In March 2026, OpenAI quietly switched off its in-chat checkout across a dozen Shopify storefronts. The numbers behind that decision were brutal in their clarity: sales processed through the conversational flow hovered near zero. Not low — near zero. Within weeks, the feature had been reduced to a redirect that dumped shoppers back into a conventional app interface, the very place the whole experiment had promised to liberate them from.
I have watched a lot of infrastructure launches die this way. Usually the cause is friction, latency, or a broken incentive. This time it was none of those. The checkout worked. The tokenization worked. What failed was something far more uncomfortable to name out loud: nobody had decided who would pay when the agent bought the wrong thing. That silence is the subject of this piece. It is not a bug in the roadmap. It is a choice, made in parallel, by almost every serious player in the field.
Agentic Commerce — the idea that autonomous AI agents will shop, negotiate, pay, and settle on behalf of consumers — has become the defining commercial narrative of 2026. The architecture that has emerged to support it is remarkably consistent across players, and remarkably incomplete.
Meta and Sierra are pushing the Personal Agent Protocol (PAP), a specification for identifying, verifying, and bounding what a personal AI agent is allowed to do on a merchant's site. Anthropic has published a Commerce Agent blueprint for Claude, deliberately conservative — the model never touches a checkout terminal or a card number. Google has floated a Universal Commerce Protocol built around the same identity-intent-signal triad. Visa's Trusted Agent Protocol (TAP) sends merchants a simple signal: an agent is initiating this transaction. Stripe, working with OpenAI, shipped the only payment-layer protocol that actually went live at scale.
Notice the pattern. Every one of these frameworks positions itself at the layer of identity, intent, or signaling. Every one of them defers the settlement layer. This is what the title means — Identity First, Money Later. It sounds like sequencing discipline. In practice, it is a strategic retreat dressed as a roadmap.
I spent the 2020 DeFi Summer as a product manager watching liquidity providers panic over impermanent loss. The lesson I took from that year was simple: adoption stalls at the point of unquantified risk, not at the point of technical difficulty. Agentic Commerce is now living that same lesson, one layer up, with far higher stakes.
Let me lay out the three layers that actually govern agent commerce, because the industry keeps collapsing them into one and then wondering why the structure wobbles.
The identity layer answers: who is this agent, and what is it authorized to do? This is where PAP, TAP, UCP, and Anthropic's blueprint all compete. Technically, it is a fairly mature extension of OAuth and SSO patterns — delegated authorization, scoped permissions, enterprise visibility. Hard problems exist, but they are known problems with known solution shapes.
The payment layer answers: how does the transaction settle? Here only Stripe and OpenAI have real deployment, and even their design betrays the underlying anxiety. The Shared Payment Token constrains authorization to a specific merchant and a specific cart total. It never shares the raw card number. That is elegant engineering — and it is also a liability boundary. The token limits the blast radius of an agent error by limiting what the agent was ever permitted to do.
The liability layer answers the only question merchants actually care about: if the agent buys wrong, who eats the loss? On this question, the entire field is silent. Not ambiguous — silent. And that silence is not accidental.
Here is the data that should anchor every conversation in this sector. In merchant surveys, 93% say AI providers should bear the financial loss when an agent makes a purchasing error. Yet only 28% of those same merchants are willing to open their full product line to agents. Read those two numbers together and you see the actual market: a trust deficit so wide that merchants are actively choosing to shrink their own addressable sales in order to avoid uninsured risk. They are paying for safety with revenue. That is not a rounding error in sentiment. It is a pricing signal for the entire category.
I have seen this dynamic before, and it is rarely temporary. When I mediated between Compound's core contributors and its community during the 2022 governance crisis, the fracture was never about code quality. It was about who was accountable when the mechanism misbehaved. Resilience beats hype every time — and resilience is built on answered accountability questions, not on clever architecture.
So why does every player rationally stop at the identity layer? Because the identity layer is cheap and the liability layer is expensive. Identity protocols cost engineering cycles. Liability layers cost money — real money, paid out when agents err. A protocol that authenticates an agent and then washes its hands of the outcome captures the upside of the narrative while externalizing every downside. That is not a technology decision. It is a rational avoidance of cost, and it is being repeated in parallel by Meta, Google, Visa, Anthropic, and Stripe simultaneously.
This is where my Web3 instincts sharpen. I audited early ERC-20 token distribution logic for a community-governed wallet called Ethos back in 2017, and the vulnerability I found was structurally identical to the one here: the system was technically sound but economically misaligned, quietly favoring those who bore no risk. Fixing it required not new code but a reallocation of who was exposed to what. The same reallocation is now the missing piece of Agentic Commerce.
The Web3 toolkit maps onto this gap with uncomfortable precision. Decentralized identifiers and verifiable credentials can prove agent identity without a central gatekeeper. Smart contract escrow can hold funds until an outcome is verified. Insurance pools can price the risk of agent error and pay out when it materializes. Oracle-fed audit logs can create a tamper-evident record of what the agent actually did. Identity, authorization, and liability can live on the same programmable ledger — which is exactly the integration that no centralized protocol is structurally willing to build, because building it means volunteering to be the party that pays.
The contrast is stark. Centralized protocols can promise authentication but cannot credibly promise accountability, because accountability requires a shared loss-bearing mechanism, and a single corporate entity will not voluntarily absorb open-ended agent error. A community-owned insurance pool can. Community is the new central bank — not as a slogan, but as a mechanism for mutualizing risk that no single firm will carry alone.
None of this is to say the Web3 path is easy. The escrow has to be fast enough not to kill conversion. The insurance pool has to be capitalized before it is credible. The audit logs have to be meaningful without being invasive. But these are engineering problems with known shapes. The problem the centralized players are avoiding is not engineering at all — it is a willingness to be the tort-bearer, the party who answers for the machine.
Let me be precise about what the OpenAI failure actually demonstrated, because it is easy to misread. OpenAI did not fail because agents could not complete a purchase. It failed because merchants and consumers could not agree on what happens when a purchase goes wrong. The checkout was the visible surface; the invisible substrate was a dispute that had never been resolved. When you remove the liability resolution, you remove the merchant's incentive to participate, and when you remove merchant participation, the agent has nothing to buy. The near-zero sales were not a demand problem. They were a governance problem wearing a payments costume.
I want to test the industry's own framing here, because there is a version of this story in which the liability gap is described as a "phase." Identity first, money later — implying money eventually. But phases require a transition mechanism, and I see none. PAP has not even reached v0.1. Its payment extension is described in language so vague it could mean anything. Anthropic's blueprint explicitly keeps the model away from the money. Visa's TAP is careful to signal intent without redistributing responsibility for non-fraudulent error. Every design choice points the same direction: the liability layer is not being deferred. It is being avoided.
And avoidance, at scale, compounds into structure. When every incumbent chooses the same cheap layer, the expensive layer does not merely remain empty — it becomes the most contested strategic ground in the market, because whoever claims it first captures both merchant trust and consumer access simultaneously. The gap is not a hole in the floor. It is the doorway nobody has walked through.
There is a further subtlety that the optimistic coverage misses. The Shared Payment Token's constraint — limited to one merchant and one cart total — looks like a security feature. It is also a responsibility firewall. By narrowing what the agent was ever authorized to do, the protocol narrows the surface on which liability can even be claimed. If the agent did exactly what it was scoped to do, who is at fault when the outcome is still wrong? The token answers the technical question and quietly buries the commercial one. Payment integration, it turns out, is not payment accountability.
This is why I keep returning to the identity-payment-liability triad. The industry treats it as a sequence to be executed in order. It is actually a set of load-bearing walls. You can build the first two beautifully, but if the third is missing, the structure does not stand under any real weight — and real weight arrives the first time an agent buys the wrong thing and someone has to be told it is their loss.
Now let me challenge my own conclusion, because the pragmatist in me insists on it.
The counter-argument is that liability gaps close through regulation, not through voluntary protocol design. There is real force to this. The 93% merchant figure is exactly the kind of industry consensus signal that regulators cite when drafting rules. If consumer protection frameworks like Reg E or PSD2 get extended to define the AI provider as the operator in a consumer transaction, the liability layer gets filled in from the outside — by law, not by code. In that world, the Web3 escrow-and-insurance pitch is redundant, because the state becomes the insurer of last resort.
I think this is partially right and strategically misleading. Regulation can assign liability, but it cannot make liability cheap, fast, or programmable. A rule that says "the AI provider pays" does not tell you how the payment happens, how disputes are adjudicated in milliseconds, or how a global merchant and a local consumer resolve a disagreement across jurisdictions. Trust, verify. But also, connect — and regulation connects nothing. It draws a line and lets the parties litigate across it. The Web3 opportunity is not to replace the regulator's line. It is to build the settlement rails that make the line enforceable at machine speed, which is the only speed at which agent commerce can actually scale.
The other blind spot in the optimistic camp is the assumption that the identity layer has independent value that survives the liability gap. It does — but only in narrow B2B contexts. Note who is quietly joining PAP: Genesys, NICE, Decagon, Instinct. These are customer-service and CRM platforms. Their interest in agent identity is not about shopping at all. It is about reducing the friction of "who are you and what can you do" in support conversations. That is a real, near-term market. But it is a support-automation market, not a commerce market, and conflating the two is how the sector will talk itself into another disappointment.
So here is the forward-looking question I would put to every builder in this space. The next protocol that launches will, once again, arrive at the identity layer. It will announce partners. It will describe payment extensions as "coming." And then it will face the same silence that greeted OpenAI at the checkout.
The only launch that will matter is the first one that answers, in advance and in code, the question the entire industry is avoiding: when the agent buys wrong, who pays, how fast, and how do we prove it? Code is law, but people are purpose. The protocol that remembers the second half of that sentence will not just capture a market. It will define the terms on which autonomous commerce is allowed to exist at all.
The window is open now. It will not stay open once the incumbents decide the liability layer is finally worth the cost — and by then, the only question left will be whether the rails that carry it were built to be trusted, or merely to be verified.