five figures, zero cited sources. The 144:1 number sits more than an order of magnitude from CyberArk's 2024 measurement of 45:1.
That is the noise floor. Now let's find the signal.
On September 22, six banks published a document titled "Building Trust in Agentic Commerce." I flag the date honestly โ it sits past my working knowledge baseline, and the event itself is single-sourced. But the architecture it describes is not novel, and that is precisely what makes it auditable.
"Agentic commerce" is the category where an AI agent โ not a human โ initiates a purchase. You tell your assistant to reorder a specific filter, compare three vendors, and buy under a hard price ceiling. The agent parses intent, matches merchants, and executes payment. The 2025 machinery for this already exists. Visa shipped its Trusted Agent Protocol with HTTP Message Signatures (RFC 9421) and Web Bot Auth. Mastercard shipped Agent Pay with agentic tokens and tokenized card numbers. Google opened AP2 with three verifiable Mandate types โ Intent, Cart, Payment. OpenAI and Stripe built the Agentic Commerce Protocol. W3C's DID/VC stack, OAuth 2.0 Token Exchange (RFC 8693), Rich Authorization Requests (RFC 9396), and Anthropic's MCP were all sitting in the toolbox.
The banks' contribution is five "pillars": transparency, security, privacy and data, choice, and interoperability. Read those words again. They are goals, not schemas. No data model. No API contract. No test vectors. No reference implementation. No explicit mapping to any single item in that toolbox. In technical-readiness terms, this sits at TRL 2โ3 โ concept formation. The document concedes as much by announcing it will wait on the NIST AI Agent Interoperability Profile, due Q4 2026, to supply the technical scaffolding.
Code does not lie, but it does hide. Here the code isn't hiding. There isn't any yet.
Let me get specific, because the whole story lives in what the pillars don't say.
First: there is no root of trust. Cross-institutional agent transactions need someone to issue the credential proving an agent is what it claims to be. A bank? A card network? A government registrar? The framework is silent. That silence is not an oversight โ it is the single most consequential unresolved question in the document, because whoever signs the credential collects the rent. There is also no revocation mechanism: how does a human withdraw authorization from an agent already mid-flight? The "choice" pillar points only at preventing market domination, never at a user's dynamic right to pull the plug. That is the exact seam where agentic commerce will first bleed.
Second: the only clause with technical teeth is the attribution rule. "Liability should reflect where the risk or error was introduced." Elegant sentence. Now operationalize it. You need a four-stage verifiable, tamper-evident chain: the human's authorization, the agent's intent log, the merchant's interaction record, the final payment instruction. I have built audit trails for a zero-knowledge compliance layer, stress-tested across 10,000 simulated transactions for an institutional client, and the hard part was never logging. The hard part is that six banks run six incompatible stacks. Without a shared attestation format โ SPIFFE/SPIRE-style workload identity, machine-verifiable credentials, signed intents โ "where the error was introduced" stays a legal fiction rather than a queryable fact.
Third โ and this is where my own domain cuts in โ the framework never names the rails it is competing against. Google's AP2 is open source. Pair it with stablecoin settlement or real-time on-chain payment and you bypass card interchange entirely. If agent-to-merchant value settles on a tokenized-dollar rail, the bank's trust layer has no toll booth to stand in. During the 2022 drawdown I optimized opcode efficiency for a Layer2 rollup and cut transaction costs 18% in a live environment two years before this document existed. The lesson was structural, not mechanical: infrastructure that doesn't own the execution path doesn't own the economics. The banks are trying to write governance over a settlement layer they increasingly don't control.
Fourth: the "144:1" figure is a category error dressed as scale. That ratio measures service accounts, API keys, and machine certificates โ Non-Human Identities. It does not measure AI agents executing commerce. Conflating an NHI census with agentic-commerce volume is how you manufacture an urgent-sounding problem with no source attached. In a bear market, unverifiable scale claims are the loudest tell that a thesis runs on narrative rather than data. Same with 89% merchant "readiness" โ "preparing" is a survey answer, not a deployed integration. Willingness minus behavior is running at roughly thirty-to-one.
The one place the document exceeds expectations is liability. Most governance PDFs skip it. But liability without a mechanism is a value statement, not a control. Ask the questions the file leaves open: Is an agent transaction inside the existing chargeback system? If not, what is the consumer's remedy? Who holds the loss when a prompt injection redirects funds? Does "Know Your Agent" create a new licensing category, and who issues agent credentials? How does any of this satisfy PSD2 strong customer authentication when the consumer is not present? None of these have answers.
Now the honest crypto angle, since I know why this lands in a blockchain feed. This document contains zero tokens, zero chains, zero protocols. It belongs here anyway, because the fight it pre-announces is the same fight on-chain rails have run against card networks for a decade. When I mapped Curve Finance's invariant math in 2020 โ risking $15,000 of my own capital to probe slippage edges and surface a timing vector โ the lesson was structural: whoever writes the settlement logic writes the fee. The six banks are trying to write the settlement logic. The open protocols already wrote theirs.
Score the map, because the network-effect math is brutal:
- Card networks (Visa, Mastercard): control authorization and tokens; enforced through network rules.
- This bank coalition: controls a trust and liability frame; enforcement โ none.
- Tech platforms (Google, OpenAI, Amazon): control the agent entry point and intent parsing; leverage โ user scale.
- Open and crypto protocols (AP2, x402, MCP): control open specs; leverage โ community adoption.
- Regulators (NIST, EU, China): leverage โ law.
A standard's value compounds with its adopter count. The banks launched a voluntary, untimed, cost-free commitment. Functionally, they bought an option: marginal cost โ a PDF; upside โ first-call positioning if the category detonates. I have watched this pattern through every bull-to-bear transition since 2017, where I spent fourteen nights reading successor-contract Solidity by hand and found three reentrancy flaws the exchanges missed. Institutions hedge with language first, then wait to see which way liquidity moves.
Here is the part nobody wants to hear, least of all the banks.
The most counter-intuitive pillar is "choice" โ the anti-monopoly clause. An oligopoly writes an anti-monopoly provision, which reads like humility. Read it structurally and the intent flips. The real target isn't protecting merchants from concentration; it's protecting incumbent banks from being concentrated out. The clause exists to stop any single tech platform or card network from owning the trust layer outright. That is not a principle. That is a moat drawn as a principle.
And the blind spot beneath the blind spot: agent commerce moves risk from after-the-fact dispute to before-the-fact authorization. A card transaction carries chargeback reversibility. An agent transaction, once it moves funds on a misread intent, carries almost none. The transparency pillar says merchants should "know when an agent is acting" โ but nothing says who eats the loss when a prompt injection hijacks an agent into transferring to an attacker-controlled merchant ID. That surface is unique to agent commerce, has no mature defense, and appears nowhere in the file. Redundancy is the enemy of scalability, but here the missing redundancy is the consumer's last line of defense.
Volatility is the price of entry, not the exit โ except this volatility is legal, not price. The consumer-protection apparatus of chargebacks and dispute rules was built for humans who remember clicking buy. It cannot referee a decision an agent made in 400 milliseconds.
Ignore the press release. The only question that matters is whether the follow-up implementation document contains normative language โ actual shall and must clauses, with test cases and a reference implementation โ or another round of principles.
If it's principles, this collapses into a consulting opinion the moment NIST publishes something real. If it's normative, someone just drafted the contract layer every agent will sign against. Logic gates are the new legal contracts. Watch the modal verbs. They tell you whether this is infrastructure or theater.