The Control Plane for Agentic Commerce
An AI agent can be given permission to spend money. That no longer looks like the difficult part.
The harder problem is what happens after permission is granted. Which merchant records can the agent see? Which account can it touch? Which payment route can it use? Who decides whether a transaction looks legitimate? What happens when an agent moves across systems owned by different companies?
Several releases this week point to the same answer: control is moving deeper into infrastructure.
Commerce systems are starting to treat agents as a new class of participant. Not simply users with automated clicks, but software actors that require their own access boundaries, financial permissions, risk controls and operating rules.
That creates a new layer in AI commerce.
The important question is shifting from whether an agent is authorized to act to how every system it touches enforces that authority.
Marketplace Software Is Starting to Give AI Its Own Access Boundaries
On August 19, Dokan, a multivendor marketplace platform for WooCommerce, added support for the WooCommerce Abilities MCP API. The important part was not MCP itself. Dokan made the integration multivendor-aware: connected AI assistants can access only the products and orders belonging to the relevant vendor.
That small changelog entry exposes a much larger infrastructure problem.
Most commerce software was designed around human roles: administrator, merchant, employee, customer. Agents introduce another operating actor. Giving an AI access to a marketplace cannot mean giving it unrestricted access to the marketplace database.
Consider a marketplace hosting 500 independent sellers. A merchant may want an AI assistant to change product information, check orders or answer inventory questions. The useful version of that assistant needs operational access. The dangerous version can see another seller's orders.
Agent readiness therefore requires more than exposing an API. Existing business boundaries must survive when machines become the interface.
Mental Model — Inherited Boundaries
Automation should inherit the same commercial boundaries as the business it represents. An agent working for one merchant should not become a shortcut around marketplace permissions.
An API being accessible to an AI agent no longer makes it agent-ready.
Source: Dokan v5.0.15 changelog
Payment Intelligence Is Moving From Separate Rules Into One Learning Layer
Razorpay launched Vulcan on August 18, describing it as a foundation model built specifically for payments.
Payment companies already use machine learning extensively. What makes Vulcan more interesting is the architecture.
Razorpay says routing, fraud detection and checkout decisions were historically handled by separate models. Vulcan instead learns across the payment system and is already being used to score possible payment routes, detect network-level fraud and personalize checkout decisions. Razorpay says it processes almost four billion customer-to-merchant payments annually, creating a feedback loop in which transaction activity improves the same intelligence layer making later decisions.
Take a failed payment. Traditional infrastructure may separately ask whether the card is fraudulent, which gateway should process it and which payment option should appear next. A shared model can evaluate those decisions together.
That matters for agentic commerce because machines will generate more transactions without humans manually navigating failures. Payment infrastructure will increasingly need to decide, in real time, not merely whether money canmove, but how it should move safely and successfully.
The intelligence governing commerce is beginning to sit inside the transaction path itself.
Mental Model — Financial Control Plane
A control plane coordinates many underlying systems through one decision layer. Payments are beginning to acquire one that learns across routing, risk and checkout rather than treating each as an isolated task.
Payment infrastructure can no longer assume that transaction intelligence belongs in separate systems.
Source: Razorpay Vulcan announcement
Financial Accounts Are Becoming Interfaces That Agents Can Use Directly
Binance introduced Agent OS on August 20, creating a standardized layer through which compatible AI applications can interact with market data, account information, wallets, payments and supported trading functions.
The more important design choice is how access works.
Users can give an agent defined permissions, place it inside a dedicated subaccount and later revoke its access. Binance says its MCP implementation can let compatible agents view permitted financial information and place supported trades while keeping unrelated personal and KYC information outside the agent's reach.
That is a different model from attaching an AI assistant to a financial website.
The financial account itself is being reorganized so that software can operate inside a restricted section of it.
A company could eventually use similar architecture to give a procurement agent access to one budget, a treasury agent access to another pool of funds and a travel agent access only to approved spending categories. The agent does not need the person's entire financial identity. It needs a bounded financial environment in which it can work.
This is how autonomous finance becomes operational rather than experimental: not by trusting agents with everything, but by designing financial systems around limited machine access from the beginning.
Mental Model — Financial Sandbox
Give the agent enough financial capability to complete its job without giving it the entire account. Autonomy becomes easier to deploy when exposure is structurally limited.
Financial access no longer has to be designed around one human controlling one complete account.
Source: Binance Agent OS announcement
Agentic Payment Rules Are Becoming an Industry Problem
Rain launched the Agentic Payments Alliance on August 18 with more than 25 founding organizations, including Visa, Mastercard, Fiserv, Circle, Remitly, Solana, Fireblocks, Shift4 and Yuno.
The coalition plans to work on areas including agent identity, authorization, emerging standards and regulatory questions. Rain's announcement explicitly identifies unresolved questions around how agents are authorized, how fraud is handled and how existing commercial benefits such as loyalty move through agent-driven transactions.
The important signal is not another industry consortium.
It is why one is becoming necessary.
If every AI platform invents its own definition of authorization, every payment provider builds a different identity model and every merchant creates separate agent controls, autonomous commerce becomes a collection of bilateral integrations.
That does not scale.
A customer agent may eventually cross an AI platform, merchant, wallet, processor, card network and fulfillment provider during one transaction. Each participant needs a compatible understanding of what that agent is permitted to do.
The transaction therefore needs rules that survive organisational boundaries.
Mental Model — Shared Traffic Rules
Cars from different manufacturers can use the same road because the rules are common. Agentic commerce needs equivalent conventions so permissions remain understandable as agents move between commercial systems.
Agent authorization cannot remain a private rule invented independently by every platform.
Source: Agentic Payments Alliance launch
The System That Is Emerging
The Agentic Commercial Control Layer
Issue 22 examined the rise of controlled economic authority: agents receiving budgets, credentials and explicit limits.
Issue 23 reveals what comes next.
A spending limit attached to an agent is useful only if the infrastructure around that agent respects it.
That infrastructure is now appearing at several levels. Marketplace software is restricting which merchant records an AI can reach. Financial platforms are creating isolated accounts and revocable permissions. Payment providers are consolidating routing, fraud and checkout decisions into learning systems. Payment companies are beginning to coordinate common rules for identity and authorization.
Together, these pieces resemble a commercial control plane for AI agents.
The web solved access largely by asking who the user was. Agentic commerce requires a more detailed question: Who is this agent acting for, what is it allowed to access, what is it allowed to do, and under which conditions?
That distinction will matter to every company exposing commercial functions to AI.
The safest businesses will not simply connect their systems to agents and add controls afterwards. Products, orders, accounts, payments and APIs will increasingly need machine-level permissions built into their architecture.
For leaders, the practical exercise is becoming clear: map every capability an agent could touch and decide where authority begins, where it ends and which system enforces the boundary.
That is becoming infrastructure, not policy documentation.
Core Truth
Agentic commerce scales when authority is enforced by the system, not merely trusted to the agent.
