The Agentic Commerce Landscape

A map of who is building what in agentic commerce, organized by the layer they operate in. The field is moving quickly, so treat this as a snapshot rather than a fixed picture.

The stack, in one view

Agentic commerce divides into layers, and most organizations occupy one or two of them: the agent surfaces where shopping happens, the commerce protocols that run the shopping journey, the payment-authorization layer that proves you approved a purchase, the networks and processors that move the money, the platforms and merchants that sell, and the standards bodies that steward the open specifications. The map below follows that order.

Who backs each standard

• ACP · CheckoutAgentic Commerce Protocol

  OpenAI and Stripe in founding governance; OpenAI, Stripe, and Meta listed as lead maintainers.

  Apache 2.0
• UCP · CheckoutUniversal Commerce Protocol

  Google, Shopify and Stripe on the Governing Council, over per-domain Tech Councils: Shopping (16 seats across Google, Shopify, Etsy, Target, Wayfair, Amazon, Meta, Microsoft, Salesforce, Stripe), Food (seated July 2026), Lodging (seated August 2026) and Payments (seated September 2026: Adyen, Ant International, Coinbase, Global Payments, Google, PayPal, Shopify, Stripe). Current spec revision v2026-08-25; a first draft Lodging Booking capability was merged 25 September 2026.

  Google-led
• AP2 · AuthorizationAgent Payments Protocol

  Created by Google with more than 60 launch organizations, and donated to the FIDO Alliance on 28 April 2026. Still v0.2, with no stable release and reference implementations that mock real payment providers.

  FIDO Alliance
• MCP · DiscoveryModel Context Protocol

  Created by Anthropic, now held by the Agentic AI Foundation, a directed fund under the Linux Foundation. Current spec revision 2026-07-28.

  Agentic AI Foundation
• A2A · CoordinationAgent-to-Agent

  Created by Google, donated to the Linux Foundation in 2025, and a hosted project of the Agentic AI Foundation since 17 August 2026. At v1.0 since March 2026 and v1.0.1 since May 2026, with more than 150 supporting organizations reported at its one-year mark in April 2026.

  Agentic AI Foundation
• x402 · Settlementx402

  Contributed by Coinbase, now stewarded by the x402 Foundation, operational under the Linux Foundation since July 2026, with 40 members at launch and more since. Block joined in September 2026, contributing Bitcoin Lightning.

  Linux Foundation
• MPP · SettlementMachine Payments Protocol

  Stripe and Tempo.

  Stripe + Tempo

Agent and model providers

These are the surfaces where agentic shopping happens.

OpenAI built the first major in-chat buying experience, Instant Checkout, and co-created the ACP standard; since March 2026 it has concentrated on product discovery and let merchants keep their own checkout. Google is pushing agentic shopping through AI Mode in Search and the Gemini app, and authored both the UCP commerce protocol and the AP2 payments protocol. Anthropic created MCP, the discovery layer the rest of the stack plugs into. Microsoft sells through Copilot, where Shopify says thousands of its merchants are already live, and Amazon joined the UCP Tech Council in April 2026, bringing the largest US retailer-platform into the open-standard camp. Perplexity partnered early with PayPal for in-chat checkout, and has since become the field’s most consequential litigant rather than merely an early integrator: on 4 August 2026 the Ninth Circuit vacated the preliminary injunction Amazon had won against its Comet agent, holding that for CFAA purposes it was the user, not Perplexity, who accessed Amazon’s computers, and that the agent “is a tool, not a person for statutory purposes.” The full Ninth Circuit declined to rehear the case on 10 September 2026, with no judge requesting a vote. See the timeline for the ruling and its limits. Meta became an agent operator rather than only a standards backer on 8 September 2026, when it launched Muse, a US consumer agent that runs its own browser in a cloud virtual machine, asks before it buys, and pays through Link by Stripe’s one-time-use cards. Note what it does not use: Meta names no commerce protocol for Muse, so it shops the way a person does, through the merchant’s ordinary website, whether or not the merchant has integrated anything.

Commerce protocols

The standards that define how an agent runs a purchase with a merchant.

ACP (Agentic Commerce Protocol), governed by OpenAI and Stripe as founding maintainers and listing OpenAI, Stripe, and Meta as lead maintainers in MAINTAINERS.md, is the checkout layer. UCP (Universal Commerce Protocol), Google’s standard, covers the broader shopping journey and is ACP’s main rival; it is governed by a Governing Council that oversees overall adoption and health (Google, Shopify, and Stripe, which joined in April 2026, with two seats open for election) sitting over per-domain Tech Councils. The Shopping Tech Council expanded to 16 seats on 24 April 2026 when Amazon, Meta, Microsoft, Salesforce, and Stripe joined Google, Shopify, Etsy, Target, and Wayfair; all sixteen seats are filled across those ten companies. A Food Tech Council was seated on 16 July 2026 with Block (Square), DoorDash, Google, Toast, and Uber Eats, and a Lodging Tech Council on 11 August 2026 with Amadeus, Booking.com, Expedia, Google, Hilton, Marriott, and Trip.com, bringing global distribution, online travel agencies, and hotel groups inside UCP governance. A fourth, the Payments Tech Council, was seated on 2 September 2026 with Adyen, Ant International, Coinbase, Global Payments, Google, PayPal, Shopify, and Stripe, the first UCP council organized around a capability rather than a retail vertical. Google holds four of the sixteen Shopping seats and six of the ten filled Food seats, which is worth holding alongside the open-governance framing. Its current spec revision is v2026-08-25, released 25 August 2026, which reorganized the specification into Common, Shopping, and Payment groups so payment sits above any one vertical, added EMV 3-D Secure payment authentication, and carries breaking changes. Three vertical councils in five weeks, a payment layer lifted out of shopping, and then a Payments council seated to govern it are the same move made repeatedly: UCP is being rebuilt as multi-vertical infrastructure with retail as its first vertical. At Google Marketing Live in May 2026 Google extended UCP with named-brand Universal Cart (Nike, Sephora, Target, Walmart, Wayfair, and Shopify merchants) and into new verticals, hotel booking and food delivery. MCP (Model Context Protocol), created by Anthropic and now held by the Agentic AI Foundation, is the discovery layer; its 2026-07-28 revision made the protocol core stateless. A2A (Agent-to-Agent) standardizes coordination between agents; it reached v1.0 in March 2026 and, on 17 August 2026, moved from the Linux Foundation’s broader portfolio into the Agentic AI Foundation, so it now sits under the same governance as MCP. See the protocol stack for how they compare.

Payment authorization and trust

The layer that proves a real user authorized a specific purchase.

AP2 (Agent Payments Protocol), created by Google and donated to the FIDO Alliance on 28 April 2026 alongside a v0.2 release, is the leading standard here, using signed mandates as verifiable credentials. It remains at v0.2 with no stable release, and Visa co-chairs the FIDO Payments Technical Working Group developing it. FIDO has published no specification from the contribution, and the repository, documentation, and copyright are still Google’s, so what moved to FIDO is future standardization rather than the artifacts. Stripe is not named among AP2’s backers and supports ACP and MPP instead, though no first-party roster confirms it is outside FIDO’s agentic work. Mastercard’s Verifiable Intent, co-developed with Google and also contributed to FIDO, is a compatible effort. The FIDO Alliance now stewards both. See AP2 explained.

Payment networks

Visa launched Intelligent Commerce in April 2025, with tokenized “AI-Ready Cards,” and led the Trusted Agent Protocol to help merchants tell legitimate agents from bots; on 8 April 2026 it added Intelligent Commerce Connect, a network-, protocol- and token-vault-agnostic acceptance “on ramp” that lets merchants accept payments initiated over the Trusted Agent Protocol, MPP, ACP, and UCP (AP2 is not among the named protocols). Visa’s own announcement describes it as in pilot with select partners, including Aldar, AWS, Diddo, Highnote, Mesh, Payabli, and Sumvin, and rolling out to more through the year. Trade reporting pointed to general availability by the end of June 2026, but that date has passed and Visa has published no first-party confirmation of general availability. Mastercard launched Agent Pay, built on agentic tokens and payment passkeys, also in April 2025, and on 30 September 2026 added trust and intelligence services that it calls the intelligence layer of its Agent Pay Trust Framework, starting with a score for how likely a transaction is to have been initiated by an agent. That score is rolling out for testing in the US, not generally available. American Express entered in April 2026 with a developer kit and an industry-first purchase-protection pledge for registered agents. See how AI agents pay.

Processors and providers

Stripe co-created ACP and powered ChatGPT’s Instant Checkout through its Shared Payment Token, which was the most concretely live consumer flow until OpenAI shifted its emphasis to product discovery in March 2026. Instant Checkout was narrowed rather than retired, and OpenAI’s developer documentation still describes it as available to approved partners. The Shared Payment Token remains the mechanism ACP integrations use. The flow that replaced it as the most concretely live is not a payment provider’s at all: see Shopify, below. Stripe also co-authored the Machine Payments Protocol (MPP) with Tempo for machine-to-machine payments, joined the UCP Tech Council in April 2026, and supports both MPP and x402. PayPal is both an AP2 partner and an early MCP-server provider, and has adopted ACP. Adyen, Worldpay, Checkout.com, and Braintree appear across the protocol partner lists.

Platforms and merchants

Shopify co-developed UCP, and on 24 March 2026, the same day OpenAI stepped back from in-chat checkout, it made itself the largest single route into AI shopping. Agentic Storefronts made “millions of merchants” sellable to ChatGPT users, discoverable “by default” with no separate integration and no transaction fees beyond standard processing, with the same panel reaching Microsoft Copilot, AI Mode in Search, and the Gemini app. The purchase completes on the merchant’s own checkout, in an in-app browser on mobile, and the merchant stays merchant of record. That is now the most concretely live consumer flow in agentic commerce, and its shape matters: the agent does discovery, the platform supplies the catalog, and checkout never leaves the merchant. Shopify’s Agentic plan, opened globally the same day, extends Shopify Catalog to brands that do not use Shopify for ecommerce. Shopify is also making its stores callable by browser agents, not only by protocol integrations: WebMCP tools for catalog, cart, and orders went live on every Liquid storefront on 5 August 2026, and on 28 September 2026 Shopify extended them to checkout, with the buyer confirming the order before the agent submits it. Shopify describes Checkout WebMCP as the UCP checkout capability delivered through browser-registered tools, so one checkout object now serves both the protocol route and the browser-agent route. Etsy was the first merchant genuinely live on ACP. Walmart announced ChatGPT buying and is a UCP co-developer. Target, Wayfair, Best Buy, and Macy’s are aligned with UCP. Merchants generally remain the merchant of record across these standards.

Standards bodies and foundations

The FIDO Alliance stewards AP2 and Verifiable Intent, both contributed on 28 April 2026. Neither is yet a FIDO specification: FIDO describes them as contributions that will be reviewed and developed through its own process, in a Payments Technical Working Group chaired by Mastercard and Visa and a new Agentic Authentication Technical Working Group chaired at launch by CVS Health, Google, and OpenAI and vice-chaired by Amazon, Google, and Okta. The Linux Foundation hosts the Agentic AI Foundation, a directed fund co-founded by Anthropic, Block, and OpenAI in December 2025, and the x402 Foundation, which became operational on 14 July 2026 with 40 members at launch and has grown since. The Agentic AI Foundation grew on 17 August 2026, when A2A joined it as a hosted project, moving out of the Linux Foundation’s broader portfolio into the body that already held MCP, goose, AGENTS.md, agentgateway, and Agent Router. Each project keeps its own maintainers and release schedule, so nothing changed in either specification, but the agent layer’s two load-bearing protocols, tool access and agent coordination, are now governed in one neutral place.

A third venue is being tested. On 23 July 2026 the IETF held a working-group-forming BoF in Vienna, Agent Communication Protocols (agentproto), on whether agent-to-agent and agent-to-tool communication needs formal Internet standards rather than only consortium governance. The draft minutes record strong support for forming a group and for the IETF as the venue, but the proposed scope was rejected, and the datatracker still lists agentproto as a BoF with no charter. On 24 July 2026 the IETF Secretariat opened a non-working-group mailing list, agentproto@ietf.org, explicitly for updating the proposed charter and working toward forming a group. That is the rewrite happening in public, not a decision. MCP, A2A, and the MPP drafts all sit in its shadow. Read it as the question being asked, not answered.

EMVCo, the body jointly owned by American Express, Discover, JCB, Mastercard, UnionPay, and Visa that maintains the EMV chip, tokenization, 3-D Secure, and Secure Remote Commerce specifications, entered the field formally on 1 September 2026. It published a draft, EMV Agentic Payments: Framework for Specifications v1.0, for public comment, and stood up an Agentic Payments Task Force to develop its approach. That comment period closed on 30 September 2026, and EMVCo has not yet published a disposition of comments or any specification arising from it. The draft’s central proposal is Intent Services: a shared, interoperable layer that lets payment participants register, reference, retrieve, and manage consumer-authorized intent before, during, and after a transaction. EMVCo’s stated focus is the scenarios where intent has to persist rather than be proved once, such as recurring purchases, cumulative budgets, and post-transaction activity, and it positions Intent Services as complementing cryptographic approaches like Mastercard’s Verifiable Intent rather than replacing them. It says the work may later extend to Know Your Agent and Agentic Transaction Indicators, and could inform changes to EMV 3DS, payment tokenization, SRC, and the Digital Payment Credential. It is collaborating with the FIDO Alliance, the OpenID Foundation, the OpenWallet Foundation, and W3C.

Two things make this worth its own paragraph. It is a draft framework, not a specification: nothing is published to build against, and the comment period closed on 30 September 2026 without a published outcome. And EMVCo is owned by the six card networks, so unlike a vendor coalition its output tends to become the thing acquirers and issuers implement. If agent identity and persistent consumer intent are the unsettled layer, this is the card industry’s own answer to it, arriving alongside FIDO’s.

A further kind of body appeared in August, and it is worth naming for what it is not. On 18 August 2026 the stablecoin infrastructure company Rain launched the Agentic Payments Alliance, a coalition of 26 founding members including Visa, Mastercard, Fiserv, Circle, Solana, Uniswap Labs, Chainalysis, Fireblocks, Shift4, Lithic, and Remitly. Rain describes it as a working coalition run collectively by its founding members rather than owned by any one company, with early work expected to cover shared research and frameworks, testing emerging standards for agent identity and authorization, and advocacy on regulatory questions. It publishes no specification and stewards no protocol, so it does not belong in the same category as FIDO or the Linux Foundation. What makes it worth tracking is the subject: how an agent proves who it is acting for and how much it may spend is the one layer where no standard has settled, and the same networks that co-chair FIDO’s Payments working group have now also joined a vendor coalition looking at it.

That layer gained a fifth effort in September. On 9 September 2026 Ant International, Mastercard, and Visa announced a collaboration on Know-Your-Agent interoperability, so that card networks, wallet ecosystems, agent platforms, and marketplaces can recognize a trusted agent without each running a separate identity check. The named work is cross-network operator traceability linking an agent to a validated operator, cardholder, or business; shared certification against common security and behavioral requirements; and continuous monitoring using identity and transaction signals. Each network keeps its own verification and decisioning, and the three existing approaches it is meant to bridge stay in place: Visa’s Trusted Agent Protocol, Mastercard’s Verifiable Intent, and Ant International’s Agentic Mobile Protocol. The work runs through BuildFin.ai, an industry platform convened by the Monetary Authority of Singapore, which makes this the first agent-identity effort with a financial regulator’s platform underneath it. Read it for what it is: a statement of intent with no specification, governance body, or timeline published. Counting FIDO’s Agentic Authentication working group, MCP’s roadmap agent-identity priority, Rain’s coalition, EMVCo’s draft framework, and now this, five separate efforts are circling agent identity. That is the shape of an unsolved problem. See the announcement.

Crypto and stablecoin rails

Coinbase created x402, the HTTP-native stablecoin protocol for machine-to-machine payments, with Circle (USDC), the Ethereum Foundation, and MetaMask in the ecosystem. Google aligned it with AP2 through an x402 extension. By mid-2026 x402 was moving from concept to infrastructure: AWS made it generally available at the edge in CloudFront and AWS WAF, and Cloudflare opened a waitlist for an x402-based Monetization Gateway. In July 2026 the Linux Foundation announced the operational launch of the x402 Foundation under formal open governance with 40 members; its premier tier now spans the major card networks and payment providers (Visa, Mastercard, American Express, Stripe, Adyen, Fiserv), platforms (Google, Shopify, AWS, Cloudflare), and crypto infrastructure (Coinbase, Circle, Ripple), a notable mainstreaming of a crypto-native rail. Stripe and Tempo added the Machine Payments Protocol (MPP) in March 2026, a second machine-native standard in the same lane that settles in stablecoins as well as cards. The two have taken different governance routes: x402 to a Linux Foundation body, MPP to the IETF, where its core was submitted on 18 March 2026 as an individual Internet-Draft that has not yet been taken up by a working group. That core draft was refreshed on 9 September 2026 under a shorter name without the author prefix, draft-httpauth-payment-01, extending its life to 13 March 2027; the Datatracker still records it as an individual submission with no working group and no RFC stream.

Legal context and recourse (emerging)

A newer and much less settled category, covering what the parties agreed to and what happens when a transaction goes wrong. Every layer above answers a mechanical question, who found what, who authorized it, how the money moved, and every one of them leaves terms, jurisdiction, and dispute resolution out of scope. AP2 says so explicitly.

The Legal Context Protocol (LCP), launched on 24 June 2026, is the most credible entrant so far. It is co-stewarded by Integra Ledger and the American Arbitration Association-International Centre for Dispute Resolution (AAA-ICDR) as Founding Maintainers, with founding contributors including Google, IBM, Circle, Wayfair, Stellar Development Foundation, Ava Labs, UiPath, Cardano, Hedera, and Mysten Labs. A business publishes one Apache 2.0-specified JSON file at /.well-known/legal-context.json pointing to its terms, optionally with a hash proving what those terms said and a flag requiring signed acceptance. Treat it as early: the v1.0 specification is a draft released for community review, and none of the protocols it proposes to attach to has adopted it. See LCP explained.

Also in this category, and further back: the A-Comm Evidence Protocol (AEP), a single-vendor draft evidence and audit standard from A-Comm Technologies that was open for public comment through 14 August 2026 with no named adopters or governing body. The Atlas is watching it rather than mapping it.

How to read the map

Three patterns are worth noticing. First, the big platform companies are hedging: Stripe and Meta are associated with both ACP and UCP, and Google spans protocols, payments, and a surface. Second, the open standards are consolidating into neutral bodies, FIDO and the Linux Foundation, and the established payments standards bodies have now arrived too, with EMVCo opening a draft framework for card-based agentic payments in September 2026. That is usually a sign a field is maturing past the land-grab phase. Third, and most useful if you are deciding where the gaps are, the mature layers are the mechanical ones. Discovery, checkout, authorization, and settlement all have working standards with real backers. Recourse does not, and the entrants trying to fill it are at draft stage. For the dated sequence of how this came together, see the timeline.