As of August 2026
Standards can tell an agent how to pay. They can't decide who bears the loss when the agent exceeds its mandate, the merchant misreads it, or the issuer can't prove the human intended the purchase.
Agentic commerce moves when delegated authority becomes enforceable across discovery, payment, acceptance, and dispute operations.
Foundation
40
member organizations joined the operational x402 Foundation launch in July 2026.
Protocol
HTTP 402
a machine can receive payment requirements and satisfy them as part of a request flow.
Missing agreement
Liability
issuers, merchants, and dispute operators still need one enforceable authority model.
The protocol layer is converging
The x402 Foundation joined card networks, processors, cloud providers, commerce platforms, and crypto firms around an internet-native payment protocol. Google AP2 described signed mandates for agent transactions. Network programs added agent identity and credential controls. These efforts give builders common objects for price, intent, credentials, and payment evidence.
Production acceptance needs a shared promise
A merchant must know what the agent was allowed to buy. An issuer must know which credential and mandate supported the charge. A dispute operator must decide whether the agent, merchant, or issuer violated that mandate. Until those parties accept the same evidence and liability rules, a technically valid protocol message is not a dependable purchase.
Discovery and protocol can scale independently. Commerce completes only when authority and liability cross every boundary.
The cold start is institutional
Merchants hesitate to build acceptance for credentials that issuers may decline or dispute. Issuers hesitate to approve agent credentials when disputed-loss allocation is unclear. Open protocols cannot solve that coordination problem by themselves. Existing card programs have an advantage because authorization, credentialing, chargebacks, merchant rules, and network arbitration already meet inside one operating system.
That doesn’t make open protocols irrelevant. They can become the shared message layer underneath multiple rails. The deployment path starts with bounded use cases where the mandate is easy to express and the value is low enough to price the risk. API calls and machine services fit that profile. Retail baskets, travel changes, substitutions, and returns need a richer evidence and dispute model.
The protocol says how money moves. The mandate says whether it was allowed. The liability rule decides whether anyone will accept it.
