An AI agent buying on behalf of a person is not simply a faster browser. It is a delegated authority system.
The interface may be conversational, but the underlying transaction needs the same discipline as any other consequential business action.
Identity comes first
The system should be able to distinguish:
- the human or organization that owns the intent;
- the agent that is acting;
- the application or adapter carrying the request;
- the merchant or counterparty receiving it.
This identity context should stay attached to the transaction rather than disappearing after the initial API call.
Authority must be scoped
A user saying “handle groceries” does not necessarily authorize every possible grocery purchase. Authority may need limits for:
- amount;
- category;
- merchant;
- frequency;
- geography;
- substitutions;
- data sharing;
- time validity.
Delegated authority should be explicit, inspectable, revocable, and evaluated before execution.
Approval is part of the product
There will be actions an agent can complete automatically and actions that require confirmation. That boundary should be defined before the transaction, not improvised after something goes wrong.
The approval screen should show the information needed for a real decision:
- requested items or service;
- total and budget variance;
- substitutions or exceptions;
- policy reasons;
- counterparty and source evidence;
- what will happen after approval.
Approval is not a failure of autonomy. It is how the user controls the delegation.
Evidence closes the loop
The completed action must be connected back to the original request. That includes the final amount, receipt, fulfillment result, substitutions, timestamps, and any variance.
If the evidence is incomplete, the system should say so. A confident-looking success state is not enough.
The right mental model
Agentic commerce is closer to a governed workflow than an autonomous click path:
Request → Identify → Authorize → Evaluate → Approve → Execute → Verify → Reconcile
That model works across retail, business services, machine payments, and future transaction types.
What businesses should prepare now
Businesses can start before connecting checkout by making their operations agent-legible:
- Define products, services, prices, availability, and policies clearly.
- Document who may authorize which actions.
- Identify which steps require human approval.
- Create evidence and reconciliation requirements.
- Keep a record of exceptions and disputes.
The businesses that prepare this control layer will be better positioned as agentic channels expand.