Let’s talk about the week the card networks started issuing passports to machines — and why the signature on them is not yours.
On the second of September, Anthropic published a blueprint for commerce agents on Claude. Reference implementations — a shopping agent and a merchant agent — covering catalogue, cart, checkout, preferences, order history. Early names attached to it: Shopify, Visa, Mastercard.
On its own, that’s a product announcement. Read it next to the other three headlines from the same fortnight and it stops being one.
The FIDO Alliance is drafting interoperability standards for agentic commerce — it ran a panel on it in Singapore with Google, Visa and Mastercard in the room. EMVCo, the body that writes the card specifications the whole world settles on, has published a framework for card-based agentic payments and opened it for industry feedback until the thirtieth of this month. Visa has been piloting Intelligent Commerce since April last year and is now extending its payment passkeys into agent commerce.
Four separate efforts, one shared question underneath all of them. How does a merchant know that this machine is authorised to act for that human?
Sit with that for a second. It’s a very good question, and it’s being answered very fast.
Think about the old way.
You stood at a counter. You handed over a card. The card had your name on it, which meant almost nothing, and the bank’s mark on it, which meant everything. Authorisation was a signature or a PIN — produced by you, in the moment, for that one purchase, visible to the person on the other side of the counter.
Now picture the new way, because it’s already here and mostly invisible.
You tell your agent to buy a replacement cartridge. It goes off, compares three merchants, adds a thicker one to the cart, and checks out at two in the morning while you’re asleep. And somewhere between your instruction and the merchant’s till, four standards bodies are trying to work out what proof should travel with that purchase — proof of which agent it was, proof of whose authority it carried, proof that the human behind it meant it.
Right now, the answer is borrowed. The agent carries your identity. It acts under the account holder’s name. The industry says so in its own writing: there is no credential for the agent itself yet. Which means the thing standing at every checkout in this economy is currently wearing your face.
So the frameworks are being built. And that part is necessary. If a machine can spend your money, someone has to be able to tell a merchant that this particular machine, this version, with this scope, was allowed to do it.
Here’s what almost nobody is saying out loud.
The trust layer is being written by the people who get paid when the transaction completes.
Not a conspiracy. Just an incentive. Who funds a standard? The party with the most to gain from it existing. Card networks, processors, platforms. So the definition of a trusted agent is being shaped by the businesses whose revenue is the transaction, and whose worst outcome is friction at the checkout.
We have watched this exact architecture get built before, and it wasn’t about machines.
It’s called KYC. Know your customer. Written to protect institutions from the person on the other side of the desk. Three decades later it’s the reason a huge number of ordinary people can’t open a basic bank account — the compliance burden got pushed down the chain until serving anyone unprofitable became irrational. The rule survived. The intent quietly changed who was allowed in.
Now run the same movie forward with KYA. Know your agent.
Version one protects the merchant. Version two protects the network. Somewhere around version three, the question stops being “is this agent authorised” and becomes “is this human worth issuing an agent credential to at all.”
That’s the part people are missing.
The unbanked. The thin-file. The person whose identity was already stolen once and now carries a flag on it. In a world where your agent’s capability depends on a credential somebody has to issue for you, capability becomes a function of your file. Not your competence. Not your intent. Your file. And the people with the least leverage get the least capable agents — a gap that widens quietly, one standard at a time.
There’s also a very ordinary lock-in shape to all of this. If checking out in the default channel requires a network-issued agent credential, your machine’s ability to act in the world becomes a permission held somewhere else. Your agent turns into a node inside someone else’s perimeter. And your consent — the actual thing you meant when you said “buy the cartridge” — gets compressed into a token, with terms set inside a framework you were never a party to.
So take the operator lesson. It’s short.
If you’re building on this, treat the checkout permission like the new API key. Assume it’s held by somebody else. Assume it can be re-scoped the day a standard updates. And design your product so the human’s own key is the one that matters — scoped, revocable, auditable, and written in a form they can actually read.
For everyone else, the question isn’t whether the agent can be trusted. It’s who gets to decide which agents count as trustworthy, and what happens to you on the day the answer is no.
One practical test to run against any of these frameworks when they land: can the human revoke the agent’s authority without cancelling a card, closing an account, or abandoning the channel entirely? If the answer is no, what’s being built isn’t consent. It’s a permission slip, and the machine is holding it.
The principle underneath is older than all of this. Consent issued by the counterparty is not consent. It’s a term of service with a nice logo on it. Authority has to come from the person — granted, scoped, revocable, provable, and without handing over a copy of yourself to get it.
You are not going to stop the machine from buying things for you.
But you should be able to see the passport it’s carrying, and you should be the one holding the pen. You’ve got this.