The Fourteen-to-One Gap
Here is a pair of numbers that arrived in the same dataset, from the same payment processor, and have been quoted in the same breath ever since. Forty-two percent of merchants are running an AI shopping agent pilot. Three percent of transactions actually clear through one.
That is a fourteen-to-one gap between deployment and demand. The trade press has reported both figures as evidence that agentic commerce is arriving. They are not evidence of arrival. They are evidence of a gap nobody is describing, and in a tape that has been range-bound for the better part of two quarters โ where speculative capital is sitting in stablecoins waiting for a direction โ the market is pricing that gap as though it were a scheduling problem. It is not a scheduling problem. It is a loss-allocation problem wearing a user-experience costume.
A second number frames it more sharply. Consumer trust in an unresolvable AI purchase decision holds above the fifty-dollar line and collapses below it. Fourteen percent of consumers say they would let an agent transact without human verification. The forty-two percent of merchants building toward that future are building toward a cohort of fourteen.
The contract says this is a technology adoption curve. The data says it is an indemnity curve. Everything downstream โ the three-hundred-million-user forecast, the double-digit teen adoption rates, the eighty-nine percent of companies "preparing" โ inherits that framing error.
I have spent fourteen years on the wrong side of this trade, which is to say the forensic side. I pulled apart BitConnect's whitepaper in 2017 when I was twenty-one and traced its fund flows to nothing. I mapped the bZx v2 oracle manipulation in 2020 and wrote the post-mortem that argued "code is law" is a slogan invented by people who have never read a data feed's uptime log. I reverse-engineered Azuki's launch contract in 2021 and found fifteen percent of supply clustered in wallets traceable to the team. I led the TerraUSD forensics in 2022 and watched the same design flaw get marketed three more times in the following eighteen months. What every one of those audits had in common is that the failure was never in the layer everyone was arguing about. It was in the layer nobody had been asked to sign.
Agentic commerce has the same shape, and the signature is legible if you know where to look. The industry is hardening the rail that already works and leaving the rail that carries the actual risk completely unsigned.
What Agentic Commerce Actually Is โ And What It Is Not
The term covers three structurally different products, and conflating them is the source of most of the confusion in the current discourse.
The first is the recommender. You describe what you want in natural language; the system returns links. This is a search box with better grammar. It carries no financial exposure, no authorization, no liability. Adoption here is effectively universal already, and it tells you almost nothing about what comes next.
The second is the co-pilot. The agent assembles a cart, applies known discount codes, compares shipping windows, and then stops and waits. The human presses the button. This is where the majority of what gets called "agentic commerce" in 2025 production actually lives. It is a workflow tool. The authorization boundary is intact, which means the trust requirement is low and the three-percent conversion figure is not surprising โ it is exactly what you would expect from a product that converts a multi-tab browser session into a single-tab session.
The third is the agent proper. The system holds a payment credential, transacts on standing intent, and reconciles outcomes without the principal in the loop. This is the thing the forecasts are about. This is the thing that does not exist at scale.
The distinction matters because the reported adoption numbers do not respect it. When a survey reports that twenty-seven percent of teenagers use an AI agent for shopping, it is almost certainly measuring the first and second categories. When a payment network forecasts three hundred million people delegating purchases by 2030, it is describing the third. The two figures get stacked in the same bar chart. That is not synthesis. That is a category error with a decimal point.
What has changed materially in the last eighteen months is not consumer behavior. It is that the payment intermediaries decided this is their layer to own, and they started shipping. Mastercard, Visa, and the processor tier have all stood up agent-payment programs. Card networks have begun publishing agent frameworks that issue scoped, revocable credentials with merchant-category and amount ceilings attached. A major search-and-cloud incumbent shipped a protocol in late 2025 that formalizes shopping intent as a signed "mandate" โ a verifiable credential that says what the human authorized, for how long, and within what bounds.
Read that stack carefully, because it tells you where the industry believes the risk is. Every one of those initiatives is a credential and mandate layer. They are all solving authorization. Not one of them is solving context.
Autopsy of a Forecast: Tracing Three Hundred Million Back to Its Source
A forecast is a press release until you inspect its methodology. So let us inspect it.
The headline claim is that three hundred million people will delegate shopping to AI agents by 2030. The figure has circulated widely. The document supporting it, as reported, does not disclose the segmentation model behind it. What counts as delegation? Does a consumer who accepts a single agent-suggested substitution count? Does a consumer who uses a co-pilot once a quarter count? Is the denominator global internet users, global online shoppers, or the card network's own cardholder base? Is the three hundred million a stock at year-end 2030 or a cumulative-ever figure? Each of those choices moves the number by a factor of three in either direction.
I have written methodology critiques on crypto tokens that were more forthcoming than this, and those were tokens.
Now the supporting cast. The teen-versus-adult comparison โ commonly quoted as twenty-seven percent versus sixteen percent โ shows up across multiple quarters with no published instrument, no panel description, no weighting scheme. The eighty-nine percent of companies "preparing for agentic commerce" is the single least defensible number in the set, because "preparing" is not defined. A company that formed a working group, a company that ran a two-week API spike, and a company that has a funded program with a named executive sponsor all resolve to the same "yes" on a survey question. In my experience auditing enterprise security programs, the self-reported preparedness rate for any emerging technology has consistently run somewhere between three and ten times the rate of funded deployment. Eighty-nine percent is a sentiment reading, not a capacity reading.
The three-percent transaction figure has a different problem. It comes from a payment processor, which means the sample is that processor's merchant base โ merchants who, by virtue of choosing a modern, developer-first processor in the first place, skew heavily toward technical sophistication. If anything, three percent is plausibly an overstatement of the general merchant population's agent-mediated share.
Here is the structural point, and it is the one that matters for anyone positioning capital against this theme. Trace the provenance of every major number in this narrative and they terminate in the same three or four organizations: a card network, a payment processor, and a payment processor. The most aggressive forecasts about AI-mediated purchasing are published by the companies that collect a fee on every AI-mediated purchase. That does not make the forecasts false. It makes them un-audited by any party without a position.
I ran this exact analysis on the ICO prospectuses in 2017. The pattern is not that the numbers are fabricated. The pattern is that the numbers are produced by an interested party, gains a decimal point of false precision in each retelling, and by the fourth retelling has become a market consensus that nobody can locate the source of. By the time the correction arrives, the capital has already been deployed.
The Fifty-Dollar Boundary Is Not a Safety Control
Consumers tolerate agent autonomy below roughly fifty dollars and reject it above. This has been read as a psychology finding. It is not. It is an actuarial finding, and once you read it as one, the number stops looking arbitrary and starts looking computable.
Decompose the consumer's decision. Let p be the probability the agent gets it wrong โ wrong item, wrong size, wrong seller, counterfeit, or a legitimate item that arrives damaged. Let d be the cost of discovery, which is not the price of the item but the time to notice, the friction of the return, and the sunk time of the original task the agent was supposed to eliminate. Let r be the probability of recovery, which for most card transactions is high because the chargeback mechanism is mature, automatic at the issuer level, and requires nothing from the consumer but a phone call.
Expected loss is approximately p ร d ร (1 โ r). Below fifty dollars, the human's monitoring cost exceeds the expected loss โ it is cheaper to let the agent act and eat the occasional mistake. Above it, monitoring becomes worth the time, which is exactly what the data shows, and which is exactly what you would predict from a rational agent-free model. There is no mystery here. There is arithmetic.
That framing has a consequence the industry has not internalized. If the fifty-dollar boundary is a recovery-cost boundary rather than a price boundary, then the fastest way to raise it is not better models. It is faster, cleaner, more automatic reversals. The boundary moves when r approaches one and d approaches zero. Not when the model gets smarter.
And here is where the boundary stops being a threshold and becomes an attack surface.
An amount ceiling is a parameter. Parameters are visible to the agent, and anything visible to the agent is visible to anything that can influence the agent's context. In 2020, the bZx attacker did not break the oracle. The attacker supplied the price that the oracle faithfully reported, and the protocol executed exactly as designed. Broken inputs into faithful systems. That is the dominant exploit class of the last decade, and it applies here with uncomfortable precision.
Consider the shape. An agent holds a standing mandate with a fifty-dollar threshold requiring human confirmation above it. The merchant's product feed โ which is the agent's context โ is influenced by someone with an incentive. The agent finds a listing at forty-nine dollars and ninety-nine cents. It purchases four hundred units, one transaction at a time, each under the confirmation ceiling, each individually authorized by the standing mandate's plain terms. No rule was violated. The mandate did exactly what it said. The principal discovers the outcome when the card statement posts.
I have called this pattern threshold arbitrage. It is the same failure that let flash-loan attackers drain protocols that had passed audit: the code enforced its invariants perfectly against inputs it had no way to validate. When the industry reports that forty-two percent of merchants are "testing," I want to know whether the test plan includes adversarial contexts, or whether it only includes happy-path product feeds. Based on the disclosure quality of the aggregate numbers, I have very little confidence that it includes the former.
There is a second-order version that is worse. The agent's memory persists. If a malicious context poisons the agent's preference state โ not just the cart, but the model of what the user wants โ the exploit outlives the transaction. That is a persistence mechanism that has no analog in traditional card fraud, and no detection mechanism has been shipped to address it.
The Unsigned Rail
Now to the technical core, which is where the entire debate has been misfiled.
Agentic commerce runs on two rails. The first is the payment rail: the credential, the authorization, the settlement, the reversal. The second is the context rail: the product data, the price, the availability, the return policy, the seller's identity, the reviews, the shipping terms, the standing user preferences.
The payment rail is being hardened aggressively and competently. Scoped credentials with amount and category ceilings. Signed intent mandates. Verifiable presentations binding a human's authorization to a specific session. Revocation semantics. Audit trails. This is real engineering and it is being done properly.
The context rail is unsigned, unaudited, and unowned.
Think about what the agent actually reasons over. It is a context window assembled from this afternoon's scraped product pages and a tool-description layer that tells the model what functions it may call. There is no hash. There is no provenance chain. There is no attestation that the return policy the agent just summarized corresponds to the return policy the seller will enforce. There is no signature binding a price to the moment it was quoted, so there is no way to prove the price the agent saw. The payment leg will be cryptographically authenticated end to end, and the reason for the payment will be a natural-language string the model invented.
The agentic stack has a signed payment rail and an unsigned context rail, and every serious exploit will live in the gap between them.
This is not a hypothetical class. It has been demonstrated repeatedly in agent frameworks over the past year: instructions smuggled into tool descriptions, hidden text in fetched pages that the model treats as operator-level commands, and exfiltration paths where the agent's own tool access becomes the weapon. It is the same vulnerability class that bricked DeFi and it has exactly the same root cause. The system trusts its inputs.
I will use the phrase I use when people ask me why NFT valuation is mostly theater. NFTs are art until you inspect the metadata hash. Agentic commerce is a shopping assistant until you inspect the context attestation. And right now, there is no context attestation to inspect. In the current implementations I have reviewed, the agent's entire evidentiary record of why it bought something is a chat transcript. A transcript is not a provenance record. It is a story the system tells about itself.
This is where the crypto-native tooling is doing something genuinely useful and largely uncredited. There are now proposals for agent-identity registries with reputation and validation components attached โ an on-chain or ledger-anchored record of which agent did what, scored by counterparties. There are machine-payment schemes that make an HTTP request payable, which is a real primitive for agent-to-service commerce. These are attempts to build the missing attestation layer. They are early, the standards are unsettled, and most of the current implementations will be replaced. But the instinct is correct, and it is the correct instinct at the correct layer.
The problem is that the industry is building this identity layer for payments, where the authorization problem is already solved, and not for context, where nothing exists. Anyone building an agent-commerce product right now should be able to answer one question: can you produce, six months after the fact, a verifiable record of what your agent knew and when it knew it? If the answer is no, you have built a system with cryptographic payment integrity and no evidentiary integrity, and you will lose the first serious dispute.
The Legal Fiction of the Autonomous Buyer
There is a category of engineering conversation about agents as if they were parties. They are not. A machine cannot be a party to a contract under essentially any commercial code I am aware of, and the frameworks that contemplate automated contracting are explicit about it.
UETA handles this directly. Section 2(6) defines an electronic agent as a computer program used to initiate an action without review by an individual at the time of the action. Section 14 provides that a contract may be formed by the interaction of electronic agents even if no individual reviewed the resulting terms. Read those together and the legal position is clean: automated contract formation is valid, and the resulting obligation attaches to the human or entity that deployed the agent. The agent is a mechanism. The principal is the party.
That has an immediate consequence for every agentic commerce product on the roadmap. The consumer is not delegating to an agent. The consumer is acting through an agent, and the consumer is therefore liable for what the agent does. A product that markets itself as taking decisions off the consumer's hands while leaving legal responsibility on them is selling a feeling, not a service. That is not a trust gap caused by consumer psychology. That is a trust gap caused by the fact that the fourteen percent who say they trust the AI are being asked to accept a liability position they have correctly intuited is worse than doing the task themselves.
Now extend it to the failure modes, because this is where the industry's silence is loudest.
If an agent purchases a counterfeit, who bears the loss? Under current structure: the principal. If an agent confirms a non-refundable booking that the principal did not want? Principal. If an agent misreads a return window and the item becomes unreturnable? Principal. If an agent is manipulated by a poisoned context into a large but individually small series of purchases? Principal, unless the mandate ceilings are enforced at the issuer, and in most of the frameworks I have reviewed the ceilings are enforced at the agent โ which is the party that was compromised.
Enforcement at the compromised party is not enforcement. It is documentation. This is a point I have made about oracle design for five years and about stablecoin peg mechanisms for four: do not put the invariant check inside the component that is under adversarial influence. Put it in the layer that the attacker cannot reach. In agentic commerce, that means the credential issuer, not the agent runtime.
There is also the question of who answers when the agent's developer is not the deployer. If a model vendor ships a tool-use framework that a merchant deploys and an attacker exploits, is the vendor liable? If a standard is published without a security profile and implementers follow it, does liability travel up the specification chain?
I have a specific and unpopular position on this, formed watching the Tornado Cash litigation. When the Fifth Circuit held in late 2024 that immutable smart contracts are not "property" of a person and therefore fall outside the sanctions authority the Treasury had claimed, it did not merely correct one designation. It pushed back on a premise that had been quietly accepted across the industry: that code can be a defendant. If a contract cannot be a sanctioned person, it is very difficult to construct a coherent doctrine under which a developer is criminally liable for an adversary's use of a general-purpose tool. That is the correct outcome, and it matters enormously here, because the alternative is that every developer who publishes an agent framework becomes the insurer of every prompt-injection exploit against every deployment.
That regime would not produce safety. It would produce an absence of published frameworks, which produces worse security, because the tooling would move into unaccountable forks. Writing the tool is not the same act as running the exploit, and any liability structure that cannot distinguish them will make the system less safe while feeling more responsive.
Teen Adoption Is a Function of Who Absorbs the Loss
The teen-versus-adult adoption gap has been reported as enthusiasm. Twenty-seven percent to sixteen percent. Young people are digital natives, the story goes, and they adopt new interfaces faster. That is a comfortable explanation, and the data does not support it.
Run the cohort against the loss model I built above. Teenagers have the thinnest credit access, the smallest discretionary budgets, and โ critically โ the lowest exposure to downside. When a teen's agent buys the wrong item, the recovery path usually terminates on a parent's card and a parent's chargeback. The discovery cost is borne by someone else. The recovery is handled by someone else.
Under the model, the threshold at which delegation becomes rational is not fifty dollars for that cohort. It is undefined, because d, the cost of discovery, is close to zero for the person actually transacting. The cohort with the highest reported adoption is the cohort with the least skin in the loss. That correlation runs exactly opposite to the enthusiasm narrative and it is the single most important thing to understand about the reported teen adoption rate.
The same logic explains why forty-two percent of merchants are testing and three percent of transactions convert. The merchants are not testing a technology. They are testing a distribution channel, on a budget, without having taken on any obligation to make the channel work. A pilot is the cheapest way to hedge a narrative. When the narrative is the thing driving your category, the pilot is not evidence of a roadmap. It is a press-release asset with a cost center attached.
The adoption curve for real agentic commerce will not be shaped by who likes the interface. It will be shaped by who signs the loss. Every prior technology that required a consumer to accept a new liability position moved at the speed of the indemnity, not at the speed of the demo. Contactless payments took a decade past technical readiness, and the gate was not terminal availability โ it was who accepted the chargeback risk. Mobile wallets took fifteen years, and the gate was the same. I have watched three crypto cycles go through the identical mechanism, and I will tell you that the only variable that reliably predicts adoption timing is whether the person clicking is the person paying.
What the Crypto Rails Actually Contribute
Here I have to be harder on my own industry than the industry likes, because the reflex response to everything above โ inside crypto, at least โ is that stablecoins and on-chain settlement are the answer. They are half an answer, and the half they miss is the half that matters.
Start with what is genuinely true. Machine-to-machine payments are a real use case, and they are the first crypto use case I have seen in a decade that does not depend on a human caring about the asset. An agent paying for an API call, a data fetch, a compute slot โ that transaction has no meaningful minimum size, no business day, no wire cutoff, and no reason to involve a human. Card rails were designed around a merchant and a cardholder. Stablecoin rails were designed around no one in particular, which turns out to be a feature when the payer is a process.
The settlement leg is also where crypto's design choices stop being theoretical. Finality is a feature for a machine paying a machine for a deterministic service. It is a liability for a consumer buying a physical good with an uncertain delivery. I have said before that the RWA narrative has been a three-year storytelling exercise because institutions do not need a public chain to move a bond โ they need a permissioned ledger with a clearing member, and that is what they built. Agentic commerce will follow the same path. The consumer-facing trust layer will be a card network or a large platform, because those are the entities with an existing reversal mechanism and an existing customer relationship. The settlement underneath may well be a stablecoin, and the industry should stop pretending that is a victory lap. Being the settlement asset for someone else's product is a real business. It is not the same business as owning the consumer.
Which brings me to the thing crypto builders should actually chase, because it is the gap and it is unclaimed. The missing infrastructure is not faster settlement. It is machine-readable, cryptographically verifiable representations of commerce facts. A signed price. A signed availability assertion with a timestamp. A signed return policy. A signed seller identity, ideally with a staked bond attached that can be slashed when the assertion proves false and a dispute is adjudicated. In other words, an attestation layer with economic consequences attached.
That is a crypto-native construction. It requires a token or a bond or a slashing condition to have teeth. It requires an adjudication mechanism that is faster than a chargeback and cheaper than litigation. It is not something a card network is going to build, because a card network does not need to โ it already owns the reversal. But a card network would consume it, because a merchant who can prove their feed is untampered would win volume from an agent runtime that prioritizes verified context.
I have not seen a credible production implementation of this. I have seen three proposals that gesture at it, one of which is a standard-track submission that describes registries for identity and reputation and validation but leaves the dispute resolution entirely to the implementer. That is a specification, not a system. The difference between a specification and a system is the exact difference between the eighty-nine percent who say they are preparing and the three percent who are transacting.
The Royalty Precedent: Why Brand Value Will Not Be Enforced by Policy
The most-said thing about agentic commerce in retail circles is that brands fear commoditization โ that an agent optimizing for price and speed will strip the brand premium and push the category into a race to the bottom. The proposed remedy is that brands should encode their value proposition so that agents can represent it.
I have watched this exact plan fail before, and I watched it fail for a structural reason that nobody has fixed.
Dynamic NFTs and programmable royalties were going to solve creator economics. The mechanism was elegant: encode the enforcement in the contract, take a cut on every secondary sale, and let the market price the asset with the royalty baked in. What actually happened is that the enforcement point was a marketplace, the marketplace had an incentive to stop enforcing, and when a marketplace stopped enforcing, it gained volume against competitors who did not. The royalty did not fail because the contract was badly written. It failed because the party responsible for enforcing it was the counterparty with the opposite incentive.
Dynamic picture assets and programmable royalty streams sound sophisticated, but artists needed one thing โ stable buyers โ and no amount of contract cleverness manufactures a buyer.
The agentic commerce version is identical. A brand can publish its value proposition in whatever machine-readable format the industry settles on. It can attach a mandate policy saying "prefer authorized sellers," "preserve this price floor," "do not substitute." None of that is enforcement. The enforcement point is the agent runtime, and the agent runtime is controlled by a party whose incentive is to optimize the consumer's outcome โ which is, definitionally, to reduce what the consumer pays. The brand's encoded preference is a message. The runtime's objective function is the law.
This is not a crisis. It is a filter, and it is overdue. The uncomfortable arithmetic is this: a meaningful fraction of what gets called brand equity in consumer categories is really information asymmetry priced as a premium. Inconsistent SKU naming across retailers. Opaque bundling. Rebate structures that only a determined human can navigate. Loyalty pricing that is not a price at all. An agent that can normalize product identity across the entire market and compute a true landed-cost comparison destroys exactly that premium, and destroys nothing else. I spent a week of my life in 2021 reverse-engineering which wallets held a launch supply that the market believed was distributed, and I can tell you that the assets that survived the disclosure were the ones that had something underneath the story. Brands will find out the same thing, and the ones that fail the query did not have a defensible position โ they had a distribution advantage against a slower buyer.
Also worth saying plainly: the agent is a smarter shopper than any human has ever been, and it never gets tired. The sales floor was always a psychological environment optimized by one side. The agent is the first shopper in history that cannot be upsold, cannot be rushed, and cannot be made to feel that walking away is a failure. The premium that survives that is the only kind worth having.
What the Bulls Got Right
I have spent most of this piece on the numbers and the missing layers, so let me be precise about where the optimistic case is correct, because it is more correct than the skeptics are willing to admit.
The sequencing is right. The industry hardened authorization before context. That looks backwards to a security engineer, and in isolation it is, but it is the correct order for a market that must first establish that a machine can spend money in a legally legible way. Scoped credentials, signed intent mandates, revocation semantics, and audit trails are the preconditions for everything else. Without them, no merchant, no issuer, and no regulator would allow a transaction to originate from a process. Getting those shipped first is not evidence that the industry misunderstands the risk. It is the industry correctly identifying the gate that regulators will check first.
Second, the trust gap is not a permanent condition. Fourteen percent is a low number, and it is also the number you would expect from a market where no one has yet offered an indemnity. Every consumer trust metric in payment history has been a function of the reversal guarantee, not the interface. Contactless payments did not become normal because terminals got better. They became normal when issuers stopped making consumers file a form. When a credible party steps up and says "if the agent gets it wrong, you are made whole within one business day without a phone call," the fourteen percent will become a majority faster than any model improvement could deliver. That party is not obviously the card network, by the way. It could be a merchant, and the first merchant to offer an unconditional machine-purchase guarantee will buy a distribution advantage it cannot get any other way.
Third โ and this is the point the skeptics systematically miss โ the three-hundred-million figure may be roughly right even though its methodology is indefensible. Not because consumers will choose to delegate, but because merchants have already delegated. Product discovery has been algorithmically mediated for a decade. Search ranking, recommendation feeds, and dynamic pricing already determine what the overwhelming majority of buyers ever see. The agent does not introduce algorithmic mediation. It relocates the mediation from a ranking function that optimizes for engagement to a decision function that optimizes for the user's stated intent. That is a change in objective function, not a change in kind, and it is the single most consequential thing happening in retail. If the hundred-millionth consumer's willingness threshold moves from fifty dollars to five hundred, the forecast is not aggressive. It is conservative.
And the fourth thing the bulls got right: the thing being built here is genuinely useful infrastructure that will outlive the narrative. Verifiable mandates, machine-readable attestations, scoped credentials with clean revocation โ that is plumbing for an economy where processes transact. Some of the current projects will die. The layer will not.
Takeaway: The Party That Signs the Loss
The three-hundred-million-user forecast is not a lie. It is an un-audited claim from an interested party, which in my experience is worse, because it survives contact with a spreadsheet. The fourteen-to-one gap between merchant testing and transaction conversion is not a temporary friction. It is the market correctly pricing an unallocated liability. The fifty-dollar boundary will not move because a model got smarter. It will move when a specific legal entity signs a piece of paper that says the loss is theirs.
So the question I would put to anyone building in this space, and to anyone allocating capital to it, is not whether the agent can do the task. It can. The question is who is holding the loss when the context is poisoned, the mandate is exhausted, the four hundred units ship, and the principal is a seventeen-year-old whose card belongs to someone else. Name the entity. Write the clause. Publish the attestation format. Everything else in this sector โ the forecasts, the pilots, the eighty-nine percent preparing โ is a rehearsal for that one document.
Until it exists, the two most important numbers in agentic commerce are not three hundred million and twenty-seven percent. They are forty-two and three, and the distance between them is a signature nobody has offered to write.