Let us start with a number that should not exist.
In the third week of a quarter that most analysts had already filed under sideways consolidation, a mid-cap specialty retailer watched its organic referral sessions collapse roughly 38% week-over-week. No core update. No checkout outage. No pricing event. The sessions simply stopped arriving — not because customers changed their minds, but because a summarization layer answered their question before the click ever happened. The funnel did not break at the top. It was amputated in the middle, and the amputation left no log line, no error, no alert. Just a quieter graph and a marketing team staring at a dashboard that had stopped telling the truth.
That anomaly is the cleanest signal I have seen this cycle, and it points at something the market is still pricing incorrectly. The conversation about artificial intelligence in commerce has been framed as a model-capability race — bigger context windows, cheaper inference, better benchmarks. That framing is a distraction. The real contest is not which model reasons best. It is who controls the protocol layer where an autonomous agent converts an intent into a settled transaction. The hash is not the art; it is merely the key. And right now, almost nobody is auditing the lock.
Context: From Discovery to Execution
The terminology here is young, and I want to be honest about its provenance before I lean on it. The phrase "Agentic Commerce Optimization," or ACO, is generally attributed to Scot Wingo, and much of the recent framing circulates through a small industry report — an "End of Q3 Vibe Check" from a source called Retailgentic. I cannot independently verify the existence or contents of that report, and I would rather state that caveat plainly than bury it. Treat the label as a useful handle, not a validated standard. The moment a framework arrives without a timestamp, a named author, or a verifiable source, you should lower your confidence in every conclusion built on top of it.
What I can verify is the underlying mechanic, because it is visible in the data plumbing.
For two decades, the dominant commercial protocol was human attention routed through a search box. You typed a query. A ranking function returned links. You clicked. A session cookie was set. An attribution model — last-touch, or some marketing-team approximation of it — credited a channel. The entire apparatus of SEO, performance marketing, affiliate networks, and retail media was built on one atomic unit: the click. Everything downstream of the click, including the conversion, was secondary. The click was the billable event, and every budget, every agency retainer, and every media rate card was denominated in it.
Generative Engine Optimization, or GEO, bent that model but did not break it. Instead of optimizing to rank in a list, you optimized to be summarized by a language model. The click survived, thinned. The atomic unit became the citation.
ACO breaks the unit entirely. If an autonomous agent can read a merchant's catalog, compare options, verify stock, negotiate a price, authorize a payment, and settle — then the click is no longer necessary. The billable event migrates from attention to execution. And execution is a protocol problem, not a content problem.
This is precisely the seam where the industry narrative and the engineering reality diverge. The narrative says "optimize for agents." The engineering says "expose a machine-readable, machine-executable commerce surface." Those are not the same statement, and the gap between them is where the next two years of value will be won or lost. One is a marketing brief. The other is an interface specification with real-time guarantees, and most merchants do not have the latter.
Core: The Four Interfaces and the Readable/Executable Requirement
When I strip the marketing language away, the "four agent interfaces" that keep appearing in these discussions are not a taxonomy of products. They are a taxonomy of protocol surfaces, and they map cleanly onto layers I have spent a decade auditing.
Answer engines are the summarizers — the systems that intercept intent before a click and return a synthesized recommendation. Retailer agents are the brand-owned or platform-owned bots that represent a specific merchant's inventory. Personal agents are the user-side delegates that hold a consumer's preferences, budget, and payment credentials. Direct merchant APIs are the merchant's own structured endpoint that any of the above can call.
Notice what is absent from that list: any model-layer differentiation. Every one of those four interfaces can be served by a mediocre model. What they cannot be served by is unstructured data. The decisive criterion is deceptively simple — the surface must be simultaneously readable and executable. Readable means a machine can parse what you sell, at what price, in what quantity, under what constraints. Executable means a machine can act on that parse — reserve, authorize, pay, confirm — without a human completing a form.
In practice, "readable" means structured product data: schema.org markup, product feeds, consistent identifiers, normalized attributes. I have watched this problem for years, and it has never been solved at the long tail, only at the head. The top ten thousand SKUs on a major marketplace are clean. The next ten million are a swamp of inconsistent attribute naming, orphaned images, and price fields that update on a batch cadence measured in hours. An agent that reads a batch-updated price field is reading a historical document, not a live quote. This is not a subtle failure mode. It is the difference between a transaction and a dispute.
"Executable" is harder, and it is where the real engineering debt lives. An executable commerce surface requires, at minimum, three things that most merchants do not have. A real-time inventory and price API, because an agent that reserves an item you no longer have is worse than no agent at all — it manufactures a broken promise at machine speed. An authorization layer, because an agent that can spend is an agent that can be drained. And an identity layer, because a merchant needs to know which delegate is acting and under what mandate, not merely that some delegate is acting.
Here is where my own experience sharpens the picture. In 2026 I spent a large part of a year on exactly this seam — designing an interface specification that let autonomous agents sign transactions through zero-knowledge proofs, specifically to bound the blast radius of model hallucination. The problem I was solving was never "can the model decide?" It was "can the model's decision be cryptographically constrained so that a bad decision is a bounded loss rather than an irreversible one?" The hash is not the art; it is merely the key. The agent's intent is the art. The proof is the fence around it. A hallucinated quantity should cost you a refund, not a warehouse of unsold inventory.
That fence is missing from almost every commercial architecture being pitched right now. And I understand why: building the fence is unglamorous, it does not demo well, and it does not fit on a slide about growth. But it is the difference between a system that scales and a system that accumulates silent liabilities until someone forces a reconciliation.
Let me make the trade-off concrete, because this is where the framework-level articles stop and the engineering begins. There are two ways to make a commerce surface executable, and they have opposite failure profiles.
The first is a platform-mediated path. The agent calls a platform's private API, the platform handles inventory, payment, and dispute resolution, and the merchant integrates once — into that platform. The cost is low and the time-to-market is short. The price is that the merchant surrenders the customer relationship, the pricing data, and the dispute surface to the intermediary. This is the Amazon Rufus model generalized into an architecture. It is elegant, it works, and it is a lock-in engine. Every convenience it offers is a dependency it installs.
The second is an open-protocol path. The merchant exposes a standardized endpoint, the agent authenticates against an open identity scheme, and payment settles through a neutral rail. The cost is high — you are now maintaining a public interface contract with real-time guarantees, and you own the uptime — and the reward is that you keep the relationship and the data. But "open" only works if enough parties adopt the same standard, and right now the standard landscape is fragmented across private protocols from at least half a dozen large players, each with its own payment semantics, its own identity assumptions, and its own definition of what a "confirmed" transaction means.
The uncomfortable middle is where most merchants will actually live: forced to adapt to multiple incompatible protocols simultaneously. I have audited enough integration layers to know what that produces. It is not interoperability. It is a maintenance tax with a different name. Every additional private protocol a merchant must support multiplies its surface area for bugs, price desynchronization, and silent overselling. Three protocols is not three integrations. It is three integrations plus the pairwise reconciliation logic between them, and the reconciliation logic is where the bugs live because it is the part nobody writes tests for.
Now consider the load characteristics, because they change the economics in a way the commercial narrative ignores. A traditional search query is a single retrieval against an inverted index. An agentic purchase is a multi-step reasoning trace: retrieve candidates, compare attributes, check live inventory, verify price, validate a constraint set, authorize, execute, confirm. That is not one inference call. It is a chain of tool calls, and each step can fail, retry, or hallucinate. The token consumption per settled transaction is an order of magnitude above a search — and the latency budget is far tighter, because the consumer is waiting and the inventory is evaporating in real time.
This has a direct architectural consequence that almost no one is modeling: inference cost becomes a binding constraint on the platform's take rate. If it costs a meaningful fraction of a dollar in compute to complete a single agentic purchase, then the margin structure of agentic commerce is fundamentally different from the margin structure of search advertising, where the marginal cost of a query is near zero. Search advertising scales on a flat cost curve — every additional query is nearly free, which is why the take rate can be generous and the margins extraordinary. Agentic commerce does not have that property. Its cost curve is linear in reasoning steps, and reasoning steps scale with catalog complexity. The platforms will discover this the way every infrastructure operator discovers it — in the P&L, after the growth narrative has already been sold to the market.
I built a simulator for a version of this problem years ago, modeling Uniswap v2 liquidity under volatility, and the lesson transferred cleanly. The headline mechanism is never the binding constraint. The binding constraint is always the edge case you did not model. For agentic commerce, that edge case is the concurrent grab. Ten agents hit the same SKU in the same millisecond, each holding a stale inventory snapshot. Who wins? Who eats the oversell? Who is liable when the confirmation the agent displayed to the user diverges from what the merchant actually shipped? The protocol layer that answers those questions is the one that captures the value — not the model layer, and not the merchant.
And here is the hidden design layer that the "four interfaces" framing obscures: agent experience, or AX. A surface must now serve two audiences with structurally opposed incentives. Human-facing design has spent two decades optimizing for friction — dark patterns, urgency timers, pre-checked boxes, ambiguous pricing, drip pricing, and every other trick that converts a hesitant human. Agent-facing design requires the opposite: radical transparency, deterministic pricing, machine-verifiable constraints, and complete attribute disclosure. Every merchant is about to discover that these two objectives are in direct conflict, and that retrofitting an API onto a dark-pattern funnel produces a machine-readable lie. The agent will read the lie, act on it, and the resulting dispute will be adjudicated by a protocol that never anticipated a merchant optimizing for a machine's confusion.
Contrarian: The Blind Spot Is Trust, and the Invisible Losers Are Not Merchants
The consensus takeaway from the ACO narrative is that merchants who fail to adapt will be culled, and that "infrastructure is the moat." I think that is half right and strategically misleading in the half that matters.
The half that is right: a merchant with no machine-executable surface is invisible to a delegation economy. If your catalog cannot be parsed, you do not exist to the agent, and non-existence is a worse outcome than losing a ranking battle. That much is true and worth internalizing.
But "infrastructure is the moat" is true only at the very top of the market. For a small or mid-sized merchant, the infrastructure is not a moat — it is a new fixed cost, and a cost that does not even guarantee selection. You can build the cleanest feed in your category and still lose every agentic purchase to a platform's private default, because the default surface is not chosen on merit. It is chosen on integration depth and commercial terms. The moat belongs to whoever owns the default, and the default is not a merchant decision. It is a platform decision. This is the centralization risk that the "optimize for agents" pitch consistently underplays: the same dynamic that concentrated discovery into a handful of search engines will concentrate execution into a handful of agent platforms, and execution is a far more valuable chokepoint than discovery ever was.
The half that is misleading is the framing of who gets hurt. The narrative points at merchants and at SEO practitioners. The actually exposed parties are the middle layer that monetizes attention: retail media networks, affiliate networks, and performance agencies. Retail media is a hundred-billion-dollar market built entirely on the click as a billable unit. When the click stops being the atomic event, that entire ledger loses its unit of account, and the loss is not gradual. Affiliate marketing has the same structure — it pays on attribution, and attribution collapses when a delegate intermediates the journey and the human never sees the merchant. I have seen this pattern before, in 2017, when I was auditing a token distribution contract while everyone around me was pricing the marketing deck. The people most exposed are almost never the people the narrative names.
But the deeper blind spot — the one that should keep protocol engineers awake — is that trust and authorization are treated as a footnote when they are actually the whole problem. The narrative says "agent-merchant trust." That phrase hides an entire research program: how does a merchant verify that a delegate is authorized, how does a user bound a delegate's spending, and how does a dispute resolve when the agent, the platform, and the merchant all point at each other? None of these questions has a settled answer, and each one is a precondition for scale, not a refinement to be added later.
Beneath trust sits a new attack surface that did not exist in the click economy. Product descriptions are now inputs to a model. That means a product description is now an injection vector. A malicious or merely careless merchant can craft attribute text that steers a summarizing agent toward its listing — a prompt-injection payload dressed as a specification. The optimization discipline that GEO started — shaping what a model says about you — extends directly into shaping what a model does. And "what a model does" now includes spending someone else's money. The surface that GEO treated as a reputation problem is, under ACO, a transaction-execution problem, and transaction-execution problems settle in courts, not in rankings.
I mapped the risk categories during my 2022 isolation, reverse-engineering the MakerDAO liquidation engine to understand how cascading failures propagate through a state machine. Agentic commerce is a new state machine with the same failure topology: a local trigger — one poisoned listing, one stale price, one mis-signed authorization — propagating into a systemic event because the participants share the same data dependency. In Maker, the shared dependency was an oracle. Here, it is the structured feed. Poison the feed, and every agent that reads it acts on the poison simultaneously. The difference is that Maker's failure mode was liquidations, and agentic commerce's failure mode is mis-directed spending at machine speed, across a surface with no circuit breaker.
The liability vacuum is the sharpest version of this. When an agent mis-buys — hallucinated a size, misread a return policy, ignored a budget constraint — the loss lands somewhere, and the protocol that defines where it lands is the protocol that defines the market. Nobody has written that protocol yet. The regulators have not even named the problem. That silence is not stability. It is deferred volatility, and the people who will pay for it are the ones who assumed the platform would absorb the loss.
Takeaway: The Protocol Defines the Market
The strategic conclusion is not "merchants must adopt ACO." That is a supply-side pitch, and I would not stake a thesis on a term whose provenance I cannot verify and whose unit economics nobody has published. The conclusion is narrower and more durable: whoever defines the protocol between an agent and a merchant defines the entrance to the next decade of commerce. The model is a commodity. The interface is the territory. And the territory is being fenced right now, in private, by parties who have every incentive to make the fence invisible until it is load-bearing.
Watch three signals, and ignore the rest. Whether any platform publishes agent-transaction volume and take-rate as a discrete line item — the moment that number appears, the theme stops being a narrative and becomes a market. Whether the private protocols converge or fragment, because fragmentation is a tax on every merchant and a moat for every platform. And whether a liability framework emerges — voluntary or regulatory — for agent-initiated purchases, because without it the entire execution layer runs on an unhedged tail.
The hash is not the art; it is merely the key. The question that should be keeping every protocol architect up at night is not whether the machines will buy. They will. The question is who holds the key to the lock they turn — and whether anyone has audited it before the volume arrives.