Mastercard, Google, OpenAI, and Cloudflare are all racing to define how AI agents shop, pay, and prove they're legitimate. The protocols they build now will determine who controls the next era of digital commerce.

On March 5, Mastercard announced Verifiable Intent, an open-source cryptographic framework that creates a tamper-resistant record every time an AI agent makes a purchase on a consumer's behalf. The same week, Splitit joined Google's Universal Commerce Protocol to bring instalment payments to AI shopping agents. And Bain & Company published new research showing that 30 to 45 percent of US consumers already use generative AI to research and compare products.

Three announcements in a single week. Three different angles on the same problem. One unmistakable signal: the race to define the standards for agentic commerce is no longer theoretical. It is happening now, and the stakes could not be higher.

To understand what is being built, we need to map the competing and complementary frameworks now taking shape. They fall into three distinct tiers.

The first tier is commerce protocols. These define how AI agents handle the shopping journey itself, from product discovery through to checkout. OpenAI's Agentic Commerce Protocol (ACP), co-developed with Stripe, powers Instant Checkout in ChatGPT and is open-sourced on GitHub under Apache 2.0. It launched with US Etsy sellers and is expanding to over one million Shopify merchants. Google's Universal Commerce Protocol (UCP), announced in January 2026, takes a more surface-agnostic approach, establishing a common language for agents to operate across consumer surfaces, businesses, and payment providers. It was built in collaboration with Shopify, Etsy, Wayfair, Target, and Walmart.

The second tier is payment and trust protocols. These focus on verifying that an AI agent has genuine permission from a real consumer, protecting payment credentials, and distinguishing legitimate agents from malicious bots. Mastercard's Agent Pay programme, launched in 2025, now includes Verifiable Intent: a cryptographic proof layer that links consumer identity, specific instructions, and transaction outcomes into a single record. Visa's Trusted Agent Protocol, developed with Cloudflare, takes a similar approach through the Visa Intelligent Commerce platform. Google's Agent Payments Protocol (AP2) handles the secure exchange of payment credentials between agents and merchants.

The third tier is infrastructure protocols. Cloudflare's Web Bot Auth provides the authentication foundation that both Visa and Mastercard build upon, using HTTP Message Signatures to cryptographically verify agent identity. Google's Agent2Agent (A2A) protocol handles communication between agents themselves. And Anthropic's Model Context Protocol (MCP) defines how agents interact with external tools and services.As PayPal noted in its guide for merchants navigating this landscape, these three tiers are not competing alternatives. They are complementary layers of a stack that is being assembled in real time, by different players, with different strategic incentives.

History tells us that in payments, the companies that win are not necessarily the ones that build the best products. They are the ones that set the rules.

Visa and Mastercard did not become the dominant forces in global payments by issuing cards. They became dominant by owning the network rules, the interchange frameworks, and the certification processes that every bank, processor, and merchant had to follow. The product was secondary. The standard was everything.

Agentic commerce is now repeating this pattern at extraordinary speed. Bain & Company's March 2026 research frames the opportunity clearly: around half of consumers say they are not yet ready for fully autonomous AI transactions, but early adopters are already using ChatGPT and Copilot to shop and check out directly from AI platforms. McKinsey estimates that agentic commerce could generate between $3 trillion and $5 trillion in global consumer commerce by 2030.

That is not a product opportunity. That is an infrastructure opportunity. And the organisations writing the specifications today, defining what counts as verified intent, how an agent proves its identity, and how disputes get resolved, are positioning themselves to capture structural power in a market that barely exists yet.

As we explored in our analysis of the financialisation of everything, the pattern is consistent: when new transaction types emerge, the value accrues not to the participants but to the platforms that define the rules of participation.

Every protocol in this race claims to be open. Every announcement emphasises collaboration, shared standards, and ecosystem-wide benefits. The rhetoric of interoperability is universal. The architecture choices tell a more nuanced story.

OpenAI's ACP is open-source and technically payment-processor-agnostic, but its first and primary implementation runs through Stripe. Merchants can bring their own payment service provider, but the reference implementation, the documentation, and the path of least resistance all point to Stripe's infrastructure. Google's UCP works across surfaces and is compatible with A2A, AP2, and MCP, but the protocol routes discovery and intent signals through Google's ecosystem. Mastercard's Verifiable Intent is designed to be protocol-agnostic, working alongside both Google's AP2 and UCP, but it deepens the dependency on card network infrastructure for the trust verification layer that sits at the heart of every agent transaction.

None of this is inherently problematic. Standards always embed the strategic interests of their creators. But it means that merchants and payment providers need to look past the "open" branding and understand whose infrastructure becomes essential at each layer of the stack.Lily Varon, principal analyst at Forrester, offered a useful reality check in Modern Retail. She described the current state of agentic commerce infrastructure as a train that has left the station but is running on "rickety rails." The fundamental plumbing is being built, she noted, but usable products remain scarce and consumer adoption is still in its earliest stages. She expects 2026 to be a year of gestation, with meaningful pickup in 2027.

That timeline matters. It means the standards being written now will harden into defaults before most merchants and consumers have even experienced their first agent-driven transaction.

For merchants, the emerging protocol landscape presents a familiar problem with unfamiliar stakes.

In the early days of e-commerce, businesses had to decide which platforms to support, which payment gateways to integrate, and which checkout experiences to build. The fragmentation was painful but manageable. Most merchants eventually converged on a handful of providers.

The agentic commerce equivalent is more complex. A merchant that wants to be discoverable by AI shopping agents now needs to think about structured product data optimised for AI surfaces (Google's Merchant Center attributes), checkout endpoints compatible with ACP (for ChatGPT Instant Checkout), UCP integration (for Google's ecosystem), and Web Bot Auth support (to verify agent identity for Visa and Mastercard transactions). Each layer adds technical overhead. Each protocol has its own documentation, its own integration path, and its own assumptions about how commerce should work.

Splitit's integration with Google's UCP, announced on March 5, illustrates how payment methods themselves are adapting. By making card-linked instalments available within UCP, Splitit is positioning flexible payments as a native capability of agent-driven shopping, not an afterthought. The logic is sound: AI-driven traffic to US retail sites surged during the 2025 holiday season but converted at lower rates than traditional channels because checkout hasn't fully shifted to AI platforms. Removing friction at the payment layer is essential.

PayPal, working with both OpenAI and Google, published a merchant guide in January that acknowledged the complexity directly, framing the protocol moment as an opportunity but also a challenge for businesses unsure where to start. The guide recommended that merchants begin with catalogue optimisation and choose a trusted commerce partner to abstract away protocol complexity, rather than attempting to integrate with every standard independently.

That advice is pragmatic. But it also reveals the underlying dynamic: merchants are being steered toward intermediaries who can manage multi-protocol complexity on their behalf. And those intermediaries, by definition, become the new gatekeepers.

As we noted in our coverage of Mastercard's Verifiable Intent, the merchants who move early will shape how these standards develop. Those who wait may find the rules already written.

Several developments in the coming months will determine whether the current standards race produces genuine interoperability or quiet consolidation.Mastercard plans to integrate Verifiable Intent directly into its Agent Pay APIs, which will bring cryptographic proof of consumer authorisation into live transaction flows for the first time. Google is rolling out Business Agent, a feature allowing shoppers to chat with brands directly from Search, with agentic checkout built in. OpenAI is expanding Instant Checkout beyond Etsy and Shopify, with multi-item carts and additional merchants planned.

The regulatory dimension is also emerging. Agent-initiated transactions raise novel questions about liability, dispute resolution, and consumer protection. If an AI agent exceeds its instructions and makes an unauthorised purchase, current chargeback frameworks were not designed to handle the complexity. Mastercard's Verifiable Intent is explicitly positioned as a solution to this problem, creating a cryptographic audit trail that all parties can consult. But whether regulators accept cryptographic proof of intent as sufficient, or demand additional safeguards, remains an open question.

The deeper pattern is structural. In the next 12 months, the protocols that attract the most merchants, the most agent developers, and the most payment volume will become self-reinforcing standards. Network effects will kick in. Switching costs will rise. And the window for influencing how agentic commerce works, who captures the value, and who bears the risk, will begin to close.

The companies writing the rules know this. That is why the announcements are coming weekly, the partner lists are growing, and the word "open" appears in every press release.