Preparing for agentic payments. 6 chapters and a final quiz.

Chapter 1. Reading a protocol’s real maturity.

The market won’t crown a winning agentic protocol anytime soon, so the useful question is a different one: which protocol can a team spend a quarter of development on without regret? You answer it with public evidence, never with announcements. In one hour, you can check that a dated specification exists, that a license is named, that a change process is written down, and that geographic availability is declared. A press release substitutes for none of those four proofs.

Six proofs to demand before writing the first line of code

• A versioned, dated specification you can read without an account or a nondisclosure agreement. A marketing page doesn’t count.
• An explicit license covering the specification text and the reference implementation.
• A written change process: who proposes a change, who decides, and how quickly.
• A runnable reference implementation, with a sandbox where you can reproduce a decline, not just a success.
• Declared geographic availability from the provider that will bill you. It is the criterion most often overlooked outside the US.
• A documented production transaction, dated and naming both parties. An announced pilot doesn’t qualify.

ACP deserves a closer look, because it sets the benchmark: five dated versions in just over six months, each describing a complete state of the specification. You can read the cadence in the repository, not in a keynote, so a team can pin a version, read it end to end, and know exactly what changed in the next one. That is what you should expect from a standard you plug payment collection into.

Chapter 2. The delegated mandate and the evidence it leaves.

A mandate is used at two moments, months apart: first when it authorizes the agent to spend, then when it defends the merchant against a dispute. The two uses have different requirements. The first can live with a short-lived object in memory; the second needs a dated, signed record that can be retrieved by order number. Design for the second, and the first will follow.

The seven fields of an enforceable mandate

These fields are not theoretical. Stripe’s shared payment token already carries them in production, available to agents, customers, and sellers in the US and Canada. The agent grants the seller a bounded right of use, described by a usage_limits object with only three limits, but the right ones: currency, maximum amount, and expiration date. The cap is set against the transaction total.

{
  "id": "spt_123",
  "object": "shared_payment.granted_token",
  "created": 1751500820,
  "deactivated_at": null,
  "deactivated_reason": null,
  "usage_limits": {
    "currency": "usd",
    "expires_at": 1788713710,
    "max_amount": 1000
  }
}

Two operational details belong in the design. The object carries a deactivation reason, and the seller receives the shared_payment.granted_token.deactivated event when the token is used, expires, or is revoked. A revoked token can no longer create a payment, so the withdrawal of authorization is a signal you receive, not something you infer. Any design that ignores that signal generates attempts that are doomed from the start.

The second example comes from a non-card rail, and it has a longer track record. On UPI, India’s real-time payment system, an AutoPay mandate carries its own identifier, the UMN. It has its own life cycle: creation, recurring executions, pause, revocation, expiration. Since August 1, 2025, NPCI has even restricted when mandates can execute, keeping them out of the peak windows of 10 a.m. to 1 p.m. and 5 p.m. to 9:30 p.m. The same model applies to agentic payments: a mandate is an object with a life cycle, not a flag set on a payment.

Chapter 3. Recognizing the agent at the front door.

The front door poses an asymmetric problem: blocking bots protects prices and inventory, but blocking a shopping agent destroys revenue. Both come through the same pipe, and a self-declared header distinguishes nothing, because anyone can copy it. The networks’ answer is to have every request signed. The merchant verifies a signature, then decides.

Visa’s Trusted Agent Protocol builds on RFC 9421, the standard for HTTP message signatures. Two headers carry the proof: Signature-Input describes what was signed, and Signature contains the result. The tag distinguishes intent: a browsing request is marked agent-browser-auth, while a request that commits to a payment carries agent-payer-auth. The merchant can therefore treat an agent reading a product page differently from an agent paying.

GET /products/headphones-nc700 HTTP/1.1
Host: shop.example.com
Signature-Input: sig1=("@method" "@authority" "@path");created=1791000000;expires=1791000420;keyid="ed25519-2026-08";nonce="9f2c1a";tag="agent-payer-auth"
Signature: sig1=:K2qGT5srn2OGbOIDzQ6kYT+ruaycnDAAUpKv+ePFfD0RAxn/1BUe:

Five checks to implement, in this order

• Presence and format: the signature fields exist, and the tag is agent-browser-auth or agent-payer-auth.
• Time window: the creation and expiration times fall within an eight-minute interval, in the right order.
• Nonce uniqueness: the nonce hasn’t been used before, checked against an eight-minute cache.
• Key resolution: the public key is retrieved and then validated.
• Cryptographic verification: the signature base is rebuilt, and the signature is validated against it.

Chapter 4. Avoiding declines: where an agentic checkout breaks.

An agentic checkout rarely fails at authorization. It fails earlier: the agent read a price in a feed, built a cart, and then presented a total the merchant no longer recognizes. Or the merchant took four seconds too long to respond. The causes are mechanical, so they can be fixed. But you have to name them before go-live.

Take the four-second budget seriously. An order approval endpoint that doesn’t respond within that time causes the payment to be declined (Stripe documentation, August 2026). Those four seconds must cover the inventory check, the risk assessment, and the decision. A synchronous call to a slow third-party service rarely fits, so precompute, cache, and keep the critical path short.

{
  "manual_approval_details": {
    "type": "declined",
    "declined": { "reason": "insufficient_stock_sku_48219" }
  },
  "metadata": { "mandate": "mnd_2026_08_07_4471" }
}

Idempotency is not a nicety here. A response in an unexpected format reaches the agent as an error, and some agents retry their calls. Without an idempotency key, a retry creates a second order: the customer receives two packages and files a dispute. The fix is a single design rule: every order attempt carries a key, and the same key always returns the same decision.

Chapter 5. Liability, contracts, and cost per order.

Liability is the wrong question when you treat it as pure law: it is settled first in the contract and in the evidence. A merchant that can produce the mandate, the signature, and the cart hash can defend itself; a merchant that can produce only a transaction ID absorbs the loss. The difference is decided at integration time, not when the dispute arrives.

Two of these points can already be checked in existing tools: agentic orders appear in the transaction list, tagged with the originating agent, and a filter isolates them. Refunds need no changes, because an agentic payment follows the standard flow (Stripe documentation, August 2026). On the network side, the payment instrument is still a tokenized card linked to an agent, a merchant scope, and a consent policy. Mastercard published this mechanism for Agent Pay on April 29, 2025.

Calculating the cost of an agentic order

# Working assumptions: replace them with your own contract terms
avg_order_value     = 80.00   # currency units
variable_fee_rate   = 0.019   # negotiated acquirer rate
fixed_fee           = 0.25    # fixed amount per transaction
decline_rate        = 0.06    # share of agentic orders declined
gross_margin        = 0.35    # margin on the average order
operating_cost      = 1200.0  # feeds, endpoints, monitoring, per month
orders_per_month    = 4000

processing_cost = avg_order_value * variable_fee_rate + fixed_fee
decline_cost    = (decline_rate / (1 - decline_rate)) * avg_order_value * gross_margin
fixed_unit_cost = operating_cost / orders_per_month

total_cost = processing_cost + decline_cost + fixed_unit_cost

print(round(processing_cost, 2))  # 1.77
print(round(decline_cost, 2))     # 1.79
print(round(fixed_unit_cost, 2))  # 0.30
print(round(total_cost, 2))       # 3.86

Look at the second line of the output: under these assumptions, declines cost as much as the acquirer fee. Gaining one point of success rate is then worth more than 10 basis points off the acquirer rate. That is why the previous chapter covers failures, not pricing. That’s where the leverage is.

Machine-to-machine payments run on different economics. One documented x402 implementation, for example, charges $0.01 in USDC per request, settled on Base, Solana, or Tempo. Access is open to businesses in every US state except New York, and in more than 30 countries on request (Stripe documentation, August 2026). With no interchange and no disputes, irreversibility changes the design: checks happen before payment, never after.

Chapter 6. Schemes, regulators, and sequencing the work.

Build a roadmap on what is published, dated, and enforceable. Everything else is monitoring. The timeline below includes only facts you can verify with their source: a scheme press release, a specification version, a regulatory text, a documented transaction.

Two lessons emerge from this list, and they pull in opposite directions. The schemes are moving fast and publishing usable specifications, while regulators have created no regime specific to agentic payments. In the European Union, PSD2 and the technical standards on strong customer authentication still apply as written (Osborne Clarke, 2026). In California, the law does the opposite of granting an exemption: whoever deploys the system is liable.

No-regret move or bet

One last point for readers operating outside the US. The best-documented agentic payments programs for sellers are still limited to the US and Canada, and the frameworks the schemes have published cover card tokens. Yet your local rail already has its own delegation primitive, whether it’s a UPI AutoPay mandate, a direct debit mandate, or a recurring authorization. These objects have a life cycle, termination reasons, and execution windows. Map them. The day the agentic channel opens in your market, half the work will already be done.