Autonomous commerce security protects purchases and payments made by AI agents acting on a person’s behalf. It must establish who authorized the agent, what the agent may do, whether the action remains in scope, and what evidence exists if the transaction is challenged.
That is a different control problem from a conventional online checkout. The person may set instructions at one time, while the agent searches, selects and pays later. This entry explains the main risks, the controls emerging around agentic payments, and the role of identity, intent, authorization and transaction risk analysis.
Autonomous commerce security is the set of identity, authorization, fraud prevention, privacy and payment controls used when software agents act for buyers. It covers the period before an agent receives authority, while it shops, when it initiates payment and after the transaction is completed.
The central question is no longer only whether the account belongs to the right person. A bank, issuer, merchant or payment service also needs to assess whether the agent is legitimate, whether the instruction is authentic, and whether the completed action matches the approved conditions.
Autonomous commerce separates instruction from execution. A person may authorize an agent to buy a product below a defined amount, renew a service, or select an offer that meets specific conditions. The final transaction may happen later, when the person is not present.
Agentic commerce fraud can target several points in the delegation chain. An attacker could impersonate an agent, alter an instruction, exploit an overly broad mandate, compromise a payment credential, manipulate product or price data, or cause an agent to act outside the buyer’s intent.
Security teams must also distinguish legitimate machine activity from malicious automation. A genuine agent can look unlike a human shopper, while a criminal tool may imitate a permitted agent or use a compromised account. Human behavior alone is no longer a sufficient trust signal.
When bots break the rules: How banks can safely harness AI for growth explores the wider banking risks of AI agents, including automated abuse, data exposure and weak access controls.
Unclear intent makes disputes and fraud investigations harder because the transaction may not show exactly what the buyer approved. A broad instruction such as “find a good deal” requires additional rules about price, merchant, product, delivery and timing.
Merchants need a way to distinguish an authorized agent from an unknown bot or a hostile actor. Agent identity should be linked to a trusted operator, an authenticated user and a defined purpose.
A mandate is the authority granted to an agent. If it has no clear scope, expiry, spending limit or revocation path, a stolen or manipulated mandate can authorize more activity than the buyer intended.
Payment credentials should not become unrestricted keys to a buyer’s account. Tokenization, transaction limits and binding the payment instrument to approved context can reduce exposure when an agent or merchant environment is compromised.
Autonomous transactions need an auditable record of the instruction, agent, checkout terms, authorization and final payment. Without that chain of evidence, parties may struggle to determine what happened and who was responsible.
Safer autonomous commerce uses layered controls rather than a single approval event. The foundation is a trusted relationship between the person, agent, merchant, payment provider and financial institution.
| Control area | Security objective |
|---|---|
| Agent identity | Recognize the software actor and link it to an accountable operator or user. |
| Verifiable intent | Record what the person instructed the agent to do and under which conditions. |
| Scoped authorization | Limit products, merchants, amounts, payment methods, locations and time periods. |
| Transaction risk analysis | Assess behavior, device, account, payment and commerce context before execution. |
| Payment token controls | Reduce the value of exposed credentials and restrict how tokens can be used. |
| Audit and revocation | Track decisions, support investigation and let the user withdraw authority. |
Industry work is beginning to formalize these controls. The FIDO Alliance work on agentic authentication focuses on verifiable user instructions, agent authentication and delegated authority. EMVCo is examining how 3-D Secure, payment tokenization, Secure Remote Commerce and digital identity can support card based agentic payments in a trusted and interoperable way.
Authentication establishes confidence in an identity or device. Authorization defines what that identity or agent may do. Intent connects the approved action to the transaction details. Autonomous commerce needs all three relationships to remain clear.
Verifiable intent creates cryptographic evidence linking an authenticated instruction to the action an agent is authorized to take.
A trusted surface can help a person review an agent’s proposed action and authenticate approval in a controlled interface. The trusted surface concept is important because the shopping agent should not control the interface that displays the final terms or validates consent.
Authentication also needs to reflect risk. Entersekt’s Context Aware Authentication assesses transaction context, behavior, device signals and risk conditions so a financial institution can apply an appropriate control to a high risk action. That approach connects identity assurance to what the agent is trying to do.
No single standard has settled every question in autonomous commerce. Several initiatives are addressing different parts of the trust chain.
These initiatives should be treated as developing ecosystem work. Financial institutions still need to map each protocol to their own identity, fraud, payment, privacy, incident response and dispute processes.
Map the delegation chain, including the merchant, payment provider, and account or card involved. Define who authenticates each actor and who retains the evidence.
| Connect authority to the final payment | |||
|---|---|---|---|
|
1. Person → Authenticated instruction and approval |
2. Agent → Verified identity and accountable operator |
3. Defined mandate → Permitted actions, limits, and expiration |
4. Payment and evidence Transaction checked against authority; records retained |
Each link needs verification. Earlier approval does not remove the need to assess the final action.
Next, translate policy boundaries into transaction controls that restrict which payments may proceed and under what conditions. A useful policy can state the permitted merchant category, amount, currency, payment method, delivery location, recurrence and expiry. It should also specify when the agent must pause and request a fresh approval.
Finally, test failure conditions. Review compromised agents, altered product data, replayed mandates, unexpected merchant changes, account takeover, payment token theft and disputes. Controls should support fast revocation, clear customer communication and an investigation record.
Entersekt’s agentic commerce guidance connects these questions to authentication, transaction intent, payment risk and cross channel decisioning. The goal is to assess trust at the point of action, not assume that an earlier login settles every later decision.
Good security makes delegated authority understandable and controllable. Customers should know what an agent can do, how long its authority lasts, which payment method it can use and how to stop it.
Additional verification should match the risk of the action. A low risk reorder may need a different treatment from a new merchant, high value purchase or change to a payment destination. Context aware decisions can protect the transaction while avoiding unnecessary interruption.
Entersekt connects authentication, risk intelligence and payment security across digital banking and payment interactions. Its Context Aware Authentication adjusts the authentication method using real time risk assessment, user preference, channel and transaction context.
That model is relevant to autonomous commerce because a successful login does not establish that every later agent action is safe. Entersekt’s digital banking authentication capabilities can add assessment before and after login, including for high risk transactions where intent and account integrity need closer review.
Four shifts redefining trust in digital payments explores this broader transition toward decisions that connect identity, intent, risk and evidence as the traditional checkout becomes less visible.
Autonomous commerce security depends on verifiable delegation. The critical controls link a person to an agent, an agent to a defined mandate, a mandate to transaction conditions and a payment to auditable evidence.
Financial institutions that prepare early can shape safer agentic journeys around clear authority, risk based authentication, payment controls, privacy and revocation. The objective is accountable automation that earns trust at every important decision.
The biggest challenge is proving that an agent’s action matches the user’s authorized intent. Identity alone does not explain what the person permitted, how long that permission lasts or whether the final purchase stayed in scope.
Agentic commerce allows software to search, select and initiate purchases for a person, sometimes after the person has left the checkout. That separation makes delegated authority, agent identity and transaction evidence central security concerns.
Authentication is important, but it cannot address every autonomous commerce risk by itself. Entersekt connects authentication to transaction context and risk decisioning, helping financial institutions assess high risk actions beyond the initial account access event.
Verifiable intent is evidence that links an authenticated person’s instruction to the action an agent takes. Entersekt’s context aware approach complements this model by assessing whether the transaction behavior and surrounding signals match the expected action.
Revocation lets a person or institution withdraw an agent’s authority when circumstances change or compromise is suspected. Entersekt’s cross channel authentication model can support stronger controls when a high risk interaction requires renewed assurance.