Mastercard's Agentic Commerce Trust Paper, Explained: The 5 Proofs Every AI Agent Purchase Needs
Robauto Team · Published · Last updated
Mastercard's new white paper says trust, not technology, caps the agentic economy. We break down its five-proof Agent Pay Trust Framework, the programs it names, and what brands should do to welcome verified AI agents.
Mastercard just published a 16-page white paper, Trust for agentic commerce: Powering secure value exchange in a world where AI agents shop, pay and act on our behalf (PDF, dated September 2026; announced September 30, 2026). Its thesis fits in one line from the executive summary: "The ceiling of the agentic economy is not technology. It is trust." Here's what it argues, what it proposes, and what we think it means for brands.
The core argument: a valid card no longer proves a valid decision
The paper cites two third-party forecasts: ICSC and McKinsey project agentic commerce in US consumer retail "could reach $1 trillion in revenue by 2030," and Gartner expects AI agents to intermediate "more than $15 trillion in B2B spending by 2028" (paper, pp. 2 and 4).
The key idea is subtle. In agentic commerce, the paper says, authority "attaches to each action an agent takes, not to the agent itself." An agent can be legitimate and hold a valid credential while a specific purchase is still unauthorized. Or, in Mastercard's words: "A valid payment credential no longer proves a valid decision" (p. 4). So the questions change: who is acting, on whose behalf, with what authority, under what limits, and who is accountable if something goes wrong?
The paper walks through two example journeys. In one, a household AI assistant buys a birthday gift under $75. In the other, a manufacturer's sourcing agent keeps a production line supplied, paying across card, account-to-account and sometimes stablecoin rails (p. 5).
The Mastercard Agent Pay Trust Framework: five proofs
Mastercard's answer is the Agent Pay Trust Framework, which has five capabilities. Each one produces "tamper-resistant proof the ecosystem can check" (p. 2). Identity, intent and controls come before the agent acts. Trusted execution happens as the money moves. Intelligence runs "after and all around" (p. 6).
1. Identity: who is acting, and on whose behalf?
At first contact, the paper notes, "a good agent and a hostile bot look almost identical." Mastercard's answer is identity built "as infrastructure, not a login." It names an Agent Portal and Registry where developers register agents, Know Your Agent / Know Your Merchant / Know Your Customer (KYA/KYM/KYC) checks through Mastercard Credential Service, and a Merchant Product Catalog that grounds discovery in "real merchants and real products instead of scraped guesswork." Verification works in both directions: the agent proves who it is, and so does the merchant (p. 7).
2. Intent: what exactly was authorized?
Suppose you said "under $75" and the agent found the right gift at $90. Without evidence, "every disagreement becomes the agent's word against everyone else's." Verifiable Intent is described as an open-source, privacy-preserving cryptographic framework. It creates tamper-resistant proof of what was approved, including the item, budget and timing. Selective disclosure means each party sees only what it needs, and Payment Passkeys confirm that the approval came from the user. Agentic Disputes then uses that audit trail to settle problems. It also names Insight Tokens (consent-bound personalization) and Agent Pay for Machines (auditable promise-to-pay records). Our favorite line from the paper: "The agentic economy will scale at the speed of recourse, not only the speed of execution" (p. 8). On a separate page, Mastercard says it co-developed Verifiable Intent with Google and describes it as "aligned with Google's Agent Payments Protocol (AP2) and Universal Commerce Protocol (UCP) and designed to be protocol agnostic" (Mastercard).
3. Controls: what is the agent allowed to do?
"Delegation starts narrow... and earns its way wider." Agent Controls build budgets, categories, time windows and conditions into the transaction flow itself. The gift agent holds $75 for one gift, while the sourcing agent holds a quarterly budget for approved suppliers only (p. 9).
4. Trusted execution: can the transaction itself be trusted?
Tokenization means "the real credentials are never shared." The Acceptance Framework gives merchants, acquirers and issuers shared rules to treat agent-led transactions "as first-class rather than anomalies to decline." Agent Connect and the Agentic Toolkit connect agent platforms, merchants and developers to these services, on any rail (p. 10).
5. Intelligence: can risk be seen as agent behavior evolves?
"Most of the agents the ecosystem will meet have not been written yet." Mastercard's agentic trust and intelligence services, Fraud Models for Agentic and Recorded Future safeguards are meant to spot bad actors without treating every agent as a threat. For agents that were never onboarded, behavior signals give visibility, but the paper is clear this "does not extend trust to the agent" (p. 11).
Two ideas worth stealing: proportionate decisions and accountability as evidence
First, if any proof is missing, "the secure default is refusal": merchants block good agents and issuers decline good transactions. With all five proofs in place, the answer no longer has to be yes-or-no. A transaction can be approved as asked, approved with narrower limits, sent back for confirmation, or declined. Second, "Accountability is not a sixth proof. It is what the five leave behind." Evidence created before and during a purchase is what resolves problems afterward (p. 6).
The paper also introduces an Agent Pay Ready mark, a visible signal for agents and merchants that meet Agent Pay program requirements (pp. 2 and 5). Per the paper, Agent Pay was announced in April 2025 with the US as its first market, with live milestones since in Europe, Latin America, Korea, Singapore and Australia. It rests on three principles: consistent proof (Verifiable Intent as an open specification, contributed to the FIDO Alliance), known actors, and bounded autonomy (p. 13).
| Trust problem | Mastercard's proposed answer | What brands can do (our interpretation) | Source |
|---|---|---|---|
| Good agents and hostile bots look alike | Agent Portal and Registry; KYA/KYM/KYC; two-way verification | Publish verifiable identity for your own site and agents; don't block every bot by default | p. 7 |
| Agents shop from scraped guesses | Merchant Product Catalog: structured, agent-readable products, pricing, availability | Ship clean structured product data and a sitemap agents can crawl | p. 15 |
| "What did the user actually ask for?" | Verifiable Intent + Payment Passkeys; Agentic Disputes | Make price, returns and shipping policies machine-readable so the order an agent approves matches your terms | p. 8 |
| Unlimited agent spending | Agent Controls: budgets, categories, time windows | Show exact totals (tax, shipping) up front so agents can check against their limits | p. 9 |
| Credential exposure; agent orders declined as anomalies | Tokenization; Acceptance Framework | Ask your PSP about accepting agentic tokens; expose a checkout agents can reach | p. 10 |
| New and unknown agents; evolving fraud | Agentic trust and intelligence services; Fraud Models for Agentic; Recorded Future | Log agent traffic separately so you can see which agents visit and convert | p. 11 |
What this means for brands (Robauto's view)
This section is our interpretation, not Mastercard's guidance. The paper makes a direct prediction: "demand will quietly route around" merchants that aren't ready for agent-led transactions (p. 14). Networks build the proofs; merchants still have to be discoverable, readable and checkout-able by agents. In practice:
1. Discoverable policies. Publish returns, shipping and pricing rules in plain, machine-readable form, for example in an llms.txt brief. Verifiable Intent records what a user approved, and your stated terms are what that approval gets checked against.
2. Structured product data. Mastercard's own Merchant Product Catalog exists to replace "scraped guesswork." Schema.org product markup and accurate availability are the do-it-yourself version.
3. Agent-facing endpoints. MCP server cards, A2A agent cards, OpenAPI documents and commerce discovery files (ACP, UCP) tell an agent what it can do on your site. Mastercard says it has joined Google's UCP and works with OpenAI's Agentic Commerce Protocol, among others (Mastercard, Jan 20, 2026).
4. A checkout that accepts verified agents. The paper's warning that "the secure default is refusal" applies to your bot rules too. Separate verified agents from abusive bots so you don't decline good demand.
Most sites aren't there yet. The latest Robauto Agent Readiness Index run (September 27, 2026) puts the median at 20 out of 100 across 79 scored top sites (99 attempted, 20 blocked). A scan of walmart.com today scored 28/100, with 0 of 5 Agentic Commerce checks passing (see also UCP cart transfer: retail domains still 0 of 5). Agents are already showing up: 22.18% of page views across the Robauto network over the last 90 days came from AI agents (Robauto AI search data; more on who's visiting in OpenAI Dots vs Meta Muse vs Grok Bot). One more note: our scanner was blocked by mastercard.com's bot management today, so we can't grade it.
A small terminology note: the paper lists "AEO from Dynamic Yield," which its appendix defines as "AI-driven experience optimization." That is different from answer-engine optimization, the AEO Robauto writes about (p. 16).
Agent-ready summary
{
"paper_title": "Trust for agentic commerce: Powering secure value exchange in a world where AI agents shop, pay and act on our behalf",
"publisher": "Mastercard",
"date": "September 2026 (announced 2026-09-30)",
"framework": "Mastercard Agent Pay Trust Framework",
"key_principles": ["Identity", "Intent", "Controls", "Trusted execution", "Intelligence"],
"build_principles": ["Consistent proof", "Known actors", "Bounded autonomy"],
"named_programs": ["Agent Pay", "Agent Pay Ready mark", "Verifiable Intent", "Agent Controls", "Agent Pay for Machines", "Acceptance Framework"],
"source_url": "https://www.mastercard.com/us/en/news-and-trends/Insights/2026/mastercard-agentic-commerce-trust-white-paper.html"
}The bottom line
Mastercard's paper boils down to five questions an agent purchase has to answer: who is acting, what was authorized, what is allowed, was the payment secure, and can risk still be seen. The payment networks are building the proofs. Brands need to make sure agents can find them, read them, and complete a purchase on their site. Scan your site free at robauto.ai/scan to see where you stand on agent readiness, including the Agentic Commerce tier.
Sources
- https://www.mastercard.com/us/en/news-and-trends/Insights/2026/mastercard-agentic-commerce-trust-white-paper.html
- https://www.mastercard.com/content/dam/mccom/shared/news-and-trends/stories/2026/trust-for-agentic-commerce-white-paper/Trust%20for%20agentic%20commerce%20white%20paper.pdf
- https://www.mastercard.com/europe/en/news-and-trends/stories/2026/verifiable-intent.html
- https://www.mastercard.com/global/en/news-and-trends/stories/2026/agentic-commerce-rules-of-the-road.html
- https://robauto.ai/agent-readiness-index
- https://robauto.ai/ai-search-data
- https://robauto.ai/scan?url=walmart.com
Where can an agent get this data live?
Robauto MCP — Agent Intelligence & Brand Discovery Infrastructure. A public, stateless Streamable HTTP endpoint at https://mcp.robauto.ai/mcp, callable with no key. Setup and the full tool list are in the Robauto MCP directory.