When AI Agents Need Passports
A human shopper rarely has to prove who they are before entering a store. An AI shopper is heading in the opposite direction.
This week, three of the world's largest payment ecosystems began working toward common rules for identifying AI agents. India is developing a registry for agents using UPI. Meanwhile, personal agents are gaining the ability to move across apps, access accounts and make purchases.
A new problem appears when these developments meet: an agent cannot introduce itself from scratch every time it enters a new commercial system.
Commerce needs a way to know which agent has arrived, who operates it, what authority it carries and whether it has behaved safely elsewhere.
The next layer of agentic commerce is therefore not another payment method. It is a portable trust system for machines.
AI agents are beginning to need something remarkably similar to a passport.
Visa, Mastercard and Ant Are Trying to Make Agent Trust Travel
On 10 September, Ant International, Mastercard and Visa announced work on an interoperable Know-Your-Agent, or KYA, framework.
Each already has its own approach to agentic payments. The new work is different. The goal is to let payment networks, wallets, agent platforms and marketplaces recognise common trust signals instead of independently verifying the same agent each time. The framework includes linking an agent to a validated operator, shared security and behavioural requirements, and continuous monitoring.
That changes agent identity from a local check into something that could travel.
Imagine an AI travel agent buying a flight through one payment network, a hotel through a digital wallet and airport transport through another merchant. If every participant must establish the agent's identity and operator from zero, autonomous commerce creates repeated friction precisely where it is supposed to remove it.
A shared trust layer could let each system recognise that the agent has already passed defined checks while still making its own transaction decision.
The important word here is not identity. It is interoperability.
Commerce already knows how to identify software inside individual systems. The harder problem is making that trust useful when the software crosses them.
Mental Model — Machine Passport: A passport does not force every country to make the same entry decision. It provides recognised identity information so each country does not have to establish who you are from scratch.
Break: An agent identity that works inside only one platform becomes less useful as agents begin shopping across many of them.
Source: KYA Interoperability Framework
India Is Treating AI Agents as Participants in the Payment Network
India is approaching the same problem from the infrastructure side.
On 10 September, Reuters reported that the National Payments Corporation of India is developing a registry to verify and monitor AI agents making transactions through UPI. The registry is expected to form part of NPCI's planned Unified Agentic Protocol and could later extend beyond UPI to other payment methods.
That is a subtle but important shift.
Payment networks traditionally recognise banks, merchants, payment apps and customers. An agent introduces another actor into the transaction. The system needs to distinguish an authorised agent from unknown software claiming to act for someone.
Consider a household agent instructed to pay the electricity bill every month and reorder groceries below a certain amount. The user's bank account may be legitimate. The merchant may be legitimate. The payment itself may look ordinary. The missing question is whether the software initiating it is recognised as an approved actor.
A registry gives the network somewhere to answer that question.
This is larger than authentication at checkout. Once agents are registered, payment systems can potentially attach monitoring, rules and accountability to the agent itself rather than treating every machine-initiated payment as an isolated event.
Mental Model — Agent as Network Participant: The agent stops being invisible software sitting behind the customer. The payment system begins recognising it as a distinct participant with its own identity and history.
Break: Knowing the customer is no longer sufficient when software can independently initiate the customer's transactions.
Source: India's AI Agent Registry Report
Meta Shows Why Agent Identity Cannot Stop at Payments
On 8 September, Meta launched Muse, a personal agent designed to work across websites and connected apps. Muse can browse, fill forms, book travel and make purchases. It runs inside a dedicated virtual machine and stores connected credentials separately so the agent can use them without seeing them directly.
The commercial implication sits in the breadth of that access.
A shopping agent confined to one retailer is relatively easy to understand. A personal agent can move between email, calendar, merchant websites, payment services and other applications while carrying context about the person it represents.
Muse also uses a separate Sentinel agent to approve outbound actions, asks the user before sensitive actions such as purchases and provides an audit trail. Its checkout integration with Link uses a one-time card rather than exposing the user's real card details.
Imagine asking an agent to organise a birthday dinner. It may read the calendar, remember dietary preferences, find a restaurant, coordinate invitations and make a booking. Commercial authority is now travelling through several systems during one task.
Each business sees only one part of the journey.
That makes portable trust more valuable. Merchants increasingly need to understand not simply which user account is present, but which software is acting, what permission it received and whether that action belongs to a legitimate chain of delegation.
Mental Model — Delegated Presence: The agent becomes a digital representative that carries a person's authority into places the person never directly visits.
Break: Customer identity and agent identity become different things once software can act across services without the customer being present.
Source: Introducing Muse
Mastercard Is Giving Merchants a Door for Outside Agents
On 9 September, Mastercard announced Agent Connect alongside an expansion of its Agent Suite for Merchants. The aim is to help merchants build their own agent experiences while also connecting with external AI agents and supporting trusted transactions.
That second part deserves attention.
Most businesses have approached AI commerce from inside their own walls: build a chatbot, improve search, add recommendations. Agentic commerce reverses the direction. Software controlled by somebody else may arrive at the merchant and ask to discover products, research options or transact.
Think about a fitness-equipment retailer. Its website may eventually receive purchasing requests from several consumer agents, bank assistants or AI platforms. The retailer cannot build a separate trust relationship with every new agent ecosystem indefinitely.
It needs a controlled entrance.
That is why connection infrastructure matters. The merchant has to recognise trusted participants while preserving its own product rules, customer relationship and transaction controls.
This resembles what payment gateways did for payment methods. Merchants did not want bespoke integrations with every financial institution. A common connection layer reduced the complexity.
Agent commerce is beginning to create the same requirement one level earlier: a standard door through which machine customers can enter.
Mental Model — Agent Gateway: The merchant does not need to know every agent personally. It needs an entrance that can recognise acceptable agents and enforce the merchant's rules.
Break: A merchant cannot scale agentic commerce by building a separate relationship with every AI that wants to shop there.
Source: Mastercard Agent Connect announcement
The System That Is Emerging
A portable machine trust layer is starting to form between AI agents and commerce networks.
This is different from the identity layer OZ Signals tracked earlier. That layer asked whether an agent could prove who it represented and whether it had authority to act. The new problem begins after those systems exist: can that trust survive when the agent moves somewhere else?
The distinction matters because agents are becoming cross-platform actors.
A personal agent may start in a messaging app, retrieve information from another service, enter a merchant environment and finish through a payment network. Every organisation still needs its own risk decision. But requiring every organisation to independently establish the agent's identity, operator, permissions and behaviour creates a verification tax on every transaction.
KYA interoperability, agent registries and merchant connection layers point toward a different architecture.
An agent could increasingly arrive carrying recognisable signals: who operates it, who delegated authority, what standards it meets, whether its certification remains valid and perhaps how it has behaved across previous interactions. The receiving system can then decide whether to trust the agent for that specific action.
Power shifts toward organisations that control these trust signals and the networks that recognise them.
For leaders, agent readiness therefore has another dimension. It is no longer enough to expose products to machines or accept agent payments. Businesses need a policy for which machines they are prepared to do business with and what evidence those machines must present.
The internet made websites universally reachable before it made every website trustworthy.
Agentic commerce is now confronting the same distinction.
Core Truth
AI commerce scales when an agent can carry trust across the market instead of rebuilding it at every transaction.
