Episode 29 — When AI Agents Go Shopping: Making Sense of UCP, ACP, AP2, and the Agentic Commerce Stack

Welcome Tony Fernandes: Why So Many Agentic Commerce Protocols Now?

Sunil: Okay, welcome to The Token Drop. We have a very special guest today, Tony Fernandes. He was at Visa for many years, most recently as VP of Payment Processing Architecture, and he has a wealth of experience in the financial world. I thought it would be a good idea to ask him some questions we've had. Specifically, I've seen a lot of agentic commerce protocols announced this year. There was UCP, which Google announced and a bunch of companies joined. OpenAI announced its ACP. They're all in the same realm. Obviously everybody believes agentic commerce will be big going forward, but maybe you can share your view, Tony, on what's going on. Why is this happening?

What Changes When an Agent Shops for You

Tony: Sure thing, Sunil. First off, thank you for having me, to both you and the DaaX team.

Tony: Traditionally, the way we shop today, online or in person, there's a person doing everything. A person searches for a product, picks a product, authenticates themselves somehow, and then pays for it. For the longest time, the industry has had processes, frameworks and standards in place to make sure this is a safe and trustworthy transaction. The person is authenticated, or trusted by the issuer of their payment instrument. The consumer is in some way known to the merchant because they've set up a profile, and so on. So there are established processes in place.

Tony: In the world of agentic commerce, an AI agent is acting on behalf of a person. Either it's been instructed directly, or it acts preemptively because it's aware of the person's context or behavior, or you've told it, "When the price of something drops below a certain level, go out and buy it." So now it's an agent doing all the things we talked about: searching, picking a product, authenticating itself and paying.

Tony: So the industry needed to rethink how it would adapt to agentic commerce. How would authentication work? How would the tokenization of payments work? How would fraud detection work? How do you make sure shopping-agent traffic isn't mistaken for a bot attack? All of these things were already in place for traditional shopping.

A Map of the Agentic Commerce Protocols

Tony: As you indicated, there's a slew of protocols in the agentic commerce space, and it can be quite confusing. How does it all work together? Are some protocols operating in the same space? I'll run through some of them, and then we can dive into specific ones as we see fit. Feel free to interrupt me at any point.

How Agents Communicate: MCP and A2A

Tony: At the very base is how agents communicate. These protocols exist not because of agentic commerce, but because AI agents needed to interoperate. The two I'm talking about are MCP, the Model Context Protocol, and A2A, the Agent2Agent protocol. We can get into the details if we choose to. Essentially, MCP allows an agent to access resources external to itself, on the same computer or the same server, if you like. Think about getting to a database and pulling information from it, or getting to tools. A2A is a protocol for agents to communicate with each other, to hand off tasks they can't do to another agent and do that securely. Both are somewhat client-server architectures, with a client side and a server side. So that's how agents communicate, and that's why those two protocols exist.

Should We Trust This Agent? Visa Trusted Agent Protocol and ERC-8004

Tony: The next area is: how do we trust this agent? Should we trust it at all? That's the big new thing in agentic commerce. There are a couple of protocols in that space. One is Visa's Trusted Agent Protocol, and another is called ERC-8004. I'm not too familiar with the second one, but I can speak a little to Visa's Trusted Agent Protocol, and we'll get to that.

What Are We Buying? UCP and ACP

Tony: The third area the protocols address is what we're buying and how we're buying it. That's where the two protocols you mentioned at the outset, UCP and ACP, operate. How do we discover products? How do we shop for them? How do we put together a cart for checkout? Those are the two protocols in that space.

Agent Mandates: AP2

Tony: Then the big one is the agent's mandate: what is the agent authorized to do? How do we make sure it does what it's authorized to do and nothing beyond that? There's a protocol, or framework, called AP2 that guides how that area works.

Payment Tokens in an Agentic World

Tony: Last but not least is how we authenticate the transaction, and how payment tokens work. A quick side note: instead of presenting your card number, what's called a PAN, in a transaction, a payment token is something presented in its place so the card number isn't exposed to the ecosystem. When you pay with a wallet on your phone, Apple Pay or Google Pay, what's on the phone isn't your card information but a token generated for payment transactions. How that evolves into the world of agents is another area the industry needs to address.

How the Protocols Layer Together

Tony: If you think about how these protocols layer, the highest layer is your AI surface: ChatGPT, Gemini, Perplexity and the rest. The layer below that, and this is loosely my interpretation, is ACP and UCP. They're also referred to as commerce protocols: how you go about browsing, searching and shopping. Everything below that is plumbing, in a way: MCP, A2A, AP2, Visa's Trusted Agent Protocol. All of those sit underneath.

Tony: Let me pause there. I've given you a mouthful. But essentially, all these protocols have come into existence to fill a gap that's been exposed because, instead of a person, an agent is now conducting commerce on that person's behalf.

Why Determinism Matters

Sajjad: Thanks, Tony. That's amazing. You painted the whole landscape of agentic communications and transactions, and that's really helpful, especially since we've been working in this space for some time. What we've found is that the need for determinism can't be overstated, simply because every time you ask an LLM a question, even if it gives you the correct answer, it may choose a different sequence of words each time. So you definitely need governance, controls and guardrails. These protocols provide those guardrails, controls and the transaction flow to make sure your purchases complete smoothly.

Does UCP Mirror How Humans Shop?

Sajjad: Having said that, what are the metaphors? As a human being, I'd visit a web page, let's say amazon.com. I'd browse the catalog, pick and compare products, maybe read some reviews. Eventually I'd pick a product, drop it in a cart, make a payment and have it shipped, all in minutes. When I decide to have it shipped, it still presents me with choices. How do you want it shipped? To what address? Do you want it immediately, say tomorrow, or can it wait a while? Are there equivalent metaphors in the UCP protocol to support that level of, if I may use the mouthful, anthropomorphizing, of how a human being interacts with a website?

Tony: Good question. I think what Google is trying to do with UCP is standardize that way of shopping. How do you search for things? How do you pick them? How do you look at reviews? Today, each merchant does it their own way. If you want to do agentic commerce, you can't build point-to-point connections with every merchant. You have to standardize the way that information is exposed to agents, and that's what UCP is trying to do. I haven't studied every API in UCP, but that's the direction they want to take it.

UCP vs. ACP: Decentralized vs. Centralized Catalogs

Tony: If you compare UCP to ACP, since they exist in the same space, UCP uses what people call a decentralized model. Merchants still control their catalog and, for lack of a better word, the discovery experience for the consumer, and UCP exposes that information to agents through APIs. The catalogs stay with the merchant.

Tony: ACP takes a slightly different, somewhat centralized approach. Merchants or businesses have to feed their catalog to OpenAI, and OpenAI uses it to surface information to the agent and, by extension, to the user. So OpenAI somewhat controls how that information is viewed by the consumer. Slightly different models.

Tony: It's going to be interesting to see what remains. Right now, I think the advice most businesses are getting is to support both UCP and ACP. ACP, as you'd imagine, has to deal with catalog staleness and freshness, because these are feeds coming in on a regular basis. With UCP, it's real time; it's whatever the merchant exposes to the agent. Both exist to let agents discover products and shop for them, but they do it slightly differently.

Can You Challenge a Deal Your Agent Made?

Sajjad: Sam, do you want to say something?

Sam: I think it's a very interesting topic. I have a general question for Tony. If buyer and seller agents reach a deal in, say, milliseconds, what opportunity does a person have to challenge its terms? This has been bothering me. How can a person challenge the terms and conditions they're getting into if there's very little time for negotiation?

Sunil: But aren't you delegating to the agent to act on your behalf, so you're stuck with whatever decision the agent made?

Sam: Yes, that's exactly my question.

Mandates and Human-in-the-Loop Models

Tony: That's where mandates come into play. You can control what authority you pass to the agent, what you authorize it to do on your behalf. This is an evolving space, and that's where the AP2 protocol certifies and secures that information so it can be captured along with the transaction.

Tony: And to Sunil's point, some of it you're delegating because you don't want to do it yourself. But I think various models will come into play. There'll be completely automated ones and human-in-the-loop ones, depending on the risk of the transaction and its payment size, which are somewhat related. I don't know if I answered your question, Sam.

Disputes: Proving the Agent Acted Within Its Authority

Sam: You did. Some of these questions are very interesting to me. When I make a normal purchase, I know some of the answers. But when an agent acts on my behalf, new questions arise. Take a disputed purchase. What evidence will prove that the agent acted within my authority, rather than merely claiming it did?

Tony: That's a great question, and it's evolving. I'm sure the industry will answer it eventually, Sam. The question the industry is grappling with is: what if something goes wrong in the purchase? Either the agent misinterpreted what you asked for or what was surfaced, or there was a breakdown in communication between the shopping agent and what the merchant surfaced as a match for your request. If something goes wrong, who's liable? Who bears the burden? Merchants will naturally be a little wary, because they don't control the platform doing the shopping and wouldn't want to be held liable for it.

Tony: So this space will keep evolving, Sam. But to your point, some of the protocols do support this. One of the reasons AP2 exists is so you can capture, along with the transaction, the mandate the user gave the agent, which is essentially the controls the user put on the agent's authority.

Starting with Recurring, Low-Risk Transactions

Sajjad: And to start with, it might be low-risk transactions.

Tony: You're absolutely right. Sorry to speak over you, Sajjad. I'm speaking more anecdotally than from what I know here, but I think people will naturally be drawn to recurring transactions first. A subscription with a merchant you know, something you do every quarter. Or, for businesses, payments to suppliers that are approved and have been vetted. The trust circle is more constrained, for lack of a better word, so I can see people gravitating toward those first.

Tony: But it's going to be interesting to see. With the release of Meta's Muse, it'll be interesting to see how that evolves, because Meta has a lot to draw from to surface its own marketplace to you, and it knows a lot about what you're thinking and doing. Time will tell.

Do We Still Need Hundreds of Apps?

Sajjad: Similarly, people are talking about the Apple App Store. Today there are millions of apps on it. But if you have an agent transacting on your behalf, the agent would know which service you prefer, how to talk to it and how to transact with it. Then the question becomes: do you really need hundreds of apps on your phone, or just a single agent that knows how to navigate and get you what you need?

Tony: That's going to be the push and pull, Sajjad, because right now it's a brand thing. Each of those apps knows me, Tony, and has a relationship with me. They'll be reluctant to let go of that interaction and pass it to an aggregator, which is an agent of some sort. It'll be interesting to see how that plays out.

Sajjad: Absolutely. I see a tension there. If I'm using a particular brand's application, that brand would prefer I keep using it rather than be disintermediated by an agent that may or may not invoke that same application.

A Day in the Life of an Agentic Transaction

Sunil: I have an idea for you, Tony, just listening to you. Back in the day, and Sam probably knows this, someone did "a day in the life of a packet" in the networking world. It was very helpful for understanding how a packet travels from my computer to a website and how the data comes back. It would be good to have a day in the life of an agentic transaction.

Tony: I think that would be a great topic for another day. And honestly, and this is just me guessing, the protocols have come out and a lot of pilots are running right now. It'll be interesting to see what these organizations learn as they pilot, and how they tweak the protocols as they go.

Sunil: It sounds very sophisticated and complicated. There are so many different parties and layers involved.

Tony: Right.

Who Sets the Price? Personalized Pricing

Sam: If my agent negotiates with your agent, who's actually setting the price? Could every buyer get a different one? Say my agent negotiates with someone else's agent—

Tony: Someone being a business, presumably.

Sam: Correct. And that agent is setting the price. Could every buyer get a different price?

Tony: You're going into a space people have visited before, regardless of AI agents. Even today, aggregators like Amazon know a lot about each of us individually. I'm pretty sure there are regulations in place to keep them from creeping into price discrimination, but discounting could be done, I would think. I'm not an expert in pricing regulations. I don't know if that answers your question, Sam, but that opportunity existed regardless of AI agents.

Hidden Instructions and Unstructured Product Data

Sam: That's why I think there were already blind spots. For example, what happens when a seller hides instructions in a product page to manipulate the buying agent? Can that even be done? You wouldn't see it.

Sajjad: That's what I was thinking about too, Sam. Of course there will be regulation on how products are advertised, to ensure fairness. But even if everyone plays fair and square, every vendor describes their product in their own words. There are product descriptions, then reviews, and all of it is unstructured. Different vendors have different lengths of description, features, functionality and specifications, plus reviews, pictures, video and so on.

Sajjad: So it'll be interesting to see how these agents navigate that, and whether they need to make rational comparisons between vendors' products before making a purchasing decision. It's not just the payment trust that Tony's industry has built up over so many years. Now there also has to be trust in how you navigate all that unstructured data, especially with LLMs and the faults and failures we've become accustomed to. How do you mitigate all of that and still get a good transaction through?

Do Brands Lose Power When Agents Shop?

Sam: Totally. Here's something I really wonder about. We love brands. I like to wear Adidas; you like your own brand. Do brands lose power if agents become better shoppers than humans? In other words, does brand trust become more valuable or less valuable when agents become better shoppers?

Sajjad: So you're not just advertising to humans anymore. You're advertising to agents.

Sam: Exactly. That's why I wanted Tony's view.

Tony: It's an interesting question, Sam. Earlier in the discussion we talked about how comfortable brands and businesses will be letting go to a shopping agent because they believe it will bring more business, and how they'll weigh that against perceived brand erosion, since the consumer isn't interacting with them directly. That remains to be seen.

Sam: Take GPU boxes. There are many brands, from NVIDIA to Acer and others, priced differently while offering similar GPUs. When you shop, you might say, "I want this DGX Spark," because of the brand. That branding power is very important. But when agents negotiate, they might say, "This other one is $500 cheaper than everything else."

Sajjad: Don't humans have the same confusion? There was a time I was shopping for laptops. You'd go to Costco and look at, say, an IBM ThinkPad or a Dell, and see a particular model with certain features. Then you'd go to Best Buy or Circuit City and see slightly different features and a slightly different model number, but in the same ballpark. It was so hard to line them all up in a spreadsheet, figure out what each did and didn't offer, and eventually make a decision. With agents, this might become a little easier.

Tony: It'll become easier for the consumer. The question is what it does to businesses and brand erosion. I think that's what Sam was asking.

Sam: Yes, that's right.

The Economics of an Agentic Transaction

Tony: Another thing the industry will have to work out, in my opinion, is the business economics of the purchase. There's a new party in the mix now. Will there be more pressure on the economics of a transaction, and how will the industry adapt? Do merchants charge for access to product information? Shopping agents aren't going to do it for free. So how does that affect the economics of a purchase? That remains to be seen.

Tony: I'm pretty sure the industry will answer all of these in time: the dispute liability question from earlier and the economics of a transaction. We've seen similar things before. When we started paying with phones, there were suddenly new players in the ecosystem, and everyone asked what that would do to the economics of a transaction. The industry figured that one out, and I'm sure it'll figure this one out too. But these are things on the radar that need to be sorted through. Maybe they're being sorted through right now and I just don't know about it.

Who Absorbs the Loss? Liability and Celebrity Endorsements

Sam: You raised a very important point. If an agent books a non-refundable trip based on misunderstood preferences, who should absorb that loss? You can't just drop the ball.

Sam: Here's another one. We respond to celebrity endorsements. A celebrity says a product is great, and there's a big brand behind it. When software doesn't care about celebrity endorsements, what happens to that whole equation? Does it still exist? There are many questions like that.

Tony: Right. It depends on how much of the decision-making a user hands over to the agent. "Buy me toothpaste" is different from "Buy me Sensodyne." It really depends on how that comes about, Sam. Time will tell.

Open Marketplace or a Few Gatekeepers?

Sam: I'm also worried: are we heading toward an open marketplace, or a few platforms controlling access to buyers? Think about what Amazon did to bookstores. They did a fabulous job, but most of the bookshops where we used to have coffee, chat or read magazines are pretty much gone. Now we can order anything on Amazon, and the convenience matters, because we order a lot of things. But have we lost something in the process? When I make a purchase decision, I'd like to feel something, look at something. If agents do it, I have to have already thought about the product and known I want it.

Sunil: There might be an agent for you, Sam, that does exactly that, one that lets you share those preferences. It's not just one agent.

Sam: But the question is, you were never involved in the middle of the transaction.

Tony: You're right, and you're asking the right question. I think it comes down to user preferences over time. There are websites that let you order custom-made clothes. You're not feeling or touching anything, but you have the option to return it afterward, and people are comfortable with that. So it really depends on the consumer and their preferences, Sam.

Sunil: Sorry, Sam, we're almost out of time. If you have one last question—

Sam: Say you go to Macy's to buy something. You'd try it on. There's a dressing room, and your wife says, "That's good, just buy it." We don't have that here. It may be a silly question, but at the end of the day, there's the personal feel of it.

Sunil: That's changed already, even without AI, right?

Tony: That's where I was going, Sunil. That's changing regardless.

Sam: It's not just AI bringing that change. I agree.

What Protocol Is Still Missing?

Sunil: One question for Tony before we end. We started by asking about all these protocols, and you gave us really good insight. Is there a protocol you think is missing? Anything this whole commerce flow still needs?

Tony: I think this will play out based on how the industry answers the question of disputes and liability. My guess is that, along with the transaction, either during or after the fact, one would have to work out what data from the whole shopping process has to live with the transaction, so it can be surfaced during a dispute. That's an area I haven't quite seen addressed yet, so it'll be interesting to see how it plays out.

Tony: I know AP2, in some ways, handles what the user authorized the agent to do. But what did the merchant return in response? All that back and forth to arrive at the right product to buy would have to be surfaced if there were a dispute, so you can adjudicate it. At least that's how I think it will work, but we'll see what the industry decides is most practical.

Wrap-Up

Sunil: Thank you so much, Tony, for joining us. Really appreciate it.

Tony: Thank you. This was fun.

Sajjad: Thank you.