Ten protocols. Twelve founding members. Four layers. One quarter. Every production protocol for how AI agents discover, authenticate, pay, and settle. The definitive map.

Something happened in the first quarter of 2026 that has no precedent in payments history. Every major player shipped a production protocol for AI agent commerce. Not pilots. Not sandboxes. Production systems processing real transactions, authenticating real agents, settling real money.

Google launched the Universal Commerce Protocol. OpenAI and Stripe shipped the Agentic Commerce Protocol. Visa released the Trusted Agent Protocol. Mastercard deployed Agent Pay and Verifiable Intent across three continents. Coinbase built stablecoin settlement into HTTP itself, then handed the keys to the Linux Foundation with Visa, Mastercard, and Stripe sitting at the table. Fiserv became the first processor to adopt both network frameworks simultaneously. FIS shipped agent identity checks to every issuing bank on its platform. Amazon, absent from the conversation entirely in January, appeared in three layers at once by April.

The stack is complete. Every layer, from discovery to settlement, has at least one production implementation. Some layers have three. Nobody agreed on which protocols go where, which ones interoperate, and which ones will become defaults. But the pieces are live. Real agents are buying real products on real payment rails.

And then it started consolidating. The final weeks of Q1 saw structural shifts that nobody predicted: a stablecoin protocol backed by card networks, a consumer authentication tool repurposed for corporate payments, and a $50 billion bet that placed the world's largest retailer inside the infrastructure stack.

Before an AI agent can buy anything, it needs to find products and express what it wants. Two protocols own this layer. They disagree on how much of the commerce journey belongs here.

Google's Universal Commerce Protocol (UCP) is the more ambitious of the two. Announced at NRF in January 2026, UCP defines the full commerce workflow from product discovery through checkout and order management. The architecture is layered: a core Shopping service handles transaction primitives, independently versioned capabilities (Checkout, Orders, Catalog) add functional areas, and extensions allow domain-specific customisation.

The partner list reads like a roster of American retail. Shopify, Etsy, Wayfair, Target, Walmart. Over 20 partners endorsed it at launch, including Adyen, American Express, Best Buy, Macy's, Stripe, Visa, and Zalando. Merchants can integrate via APIs, Agent-to-Agent (A2A), or MCP, which means UCP sits above the communication protocol rather than prescribing one.

OpenAI's Agentic Commerce Protocol (ACP), maintained jointly with Stripe, takes a deliberately narrower approach. Where UCP tries to standardise the entire commerce journey, ACP focuses on checkout. The specification defines how ChatGPT calls a merchant's checkout session endpoint, updates the session as users change items or shipping, and receives order lifecycle events via webhooks. It is a clean, bounded problem. Stripe's technical documentation lays out exactly how it works.

ACP is already live. OpenAI launched "Buy it in ChatGPT" in February for all US users. Over one million Shopify merchants are accessible. Etsy sellers are active. PayPal's ACP server will bring additional businesses onto the platform in 2026. Worldpay has published an ACP integration guide. And OpenAI is not slowing down. The company now has 900 million weekly users, up from 800 million just weeks ago, and closed a $122 billion funding round at an $852 billion valuation. The largest consumer AI surface on the planet is also a checkout surface.

The tension between UCP and ACP is architectural. UCP says: standardise the full journey, discovery to post-purchase support. ACP says: standardise checkout, let the AI platform handle everything else. Both are open source. Both are in production. Merchants integrating today are making a choice, and that choice shapes which AI platform controls commerce.

An agent found a product. Now someone needs to verify the agent is legitimate and has permission to act on a consumer's behalf. This is where the card networks planted their flags.

Visa's Trusted Agent Protocol (TAP) addresses agent identity with cryptographic signatures. Agents sign HTTP requests using private keys. Merchants verify those signatures against a trusted key store maintained by Visa's payment scheme. The signed payload includes agent intent, consumer recognition data, and payment information. Timestamps and nonces prevent replay attacks.

The protocol was built in collaboration with Cloudflare and Akamai, which tells you where Visa thinks the enforcement should happen: at the network edge, before the request reaches the merchant. Why the urgency? Visa reported a 4,700 percent surge in AI-driven traffic to US retail sites. TAP is the answer to distinguishing legitimate agents from malicious bots at that scale.

But TAP is no longer just a retail play. Visa signed on as a customer of Ramp, using Ramp's AI agents for its own corporate bill payments. Read that again. The company that built the Trusted Agent Protocol is now using it through a corporate expense platform. The numbers are concrete: 85 percent invoice coding accuracy, $1 million in fraud flagged within 90 days, across Ramp's 50,000+ customers and $100 billion+ in annual purchase volume. TAP was designed for a world where agents buy consumer goods. Visa just proved the same protocol works for corporate expense management. The addressable market for agent authentication expanded from retail to the entire B2B payments stack in one deal.

Mastercard deployed two complementary frameworks. The Agent Pay Acceptance Framework provides governance for AI agents to transact using tokenisation, strong authentication, and fraud prevention. Verifiable Intent adds a cryptographic proof layer on top. When an agent books a $3,000 trip on your behalf, Verifiable Intent creates a tamper-proof record of what you actually authorised. If you dispute the insurance charge later, that record exists.

And Mastercard moved fast. After launching Agent Pay in Latin America, the company pushed into Hong Kong. Three continents in one month: Latin America, North America, and Asia. That is not a pilot programme. That is a global rollout happening at a pace that most payments infrastructure takes years to achieve.

The gap between Visa and Mastercard's approaches is subtle but real. TAP focuses on agent authentication: is this agent who it claims to be? Verifiable Intent focuses on consumer authorisation: did the human actually tell the agent to do this? Both questions need answering. Neither protocol answers both.

Protocols are academic until they reach the infrastructure that actually moves money. Two companies turned these protocols into defaults in Q1.

Fiserv became the first major processor to adopt both Visa's TAP and Mastercard's Agent Pay simultaneously. The Visa Acceptance Platform, a unified API-driven acceptance layer, integrates into Fiserv's European acquiring operations. Mastercard's framework plugs in alongside it. Merchants on Fiserv's platform will gain agentic commerce capability without making a single integration decision. It just shows up in a platform update.

FIS approached from the issuer side. Its agentic commerce offering, announced in January and now shipping to all issuing bank clients, gives banks the ability to evaluate AI agents using "Know Your Agent" (KYA) data before authorising transactions. The logic mirrors Know Your Customer for humans: before the bank approves a payment, it needs to know who is asking. FIS built that identity check for non-human initiators. The offering covers transaction authorisation, fraud detection, loyalty, and customer servicing.

This layer matters more than it looks. These are the companies whose infrastructure runs underneath the payment networks. When Fiserv and FIS adopt agentic protocols, millions of merchants and thousands of banks gain the capability through upgrades they did not specifically request. That is how standards become defaults. Not through adoption campaigns. Through processor updates.

Discovery done. Agent authenticated. Processor ready. Now the money needs to move. Three approaches are competing, and the lines between them blurred dramatically in late Q1.

Traditional card rails remain the default path. Santander and Visa completed live agentic payments across Latin America in March. Real money, production networks, transactions initiated by AI agents and settled through the same rails that process billions of human transactions daily. These transactions settle on existing Visa and Mastercard rails, which means the familiar three-day clearing window, interchange fees, and chargeback framework all apply.

Card settlement works. It has worked for decades. But the economics get awkward when agents start transacting at machine speed. An agent querying 40 APIs per minute, making micropayments for data access, paying fractions of a cent for compute, that is a use case card rails were never designed for. Interchange makes sub-dollar transactions unviable. The question is not whether card settlement works. It is whether it works for the transaction patterns agents will create.

x402 offers a fundamentally different answer. Built by Coinbase, the protocol embeds stablecoin settlement into HTTP itself. An agent hits an API endpoint, gets a 402 Payment Required response, and settles onchain in seconds. No intermediary bank. No clearing window. The protocol has processed over 15 million transactions on Base, though daily volume still sits at roughly $28,000. That gap between institutional backing and actual usage is one of the most telling data points in the entire space.

Then came the structural shift. On April 2, Coinbase transferred x402 to the Linux Foundation, launching the x402 Foundation. The founding coalition reads like someone merged the boardrooms of payments and cloud: Stripe, Visa, Mastercard, Google, AWS, Microsoft, Cloudflare, American Express, Shopify, Circle, and Polygon Labs. Twelve founding members. Card networks, cloud providers, processors, and crypto-native companies sitting at the same table for a stablecoin settlement protocol.

Sit with that for a moment. Visa and Mastercard, whose entire business model depends on interchange revenue from card-based settlement, are founding members of a protocol designed to settle payments via stablecoins. Either they believe x402 will complement their rails, or they believe it will compete and they want a seat at the table regardless. Both interpretations tell you something important about where settlement is heading.

This looks a lot like what happened with open banking. The banks initially fought it. Then they realised they could not stop it. Then they joined the standards bodies and ensured the specifications worked within their existing infrastructure. Visa and Mastercard joining x402 is the same play. If stablecoin settlement is coming for agent micropayments, better to write the rules than be subject to someone else's.

Google's Agent Payments Protocol (AP2) bridges the two approaches. AP2 integrates with x402 for stablecoin settlement and with traditional payment methods for fiat. It sits between the commerce layer (UCP) and whatever settlement rail the merchant accepts. That makes AP2 one of the most strategically important protocols in the stack. Whichever settlement rail wins, AP2 routes traffic to it. Google does not need to pick a side. It needs to sit in the middle.

Here is every production protocol for agentic commerce as of April 2026.

Ten protocols. Four layers. The stack is complete and consolidating.

Not every player holds the same kind of leverage. Here is who controls what, and why it matters.

Google holds the broadest position of anyone on the board. UCP for discovery, AP2 bridging both settlement rails, a founding seat at the x402 Foundation. Google does not need any single protocol to win. It needs to sit between all of them. Its AI surfaces, Gemini and AI Mode, are where agent commerce conversations start for a growing number of consumers. If UCP becomes the default discovery layer, Google owns commerce the way it owns search. That is the search engine model applied to commerce infrastructure.

Amazon is the surprise entrant. Not building a protocol. Not launching a framework. Just writing very large cheques. $50 billion into OpenAI ($35 billion contingent on IPO). A $100 billion AWS cloud deal over eight years. A founding seat at x402. In three weeks, Amazon went from absent to holding positions in settlement (x402 via AWS), AI platform (OpenAI investment), and cloud infrastructure (the compute layer everything else runs on). Amazon is doing what Amazon always does: owning the infrastructure layer and letting everyone else compete on top of it.

Visa is playing both sides of the settlement question. TAP for agent authentication on card rails. Founding member of x402 for stablecoin settlement. Customer of Ramp for its own corporate payments. Visa is not betting on which settlement rail wins. It is ensuring that agent authentication runs through Visa regardless of which rail carries the transaction.

OpenAI has distribution that dwarfs most payment companies. 900 million weekly users. $852 billion valuation. "Buy it in ChatGPT" live for US consumers. ACP is narrower than UCP, but OpenAI controls the screen where millions of people interact with AI agents daily. Protocols matter. Distribution matters more.

Mastercard has the liability answer. Verifiable Intent is the only framework that creates a tamper-proof record of consumer authorisation. In a world where agentic dispute rates are an unsolved problem, the company with the audit trail has leverage that grows every time a chargeback lands.

Coinbase traded control for legitimacy. Transferring x402 to the Linux Foundation means Coinbase no longer owns the protocol. But a Coinbase-owned protocol going nowhere is worth less than a Linux Foundation protocol with the entire establishment as founding members. Smart trade.

Fiserv and FIS have the quiet power: distribution through plumbing. Fiserv adopted both Visa TAP and Mastercard Agent Pay. FIS shipped KYA to every issuing bank on its platform. Protocols are academic until processors ship them. These two companies can make agentic commerce a default capability for millions of merchants and thousands of banks without anyone making a conscious adoption decision.

The stack is complete. It is not finished. Four gaps remain, and each one is big enough to stall the entire system.

Identity is still fragmented. Here is the core problem: 78 percent of organisations have no formal policies for non-human identities. Visa's TAP and Mastercard's Agent Pay each solve part of the authentication puzzle. Neither creates a universal agent identity that works across protocols. An agent authenticated by Visa is not automatically trusted by a Mastercard merchant. The x402 Foundation, with its cross-industry membership, could become the forcing function for a shared identity standard. Could. Has not yet.

Disputes are still unsolved. The chargeback system was designed for human buyers who can be contacted, questioned, and held accountable. Friendly fraud already accounts for 75 percent of chargebacks. Agent-initiated transactions add a genuinely new category: purchases the consumer authorised in the abstract but does not remember specifically. Your agent booked the hotel, added the insurance, and upgraded the room. You agreed to "book the trip." Did you agree to the upgrade? Mastercard's Verifiable Intent is the closest thing to a solution. It is not enough on its own.

Governance is crystallising, slowly. The emerging On Behalf Of (OBO) framework for agentic trust represents the first attempt at a cross-industry accountability structure. Rep. Gottheimer's letter to Anthropic on AI safety signals that legislators are paying attention. The x402 Foundation provides formal governance for settlement. But most other protocols still depend on bilateral agreements between companies rather than shared standards. When Google's UCP and OpenAI's ACP both claim to handle checkout but define the session schema differently, who resolves the incompatibility? Nobody, yet.

Security got its case study. The LiteLLM supply chain breach validated every concern the security community had been raising. LiteLLM, an AI gateway present in 36 percent of cloud environments, was compromised. 500,000 machines affected. Four terabytes stolen from Mercor, a $10 billion AI startup. It was the first documented use of an AI agent in a supply chain attack.

The protocols in this map handle commerce flows. They authenticate agents, authorise consumers, route payments, settle funds. None of them adequately address what happens when the agent itself is compromised. A perfectly authenticated agent with a valid cryptographic signature, operating on compromised infrastructure, will pass every check in the stack. That is the gap nobody wants to talk about.

The next 90 days will tell us whether the consolidation pattern holds or fractures.

x402 Foundation governance. The founding members include direct competitors. How Visa and Mastercard negotiate stablecoin settlement rules alongside Coinbase and Circle will define whether x402 becomes a genuine standard or a committee that produces documents nobody reads.

ACP international expansion. "Buy it in ChatGPT" is US-only. OpenAI has the users globally. Stripe has the payment infrastructure globally. The question is when, not whether.

Visa TAP in B2B. The Ramp integration is a proof point. If more corporate payment platforms adopt TAP, agent authentication becomes a B2B standard, not just a retail one. That changes the revenue model entirely.

Interoperability. Still the biggest gap. An agent authenticated by Visa's TAP, checking out via OpenAI's ACP, and settling on x402 stablecoin rails still requires navigating three separate protocol specifications maintained by three different organisations on three different versioning cycles. The x402 Foundation might become the forum where cross-protocol coordination happens. Or it might become another standards body that meets quarterly and publishes whitepapers.

The protocols are hardening. Every month they remain in production, more merchants integrate, more agents adopt them, and switching costs compound. The companies that set the rules now will collect rent on them for the next decade. This is how it went with card networks. By the time Discover launched in 1985, Visa and Mastercard had already established the network rules. Discover built a better product on several dimensions. It did not matter. The rules were already written.

The agentic commerce rules are being written now. By Q4, they will be difficult to rewrite.

Ten protocols shipped in a single quarter. The biggest card networks, cloud providers, and AI companies are all sitting at the same governance table for stablecoin settlement. The stack is consolidating faster than anyone predicted. Which layer are you building on, and what happens when the protocol next to yours wins instead?