# Mastercard Named Five Trust Pillars. Visa Scores 14. Mastercard.com Is Blocked.

Mastercard’s Agent Pay Trust Framework lists identity, intent, controls, trusted execution, and intelligence. Live Robauto Agent Scans still show Visa at 14 and Stripe/Shopify at 0 of 5 commerce — while mastercard.com blocks the scan.

Canonical: https://robauto.ai/blog/mastercard-five-trust-pillars-visa-14-blocked

Robauto Team · Published Oct 2, 2026 · Last updated Oct 2, 2026

Mastercard’s Agent Pay Trust Framework lists identity, intent, controls, trusted execution, and intelligence. Live Robauto Agent Scans still show Visa at 14 and Stripe/Shopify at 0 of 5 commerce — while mastercard.com blocks the scan.

**Mastercard just published five pillars for trusting AI agents with money — and a read-only Agent Scan of mastercard.com still hits a 403 bot wall.** Live Robauto scores put visa.com at **14** with Agentic Commerce **0 of 5**. The white paper asks the right questions. The open web has not answered them yet.

## **The Agent Pay Trust Framework’s five pillars**

On September 30, 2026, Mastercard published [Trust for agentic commerce](https://www.mastercard.com/us/en/news-and-trends/Insights/2026/mastercard-agentic-commerce-trust-white-paper.html), introducing the **Agent Pay Trust Framework**. Finextra’s October 1 interview with Ann Johnson (EVP, security solutions, Mastercard) spells out the same five layers:

PillarKey questionSource

**Identity**
Who is acting?
[Mastercard](https://www.mastercard.com/us/en/news-and-trends/Insights/2026/mastercard-agentic-commerce-trust-white-paper.html)

**Intent**
What was authorized?
[Mastercard](https://www.mastercard.com/us/en/news-and-trends/Insights/2026/mastercard-agentic-commerce-trust-white-paper.html)

**Controls**
What is the agent allowed to do?
[Mastercard](https://www.mastercard.com/us/en/news-and-trends/Insights/2026/mastercard-agentic-commerce-trust-white-paper.html)

**Trusted execution**
Can the transaction be trusted?
[Mastercard](https://www.mastercard.com/us/en/news-and-trends/Insights/2026/mastercard-agentic-commerce-trust-white-paper.html)

**Intelligence**
Can risk be seen as agent behavior evolves?
[Mastercard](https://www.mastercard.com/us/en/news-and-trends/Insights/2026/mastercard-agentic-commerce-trust-white-paper.html)

Johnson’s framing in the [Finextra interview](https://www.finextra.com/the-long-read/1774/how-banks-build-trust-in-agentic-commerce) is blunt: trust determines scale. _“Finding a pair of shoes through an agent is one thing, but trusting the agent to spend your money is another.”_

Finextra also cites the scale forecasts Mastercard is working against:

- McKinsey + ICSC: agentic commerce in US consumer retail could reach **$1 trillion by 2030**

- Gartner: AI agents to intermediate more than **$15 trillion** in B2B spending by **2028**

- One in **10** consumers projected to routinely use AI agents to make purchases by **2030**

That is the payments-network view of trust. Merchants still have to publish machine-readable surfaces those agents can discover on the open web.

## **Live Agent Scans, October 2, 2026**

We ran fresh Robauto [Agent Scans](https://robauto.ai/scan) (~15:30 UTC). Agentic Commerce covers x402, ACP, UCP, AP2, and MPP:

DomainScoreAgentic CommerceNotesSource

mastercard.com
**blocked**
n/a
403 bot-management interstitial
[Agent Scan](https://robauto.ai/scan?url=mastercard.com)

visa.com
**14**
**0 / 5**
—
[Agent Scan](https://robauto.ai/scan?url=visa.com)

stripe.com
**22**
**0 / 5**
—
[Agent Scan](https://robauto.ai/scan?url=stripe.com)

shopify.com
**24**
**0 / 5**
—
[Agent Scan](https://robauto.ai/scan?url=shopify.com)

robauto.ai
**98**
**5 / 5**
verified
[Agent Scan](https://robauto.ai/scan?url=robauto.ai)

metareva.com
**100**
**5 / 5**
verified
[Agent Scan](https://robauto.ai/scan?url=metareva.com)

Networks and processors that shape how money moves still score in the teens and twenties on agent readiness, with commerce discovery at **0 of 5**. Blocking a scanner is a legitimate ops choice — and it is also a decision about whether agents can see your trust story at all. Ceiling examples publish the full stack, including commerce discovery at **5 of 5**.

## **Map the five pillars to what brands can ship**

Issuers own identity tokens, intent proofs, and risk intelligence. Brands still win or lose on whether an agent can find honest, machine-readable surfaces without a human pasting a URL:

Mastercard pillarOpen-web surface brands can shipWhy it matters

Identity
`llms.txt`, agent card / A2A profile, verified brand endpoints
Agents need a stable “who you are” document, not only a homepage

Intent
Clear product + policy pages; scoped MCP tools; AP2-aligned authorization hints
Agents should know what a human authorized before they spend

Controls
robots.txt allowlists, rate limits, MCP capability scopes, return/refund policies
Hard limits beat soft promises when an agent acts at speed

Trusted execution
UCP / ACP / x402 / AP2 discovery; checkout that agents can complete
Commerce protocols turn “I found it” into “I can pay for it safely”

Intelligence
Conversion pixel / analytics that distinguish agent traffic; audit logs
You cannot manage agent risk you cannot see

A practical shipping order: Signal Basics first (robots, sitemap, llms.txt, readable HTML), then Agent Integration (MCP / agent card), then Agentic Commerce (x402, ACP, UCP, AP2, MPP). Trust papers raise the ceiling; discovery documents raise the floor.

```
`{
"as_of": "2026-10-02",
"thesis": "trust_pillars_named_open_web_commerce_still_0_of_5",
"mastercard_agent_pay_trust_framework": {
"pillars": ["identity", "intent", "controls", "trusted_execution", "intelligence"],
"source": "https://www.mastercard.com/us/en/news-and-trends/Insights/2026/mastercard-agentic-commerce-trust-white-paper.html"
},
"finextra_forecasts_cited": {
"us_retail_agentic_commerce_2030_usd": "1_trillion",
"b2b_agent_intermediated_2028_usd": "15_trillion_plus",
"consumers_routinely_using_agents_to_buy_2030": "1_in_10",
"source": "https://www.finextra.com/the-long-read/1774/how-banks-build-trust-in-agentic-commerce"
},
"brand_checklist": {
"identity": ["llms.txt", "agent_card"],
"intent": ["product_feed", "mcp_scopes"],
"controls": ["robots.txt", "policies"],
"trusted_execution": ["ucp", "acp", "x402", "ap2"],
"intelligence": ["agent_aware_pixel"]
},
"example_scans": {
"mastercard.com": "blocked_403",
"visa.com": {"score": 14, "commerce": "0/5"},
"stripe.com": {"score": 22, "commerce": "0/5"},
"shopify.com": {"score": 24, "commerce": "0/5"},
"robauto.ai": {"score": 98, "commerce": "5/5"},
"metareva.com": {"score": 100, "commerce": "5/5"}
}
}`
```

## **Network pulse: agents crawl; referrals stay at zero**

From live [Robauto AI Search Data](https://robauto.ai/ai-search-data) (updated 2026-10-02T15:00:11Z):

MetricValueSource

Total page views (90d)
**1,335,762**
[AI Search Data](https://robauto.ai/ai-search-data)

AI-classified views (90d)
**307,518**
[AI Search Data](https://robauto.ai/ai-search-data)

AI traffic share
**23.02%**
[AI Search Data](https://robauto.ai/ai-search-data)

ai_referral visits
**0** (0% of bot traffic)
[AI Search Data](https://robauto.ai/ai-search-data)

llm_crawler share of bot traffic
**53.5%** (164,660 visits)
[AI Search Data](https://robauto.ai/ai-search-data)

Agent Readiness Index
median **20** / max **75** (79 scored, 20 blocked of 99 attempted)
[AI Search Data](https://robauto.ai/ai-search-data)

Nearly a quarter of network traffic looks AI-classified, yet measured AI referrals are still **zero**. Crawlers read; agent-attributed visits that convert do not show up. Trust frameworks and open specs raise the ceiling for autonomous buying — the readiness median remains **20**.

## **What to do next**

Run a free [Agent Scan](https://robauto.ai/scan) on your domain. Map each Mastercard pillar to one shippable surface this week — start with `llms.txt` and an agent card, then layer commerce protocols. Guides live on [Robauto Learn](https://robauto.ai/learn); watch crawls vs referrals on [AI Search Data](https://robauto.ai/ai-search-data).

## Sources

- [Mastercard — Trust for agentic commerce (Agent Pay Trust Framework)](https://www.mastercard.com/us/en/news-and-trends/Insights/2026/mastercard-agentic-commerce-trust-white-paper.html)
- [Finextra — How banks build trust in agentic commerce (Ann Johnson)](https://www.finextra.com/the-long-read/1774/how-banks-build-trust-in-agentic-commerce)
- [Robauto Agent Scan — mastercard.com (blocked)](https://robauto.ai/scan?url=mastercard.com)
- [Robauto Agent Scan — visa.com](https://robauto.ai/scan?url=visa.com)
- [Robauto Agent Scan — stripe.com](https://robauto.ai/scan?url=stripe.com)
- [Robauto Agent Scan — shopify.com](https://robauto.ai/scan?url=shopify.com)
- [Robauto Agent Scan — robauto.ai](https://robauto.ai/scan?url=robauto.ai)
- [Robauto Agent Scan — metareva.com](https://robauto.ai/scan?url=metareva.com)
- [Robauto AI Search Data (network KPIs)](https://robauto.ai/ai-search-data)

## Where can an agent get this data live?

**Robauto MCP — Agent Intelligence & Brand Discovery Infrastructure.** A public, stateless Streamable HTTP endpoint at `https://mcp.robauto.ai/mcp`, callable with no key. Setup and the full tool list are in the [Robauto MCP directory](https://robauto.ai/mcp-directory).

[All blog posts](/blog)

---

(c) 2026 Robauto, Inc. — support@robauto.ai
Machine surfaces: https://robauto.ai/llms.txt · https://robauto.ai/llms-full.txt · https://robauto.ai/.well-known/api-catalog