Mastercard Named Five Trust Pillars. Visa Scores 14. Mastercard.com Is Blocked.

Robauto Team · Published Oct 2, 2026 · Last updated Oct 2, 2026

Mastercard’s Agent Pay Trust Framework lists identity, intent, controls, trusted execution, and intelligence. Live Robauto Agent Scans still show Visa at 14 and Stripe/Shopify at 0 of 5 commerce — while mastercard.com blocks the scan.

Mastercard just published five pillars for trusting AI agents with money — and a read-only Agent Scan of mastercard.com still hits a 403 bot wall. Live Robauto scores put visa.com at 14 with Agentic Commerce 0 of 5. The white paper asks the right questions. The open web has not answered them yet.

The Agent Pay Trust Framework’s five pillars

On September 30, 2026, Mastercard published Trust for agentic commerce, introducing the Agent Pay Trust Framework. Finextra’s October 1 interview with Ann Johnson (EVP, security solutions, Mastercard) spells out the same five layers:

Johnson’s framing in the Finextra interview is blunt: trust determines scale. “Finding a pair of shoes through an agent is one thing, but trusting the agent to spend your money is another.”

Finextra also cites the scale forecasts Mastercard is working against:

• McKinsey + ICSC: agentic commerce in US consumer retail could reach $1 trillion by 2030
• Gartner: AI agents to intermediate more than $15 trillion in B2B spending by 2028
• One in 10 consumers projected to routinely use AI agents to make purchases by 2030

That is the payments-network view of trust. Merchants still have to publish machine-readable surfaces those agents can discover on the open web.

Live Agent Scans, October 2, 2026

We ran fresh Robauto Agent Scans (~15:30 UTC). Agentic Commerce covers x402, ACP, UCP, AP2, and MPP:

Networks and processors that shape how money moves still score in the teens and twenties on agent readiness, with commerce discovery at 0 of 5. Blocking a scanner is a legitimate ops choice — and it is also a decision about whether agents can see your trust story at all. Ceiling examples publish the full stack, including commerce discovery at 5 of 5.

Map the five pillars to what brands can ship

Issuers own identity tokens, intent proofs, and risk intelligence. Brands still win or lose on whether an agent can find honest, machine-readable surfaces without a human pasting a URL:

A practical shipping order: Signal Basics first (robots, sitemap, llms.txt, readable HTML), then Agent Integration (MCP / agent card), then Agentic Commerce (x402, ACP, UCP, AP2, MPP). Trust papers raise the ceiling; discovery documents raise the floor.

{
  "as_of": "2026-10-02",
  "thesis": "trust_pillars_named_open_web_commerce_still_0_of_5",
  "mastercard_agent_pay_trust_framework": {
    "pillars": ["identity", "intent", "controls", "trusted_execution", "intelligence"],
    "source": "https://www.mastercard.com/us/en/news-and-trends/Insights/2026/mastercard-agentic-commerce-trust-white-paper.html"
  },
  "finextra_forecasts_cited": {
    "us_retail_agentic_commerce_2030_usd": "1_trillion",
    "b2b_agent_intermediated_2028_usd": "15_trillion_plus",
    "consumers_routinely_using_agents_to_buy_2030": "1_in_10",
    "source": "https://www.finextra.com/the-long-read/1774/how-banks-build-trust-in-agentic-commerce"
  },
  "brand_checklist": {
    "identity": ["llms.txt", "agent_card"],
    "intent": ["product_feed", "mcp_scopes"],
    "controls": ["robots.txt", "policies"],
    "trusted_execution": ["ucp", "acp", "x402", "ap2"],
    "intelligence": ["agent_aware_pixel"]
  },
  "example_scans": {
    "mastercard.com": "blocked_403",
    "visa.com": {"score": 14, "commerce": "0/5"},
    "stripe.com": {"score": 22, "commerce": "0/5"},
    "shopify.com": {"score": 24, "commerce": "0/5"},
    "robauto.ai": {"score": 98, "commerce": "5/5"},
    "metareva.com": {"score": 100, "commerce": "5/5"}
  }
}

Network pulse: agents crawl; referrals stay at zero

From live Robauto AI Search Data (updated 2026-10-02T15:00:11Z):

Nearly a quarter of network traffic looks AI-classified, yet measured AI referrals are still zero. Crawlers read; agent-attributed visits that convert do not show up. Trust frameworks and open specs raise the ceiling for autonomous buying — the readiness median remains 20.

What to do next

Run a free Agent Scan on your domain. Map each Mastercard pillar to one shippable surface this week — start with llms.txt and an agent card, then layer commerce protocols. Guides live on Robauto Learn; watch crawls vs referrals on AI Search Data.

Sources

• Mastercard — Trust for agentic commerce (Agent Pay Trust Framework)
• Finextra — How banks build trust in agentic commerce (Ann Johnson)
• Robauto Agent Scan — mastercard.com (blocked)
• Robauto Agent Scan — visa.com
• Robauto Agent Scan — stripe.com
• Robauto Agent Scan — shopify.com
• Robauto Agent Scan — robauto.ai
• Robauto Agent Scan — metareva.com
• Robauto AI Search Data (network KPIs)

Where can an agent get this data live?

Robauto MCP — Agent Intelligence & Brand Discovery Infrastructure. A public, stateless Streamable HTTP endpoint at https://mcp.robauto.ai/mcp, callable with no key. Setup and the full tool list are in the Robauto MCP directory.

All blog posts