Key Takeaways
- Mastercard's digital lead Sherri Haymond argues the hard part of agentic commerce is not the shopping but the authentication and trust layer behind the payment. The moment you delegate spend to an agent, a gap opens up over who reads the terms and who keeps the transaction safe
- Mastercard's answer is not to bolt on new trust but to port the trust of its existing card network onto agents through Agentic Tokens and Verifiable Intent. A merchant that already accepts Mastercard accepts agent transactions by default
- Visa and Stripe are attacking the same problem from different entry points, and what decides the winner is authentication, consent and standards more than the shopping experience. For merchants, the question becomes how to be sellable to agents and which payment rails to bet on
The Claim That the Hard Part Is the Payment, Not the Shopping
Mastercard's Sherri Haymond tells PYMNTS CEO Karen Webster why the hard part of agentic commerce isn't the shopping.
www.pymnts.comIn a Monday Conversation with PYMNTS CEO Karen Webster, Mastercard's global head of digital commercialization, Sherri Haymond, flipped a common assumption. Having an AI agent find a product, weigh options and pull the trigger is no longer the difficult part. The genuinely hard part is the authentication and trust machinery that runs behind the payment.
This framing sits on top of a question Mastercard has answered for almost sixty years. How do you get two parties who have never met to trust each other enough to do business? The answer was a card, a network and a rulebook everyone agreed to follow. Now a new party is pulling up to the table, and it is not human. It is an agent acting on someone's behalf, ready to shop and pay with nobody watching. Whether machines will transact is no longer the question, because they already do. The question has moved to who builds the trust that makes it safe, and who wins when the buyer is an algorithm.
Mastercard has pressed this point with Agent Pay and its newest extension, Agent Pay for Machines, built for transactions one piece of software executes on behalf of another. Consumers clearly want to type their intent into a prompt and have a transaction execute. The catch is that the plumbing to do that safely and at scale is the part nobody sees and everybody needs.
The Blank-Check Problem That Opens at Delegation
This is where it gets interesting and where the risk lives. When a consumer delegates spend to an agent, nobody is left reading the fine print. Haymond described the gap directly.
When you're delegating spend authority to an agent, you're not the one going to the website or the app yourself, to read the terms of sale, the product descriptions, to see if something's final sale, when it's going to be delivered. All of that has to get filled in somehow.Source: Sherri Haymond (Mastercard EVP)
That gap, she says, is the whole game. It is the industry's biggest opening and its biggest exposure at the same time. Consumers already trust software to recommend a product. Trusting software to spend the money is a different thing altogether. If people do not trust that the system will work as intended, they simply will not use it, and the most important ingredient turns out to be trust.
What stands out is that Mastercard does not treat trust as something you bolt on later. Agent Pay runs on top of the tokenization, credential management and digital payments infrastructure the company spent two decades building. Trust is not an add-on part. It is something you have already earned, or you have not. That conviction sits at the root of the design choices below.
The Two Pillars: Agentic Tokens and Verifiable Intent
So how is that trust implemented as technology? According to Mastercard's own materials, Agent Pay rests on two pillars.
The first is the Agentic Token. It extends Mastercard's tokenization service (MDES), binding a tokenized card credential to a specific agent, a specific merchant scope and a specific consent policy. A model like ChatGPT or Microsoft Copilot can complete a checkout without ever holding the raw card number. The user enrolls an agent through their issuing bank's app, the bank requests an Agentic Token, the agent presents that token at checkout, and Mastercard's network checks the token's session, limit and merchant scope before authorizing. The merchant just receives the token, and the network de-tokenizes it back to the underlying card.
The second pillar is Verifiable Intent, a framework that ties identity, instruction and outcome into a record you can check after the fact. It was introduced earlier in 2026. The important move comes next. Rather than keeping the framework as a moat, Mastercard handed it to the FIDO Alliance for the whole industry to use. FIDO is focusing on verifiable user instructions, agent authentication and trusted delegation for commerce, working alongside Google's AP2. The pieces that are foundational and not worth competing on get standardized, and everyone competes above that line. Haymond's repeated emphasis on standardization points to exactly this stance.
The rollout has substance behind it too. Agent Pay launched in April 2025 with Microsoft, IBM and Braintree as launch partners. Citi and US Bank cardholders entered the pilot in September 2025, and the rollout completed across all US Mastercard cardholders in November 2025.
Where Visa and Stripe Differ
Mastercard is not the only one working this problem. The day after Agent Pay launched, Visa announced Intelligent Commerce, and the two networks staked their claims within about a day of each other. They agree on the diagnosis: AI agents need a credentialed way to transact on a cardholder's behalf. Where they diverge is in how identity, tokenization and merchant trust get wired.
The most practical difference shows up in the merchant lift. Because Mastercard runs Agent Pay on the card rails it already owns, a merchant that already accepts Mastercard accepts agent transactions by default. Visa instead leans on a Trusted Agent Protocol that defines how agents identify themselves to merchants, introducing a new acceptance surface and richer agent metadata. Stripe takes a developer route, using issuing APIs and programmable cards and controls so teams can ship agentic payments more easily. Laying the three side by side sharpens the contrast.
| Mastercard Agent Pay | Visa Intelligent Commerce | Stripe (Agentic Commerce) | |
|---|---|---|---|
| Trust anchor | Agentic Token (extends card tokenization) | Trusted Agent Protocol (agent identity to merchants) | Issuing APIs with programmable cards and controls |
| Merchant lift | Accepts agent transactions by default if it already accepts Mastercard | New acceptance surface plus richer agent metadata | Integrate via API if already on Stripe |
| Intent and consent | Verifiable Intent (ties identity, instruction, outcome) | User-set spending limits and real-time fraud monitoring | Permissions and limits set at issuance, with tokenization |
| Standards direction | Contributed Verifiable Intent to the FIDO Alliance | Aligning with Google AP2, OpenAI ACP and x402 | API-centric, interoperates with external protocols |
| Primary aim | Port the trust of existing card rails onto agents | Merchant acceptance and simpler integration | Let developers ship agentic payments easily |
It is worth noting that the three are not purely adversarial. Both networks joined Google's AP2 protocol in September 2025, and Visa said it is aligning its Trusted Agent Protocol with OpenAI's Agentic Commerce Protocol and Coinbase's x402 standard. Cooperate on the foundational authentication, consent and standards layer, then differentiate on the services above it. That shape is emerging across the whole industry.
A New Market Where the Buyer Is Software
Agent Pay for Machines pushes the idea past the consumer and into machine-to-machine commerce. The example Haymond walked through lands fast for anyone who has tried to start something. A small business owner is opening a new store and has not created a website or even bought a domain name, let alone a marketing program on Instagram. She asks her favorite AI assistant to put the business online. The agent buys the domain, builds the site, stands up a marketing campaign, compares providers and gets the owner's sign-off. Once the owner says yes, the payments happen in the background at machine speed, drawing on funding sources such as cards, virtual cards, bank balances, lines of credit or stablecoins.
The point is not to remove the owner from the process, at least not at first. The owner stays in control while the agent handles the steps that normally require time, staff and manual coordination. The payment stops being a separate errand and lives inside the work. Haymond called it a move that solves a major problem and opens a tremendous amount of opportunity, a whole new category. Work that used to take months, people and real money, the kind of thing that priced out the smallest players, just got cheap and becomes a platform for innovation.
The larger opportunity Mastercard sees is not simply making today's payments faster. It is opening a market where agents become buyers and customers in their own right. As businesses use agents to find services, compare options and complete tasks, many of those actions end in a payment. That creates a new class of machine-to-machine transactions and a new set of services around them: the payment itself, the tools that make it safe, and the data services that help agents deliver better results. Haymond pointed to personalization, where anonymized insights help an agent show more relevant options to one buyer than another. Agents become more than assistants. They become a new channel for commerce and a new source of revenue.
What It Means for Your Payments and Your Store
Brought down to the level of a merchant, payments lead or executive, the question narrows to two things.
The first is whether your business is sellable to agents. With discovery moving out of the browser and into the chat window, and buy buttons appearing inside Google and social ads, it matters whether your product data, inventory, pricing and delivery terms are legible to a machine. The gap Haymond described, where nobody is left reading the terms, is also an opening: the merchants that present clear, structured product information are the ones agents are more likely to choose.
The second is which standard to bet your payment acceptance on. We are in a phase of death by a thousand protocols, and Haymond herself expects the industry to move past it over the next eighteen months, to the point where the talk of protocol wars fades. That makes it more rational over time to stand on shared rails such as Agentic Tokens and Verifiable Intent, or the common ground Visa and Stripe are building, rather than holding your own bespoke authentication and trust machinery. Her line that trust cannot be bolted on comes back with equal weight for the businesses delegating payments. Stand on a network that has already accumulated trust, or try to build it from zero. That choice quietly shapes competitiveness in the agentic era.
Conclusion
The heart of the Agent Pay debate is not teaching AI to shop, but teaching it to spend safely. Haymond's argument in one line is that the hard part is the authentication and trust layer behind the payment, not the shopping. Mastercard's answer is not to invent new trust but to port the trust its card network earned over two decades onto agents, through Agentic Tokens and Verifiable Intent. Visa and Stripe are climbing the same mountain from other entry points, cooperating on standards at the foundation and competing above it. As the buyer becomes an algorithm, the question for any business is whether it is ready to be legible to agents and to stand on payment rails that already carry trust.
