The Three Percent Fill Rate
Forty-two percent of merchants have an agentic checkout pilot running. Three percent of transactions actually flow through one.
That gap is the entire story, and almost nobody selling the story wants to talk about it. The supporting cast of numbers is familiar by now: teen adoption of AI shopping assistants at twenty-seven percent, adults at sixteen, consumer trust in unverified agent recommendations at fourteen percent, and a hard behavioral cliff somewhere around a fifty-dollar basket. Below fifty dollars, people will let a machine pick. Above it, they will not.
The headline number attached to all of this is three hundred million users delegating shopping decisions to AI agents by 2030. That figure did not come from a settlement ledger, a stablecoin mint, or a rollup sequencer. It came from a card network's press cycle, and it was repeated by payment processors with a direct commercial interest in every incremental dollar of online transaction volume.
I have spent most of my career reading ledgers that nobody wanted read. In 2018 I spent three months auditing the order-routing logic of the 0x v2 contracts while the ICO market was busy pricing whitepapers, and I found seven vulnerabilities that never made it into a press release. In 2021 I ran wallet clustering across the top ten NFT collections by volume and found that roughly forty percent of the reported trading was bots talking to each other. The pattern is stable across every hype cycle I have documented: the forecast is published, the infrastructure is not, and the difference between the two is where retail capital gets destroyed.
Three percent is not a rounding error on the way to three hundred million. It is a measurement of how far the authorization layer is from existing. And authorization, not recommendation, is the product.
Context: Who Wrote the Three Hundred Million Number
Agentic commerce is a simple idea with an expensive implementation. Instead of a human browsing a catalog, clicking a cart, and typing a card number, a software agent holds a budget, a preference set, and a mandate, then executes purchases on the human's behalf. The human states intent. The agent finds, compares, negotiates, and settles.
The pitch is compelling because the friction it removes is real. Comparison shopping is tedious. Coupon discovery is tedious. Reordering consumables is tedious. Any task that is high-frequency, low-variance, and low-stakes is a legitimate automation target. That is why agent adoption is clustering at the bottom of the price curve rather than the top.
What makes this cycle different from previous automation waves is that the agent is not just advising. It is transacting. That moves the problem out of the recommender-system domain, where a bad suggestion costs a click, and into the payments domain, where a bad execution costs money and creates a liability.
Into that gap have stepped the incumbents. Mastercard has been building agent payment rails. Visa has published a trusted-agent framework. Google has shipped an agent payments protocol. Stripe and OpenAI have co-authored a commerce protocol for agent-initiated checkout. Coinbase has promoted an HTTP-native payment scheme built on the long-dormant 402 status code. Several of these are live on testnets. A few are live with real money in constrained corridors. All of them are being described in the same breath as a three-hundred-million-user market.
The sourcing matters. The adoption percentages, the merchant pilot rate of forty-two percent, the eighty-nine percent of companies "preparing," the three percent of transactions actually executed — these come from payment processors and card networks. The forty-two percent figure traces to a merchant survey run by a payment provider, which means the sample skews toward merchants already on that provider's stack: technically literate, integration-ready, and predisposed to say yes to a pilot that costs them an afternoon of engineering.
None of that makes the numbers false. It makes them non-representative, and non-representative data is the raw material of every bubble I have audited. When I modeled Terra's peg maintenance logic in 2022, the mechanism itself was elegant. The problem was that the assumptions embedded in the mechanism had never been stress-tested against a correlated exit. The published numbers were internally consistent and externally catastrophic.
Agentic commerce is at the same stage of its life cycle that algorithmic stablecoins were in late 2021. The demo works. The assumptions have not been priced.
Core: The Fifty-Dollar Line Is a Fee Market, Not a Preference
The most useful number in the entire dataset is the fifty-dollar threshold, and it is routinely misread as a consumer sentiment finding. It is not. It is a price signal emitted by an implicit risk model running in the buyer's head.
Think about what an agent transaction actually requires from the principal. The buyer must delegate: budget, identity, payment credentials, and the authority to commit. Every delegation is a transfer of control, and control has a price. That price is the expected loss from agent error, multiplied by the probability of agent error, multiplied by the probability that the loss is not recoverable.
Below fifty dollars, the expected loss is small enough that the delegation cost rounds to zero, so the buyer delegates freely. Above fifty dollars, the recovery probability collapses — because there is no dispute mechanism for agent-executed purchases that a consumer can name, no chargeback path they trust, and no named counterparty to hold responsible. The buyer stops delegating not because the machine is bad at picking but because the machine is opaque at failing.
That is a settlement architecture problem. It is the same class of problem I spent three months on at 0x, in a different costume.
In an order-routing system, a fill is only trustworthy if the counterparty can verify what happened and unwind it if the routing logic misbehaved. The v2 contracts I audited had a reentrancy exposure in the fill path that would have let a malicious taker re-enter and settle at a stale price. Nobody cared, because the market was busy being excited. The fix was not better routing. The fix was a stricter state model.
Agent commerce has no state model. Consider what a completed agent purchase looks like on the evidence layer. A card-network-mediated flow produces an authorization record, a clearing record, and a settlement record, all proprietary, none of them expressible as a verifiable claim that a third party can independently check. A consumer who wants to prove that the agent bought at the wrong price, or from an unapproved merchant, or outside the mandate, has no portable artifact to point at.
Fourteen percent trust is exactly what you would expect from that architecture. Trust is not a feeling consumers need to develop. It is a receipt they need to be able to produce.
This is where the crypto-native framing becomes genuinely useful, and where I part company with most of the commentary. The interesting question is not whether agents will shop for people. They will. The interesting question is where the authorization artifact lives, and whether it is verifiable by someone other than the party that issued it.
A properly constructed agent mandate is a signed, scoped, expiring capability. It names a principal, a spending ceiling, a merchant allowlist, a category boundary, and a revocation path. It produces a signed receipt at execution. Both artifacts are verifiable by a stranger. That is a design that has existed in the Ethereum ecosystem for years under various names, and it is now being reinvented inside walled gardens where the issuer and the verifier are the same legal entity.
Code speaks louder than promises, and a mandate that only the issuer can read is not a mandate — it is a terms-of-service document.
Core: What Agent Wallets Actually Look Like On-Chain
If agentic commerce were real at scale, it would leave a forensic signature. I have been looking for it.
When I ran clustering on NFT trading volume in 2021, the bot signature was unmistakable once you stopped looking at aggregate volume and started looking at inter-arrival times. Human wallets show circadian structure: gaps that correlate with sleep, transaction bursts around waking hours in the wallet's dominant timezone, gas price bids that drift with attention. Bot clusters show fixed inter-arrival distributions, deterministic gas bidding, contiguous nonce sequences with no idle gaps, and — the tell — repeated calldata fingerprints across wallets that never touch the same counterparty twice.
The agent wallets that exist today carry the same signature. What they do not carry is volume. Where I find agentic behavior in current on-chain data, it is concentrated in three narrow corridors: testnet and low-value mainnet experimentation, incentive-farming activity that smells like airdrop positioning rather than commerce, and a thin band of production usage inside a handful of stablecoin-denominated flows.
Three percent of transactions is consistent with what the ledger shows. The pilot population is real. The production population is a few thousand wallets, most of them operated by people who work in the industry.
There is a second forensic observation worth making, and it is the one that should worry anyone building governance infrastructure. Agent wallets break the one-human-one-wallet assumption that most token distributions, sybil-resistance schemes, and DAO voting systems are built on.
A single principal can operate an unbounded number of agents. Agents can be rented, delegated, re-delegated, and composed. An agent that holds a governance token and votes is a legal and technical problem with no current answer. Is the vote the principal's or the agent's? If the agent's behavior is determined by a model checkpoint that its operator can swap without notice, is the delegation even meaningful? If ten thousand agents are spun up by one operator to farm a distribution designed for ten thousand people, the distribution is simply transferred.
I audited the custody multi-signature architecture for several asset managers after the 2024 ETF approvals. The finding that went into the confidential report was not that the key management was broken. It was that the key management was centralized in ways the disclosure documents did not describe, and that the operational assumption of "multiple independent signers" degraded to "multiple hardware tokens held by people in the same building." Agent wallets are the same failure mode at a different layer: the architecture diagram says delegation; the reality says one operator with a loop.
Follow the gas, not the narrative. The gas currently being spent on agentic commerce is testnet gas and subsidized gas. That is the honest measure of the sector's maturity, and it is two orders of magnitude away from the forecast.
Core: The Settlement Race Nobody Is Pricing
Here is the part of the story that the payment-industry data cannot see, because the payment industry is not structured to look at it.
Agent-mediated commerce is, at its core, a machine-to-machine payment problem. Machines do not need a card. Machines need a settlement primitive that is programmatically callable, denominated in something stable, final in seconds, and cheap enough that a sub-dollar transaction is economically coherent.
Card rails are not that. Card rails are optimized for a human-initiated authorization with a chargeback layer bolted on top for consumer protection. That chargeback layer is precisely what makes cards expensive, and it is precisely what makes them good for the fifty-dollar-plus segment — the segment where the buyer wants recourse. It is also precisely what makes them structurally wrong for the sub-dollar, high-frequency, machine-initiated segment that agents will dominate.
Stablecoins are that. A dollar-denominated token transferred over a low-fee chain settles in seconds, costs fractions of a cent, and can be authorized programmatically by a signed mandate. No interchange. No chargeback by default. Recourse, if it exists at all, must be constructed separately.
That trade — lower cost, weaker recourse — is the real axis of competition, and it maps almost exactly onto the fifty-dollar threshold. Below the line, cheap and final wins. Above the line, expensive and reversible wins. The market is not undecided. It is bifurcated, and the incumbents are trying to own both sides of the bifurcation before the bifurcation becomes visible.
The crypto-native agent payment protocols are aimed squarely at the sub-fifty segment. The card networks' agent frameworks are aimed at the whole range, with the explicit promise that the card brand supplies the trust. Both are correct about where the volume is. Only one of them is correct about where the trust comes from.
Now the infrastructural consequence, which is the part I have not seen anyone price at all.
Agentic payments are the worst-case traffic profile for a rollup's data availability budget. They are high-frequency, low-value, incompressible, and non-batchable at the envelope layer. A human-initiated transaction can be amortized: wallets batch, exchanges aggregate withdrawals, rollups compress calldata efficiently because human behavior is repetitive. A machine-initiated transaction carries a signed mandate, a receipt, a merchant identifier, and a timestamp, and it happens millions of times a day because that is what machines do.
EIP-4844 introduced a separate blob fee market precisely so that rollup data would stop competing with execution for block space. The design target was three blobs per block, with a maximum of six, and that target was later raised — a parameter, not a promise. A blob fee market that has a target also has a congestion regime, and a congestion regime that is driven by low-value machine traffic is a congestion regime that cannot be optimized away by making blocks bigger.
I have held this position for a while and it has not been popular: blob space is a consumed resource with a fixed supply curve and a demand curve that is about to be attached to machine transaction volume. When that happens, the cost of every rollup transaction gets repriced by traffic that has nothing to do with human users. Every L2 that has been selling sub-cent fees as a structural feature rather than a promotional rate will discover the difference.
The twenty-seventh percentile of teenage adoption and the three-hundred-million forecast are the demand story. The blob fee curve is the supply story. Logic outlives the hype cycle, and the fee curve always outlives the roadmap.
Core: The Liability Vacuum, and Why Entities Without Legal Status Are a Design Flaw
The unanswered question in every agentic commerce document I have read is the same one, and it is not a technical question.
When an agent executes outside its mandate — buys the wrong item, buys from an unapproved merchant, buys at a manipulated price, or buys a counterfeit — who is liable?
The agent is not. Agents have no legal personality. The model provider will point to its terms of service, which almost certainly disclaim output accuracy. The merchant will point to a valid authorization. The payment rail will point to a valid mandate. The principal will point out that they delegated authority to a system that failed, and that they had no way to verify the failure in advance.
That is not a gap in the market. That is an unallocated loss, and unallocated losses do not disappear. They get priced as distrust, which is exactly the fourteen percent.
This is a problem I have watched the DAO ecosystem refuse to solve for eight years. Most DAOs have the legal status of nothing. They are not corporations, not partnerships, not LLCs in most jurisdictions, and not anything a court can serve. That works beautifully until there is a loss. Then the members discover that the default legal treatment of an unincorporated association is not limited liability — it is joint and several exposure, allocated by a judge who has never read a governance forum.
Agent operators are about to walk into the same trap from the other direction. The first wave of agent-based commerce businesses will be structured as token-holding collectives or unincorporated DAOs, because that is the cheapest and fastest structure available, and because the industry has normalized it. The first significant loss event involving an agent that mis-executed at scale will produce a defendant search. The entity will not be findable. The contributors will be.
The technically correct fix is unglamorous and therefore unpopular: a legal wrapper with real capital behind it, a documented mandate schema with explicit scope limits, a signed receipt at every execution, and a dispute process with a named decision-maker. That is not a decentralized architecture. It is an accountable one. Those are frequently the same thing, and the industry's refusal to admit it is why every trust metric in this sector underperforms.
Trust is verified, not given, and verification requires someone whose name is on the liability.
Core: Regulation by Enforcement, Deliberately Withheld
The regulatory layer is where this gets interesting, because the ambiguity here looks accidental and is not.
Agent-initiated payments sit at the intersection of three regimes that do not talk to each other: money transmission, consumer protection, and automated decision-making. An agent that holds a balance and executes payments may be performing money transmission. An agent that makes purchase decisions on behalf of a consumer may be engaging in activity that consumer protection law has opinions about. An agent that processes personal data to model preferences falls under data protection rules, and in the European Union, an agent making economic decisions on a consumer's behalf is a plausible candidate for high-risk classification under the AI Act, which carries transparency and human-oversight obligations that most current agent designs do not satisfy.
In the United States, there is no federal framework that names agentic commerce at all. There is a securities regulator that has spent a decade building doctrine through settlement orders rather than rulemaking. There is a competition authority that has begun to look at algorithmic pricing without defining what an unlawful algorithmic decision looks like. There is a consumer financial protection body whose jurisdictional reach over software agents is untested.
The charitable reading is that regulators are waiting for the technology to mature before writing rules. That reading does not survive contact with the timeline. The same regulator has issued enforcement actions against token issuance, exchange operation, and staking-as-a-service with no prior rulemaking, while publicly declining to publish a compliance pathway that a reasonable operator could follow. The ambiguity is the instrument. It produces a regime where the cost of legal uncertainty is borne by the builder and the discretion is retained by the agency.
For agentic commerce, that means the first mover advantage belongs to the incumbents, who have compliance departments, lobbying budgets, and the ability to absorb an enforcement action as a cost of business. Independent agent operators do not. The effect is not to slow the sector down. It is to concentrate it, in exactly the entities that the crypto-native version of this technology was supposed to route around.
Regulation-by-enforcement is not confusion about the technology. It is a deliberate refusal to publish the rule, because an unpublished rule is a discretionary rule, and discretion is a policy.
Contrarian: What the Bulls Actually Got Right
I have spent most of this piece dismantling the forecast. The steelman deserves equal treatment, because there are three claims in the bull case that hold up under scrutiny, and one of them is more important than anything I have written above.
The first is cohort timing. The twenty-seven percent versus sixteen percent gap is real, and its most likely explanation is not that teenagers are technically sophisticated. It is that teenagers have no legacy payment habits to unlearn, no chargeback expectations, no accumulated suspicion of automation, and no mental model in which a card number typed into a web form is the natural way to buy something. That cohort ages into purchasing power. A behavioral gap that is generated by age rather than by circumstance closes on a schedule.
The second is that the fifty-dollar threshold is an insurance problem, and insurance problems are solvable. I called it a settlement architecture problem and I stand by that, but the two framings are the same statement. Where a market can price risk, it will supply the coverage. The likely forms are obvious: escrowed settlement with a dispute window on higher-value agent purchases, a bonded merchant registry where a merchant posts collateral against misdescribed goods, and mandate-level insurance priced by category. None of these are technically exotic. All of them are commercially unbuilt. That is a market opportunity, not a permanent condition, and I would be wrong to describe it as a wall.
The third claim, and the one that deserves more respect than it gets, is that the card networks are correct about the fundamentals. Trust genuinely is the product. Authorization genuinely is the bottleneck. Whoever solves verifiable authorization — a mandate that a third party can check, a receipt that a consumer can produce, a liability that has a name attached — captures the economics of every agent transaction that follows. The networks have diagnosed the problem correctly. Where they are exposed is that the diagnosis does not imply they own the solution. A verifiable mandate does not require a card brand to verify it. That is the whole point of verifiability.
So the honest bullish case is this: the three hundred million is directionally plausible, the cohort effect is real, the trust gap is a priced risk rather than a structural impossibility, and the winner will be whoever makes authorization auditable rather than whoever makes recommendation accurate. The bearish case is about timing and capture, not about whether agents will transact.
I will take the middle position, which is less satisfying and more defensible. The volume will come. It will arrive three to five years later than the forecast implies, it will be concentrated at the bottom of the price curve for longer than anyone models, and the entity that captures the margin will be the one holding the dispute mechanism, not the one holding the model weights.
Takeaway: Who Signs for the Fill
Every failure I have forensically reconstructed followed the same sequence. A mechanism was described in terms of what it would do. It was validated against scenarios its designers chose. It shipped. The scenario its designers had not modeled arrived, and the loss was allocated by whoever happened to be standing closest to the ledger.
The agentic commerce cycle is at the third step. The mechanism is described. The pilots are running. The forecast is published by parties with a direct interest in the transaction volume it predicts. The scenario that has not been modeled is a mass mis-execution event at scale, and the people who will absorb that loss have not been identified yet, because identifying them would slow the pilot down.
So the question worth asking is not whether three hundred million people will delegate shopping to an AI agent by 2030. It is this: when the agent fills the order and the order is wrong, whose signature is on the authorization, whose name is on the receipt, and whose balance absorbs the difference?
Until that question has an answer that a stranger can verify, the three percent is the honest number, and the three hundred million is a marketing artifact with a payment processor's logo in the corner.