Briefing · Framework
AI agents are learning to find you and pay. What you promise is your call.
Buying through an AI agent takes five steps: find, check, promise, pay, settle. Tech platforms, card networks and payment providers are building most of them in public. The promise in the middle is still yours to write.
Published Updated
The ladder
Five steps from being found to being paid
This is our framework for reading agentic commerce, meaning AI agents buying on a customer’s behalf. The steps run in the order a purchase happens, and each has a different owner.
Found
The agent finds your business and what you offer. AI assistants and shopping platforms own this step; in May 2026 Google announced a Universal Cart and a move into hotel booking and local food delivery.
Checked
The agent checks it can act: is the agent legitimate, are you a real participant, can it use your site. Networks and platforms own this; in June 2026 Visa announced an Agent Score and an Agentic Directory.
Promised
Before money moves, a promise must exist: this deposit can be taken, this slot held, this booking cancelled inside this window, this service delivered at this time. No platform or network writes this for you.
Only the business can write this
Paid
The payment runs: checks, card tokens and the payment method, with you kept as the seller of record. Card networks, payment providers such as Stripe and open checkout standards are building this quickly.
Settled
The money settles and the job closes: delivery, reconciliation, refunds and disputes. That only goes cleanly if the promise at step three was real.
Steps one, two, four and five are being built in public. Step three is the business’s own work, and a clean payment can’t settle a promise nobody made.
Four easy misreads
Being found is not a promise: an agent can add your service to a cart without anyone having decided whether that booking can be made, held or cancelled.
Being checked is not a promise: an agent readiness score or a directory entry shows whether an agent can act, not whether you can keep your word.
Paying is not a promise: a payment rail moves money for a promise that already exists, and settling can’t create one afterwards.
Our read: the companies named here are building the other four steps and leaving step three unaddressed. That is our interpretation of what they have announced, not something any of them has said.
Step three
What a promise an agent can rely on needs
A promise here is not a slogan. It is a set of facts and rules you control, true at the moment the agent asks.
Facts about your services
Services, hours, availability and which locations offer what, clear enough that an agent doesn’t have to guess.
Whether this request fits
Can this party size, time or service actually be accepted at this location right now?
Current, not a snapshot
A promise made on yesterday’s availability is a promise that breaks.
Exactly what is promised
Amount due now and later, any real hold and when it ends, the cancellation window, the guarantee and its limits. A deposit on its own doesn’t prove a hold.
Terms both sides can see
Your no-show, late and deposit rules, shown to the customer and the agent and applied the same way everywhere.
A record you can stand behind
The exact terms and what the customer accepted, kept so refunds and disputes are settled against what you actually wrote.
A public census
Thousands of storefronts declare checkout. Single digits declare paying inside the agent.
Businesses that support the Universal Commerce Protocol, an open standard for agent checkout, publish a small public file (at /.well-known/ucp, much like robots.txt) saying what an agent may do with them. UCP Checker counts those files. On 22 September 2026 at 20:58 UTC it counted 17,765 verified storefronts across 21,900 tracked domains [UCP Checker · 2026-09-22 20:58 UTC]: it watches the larger number of web addresses, and the shares below are of the storefronts it verified.
Share of the 17,765 verified storefronts declaring each part of checkout [UCP Checker · 2026-09-22 20:58 UTC]
Checkout99.6%
Cart management90%
Order management60.3%
At the same reading [UCP Checker · 2026-09-22 20:58 UTC], the count for Payment Token Exchange stood at 8 and for Embedded Checkout at 1. These are the parts that would let the payment happen inside the agent’s journey: handing the shop a secure stand-in for the customer’s card, and showing the shop’s own checkout inside the agent.
The live counter these figures were read from:
How to read these numbers
The census is a live counter that its publisher re-crawls every 24 hours. These figures are what it showed at the stamped moment and at no other; they are not current as you read this.
Since the August census, cart-management declarations have grown by thousands, while payment-token declarations are still in single digits. Across the September readings taken for this update, the Payment Token Exchange and Embedded Checkout counts did not move at all.
Counting a file is not counting a sale. UCP Checker’s own methodology says its optional checks are deliberately read-only and rate-limited, and do not exercise checkout or write any state. A declaration is a business saying what it will accept, not a business having accepted anything.
July and August 2026
The rules for describing a promise got more precise
Four developments describe more of step three. Each has a limit that stops it from proving more than it says.
Shopify · API version 2026-07
A deposit field on draft orders
- The limit
- Shopify Plus draft orders only. Not a universal deposit, reservation or booking standard.
An authorised app can set a deposit on a draft order, and a scoped customer-account integration can read the amount due now and later.
Shopify · changelog
Business rules move to the server
- The limit
- The old hook still works on current and earlier versions; removal is in the future. It doesn’t show any shop has made the switch.
Shopify points developers away from an old checkout hook (useBuyerJourneyIntercept) towards server-side checks that apply across checkout surfaces, including express wallets and agent checkout.
Universal Commerce Protocol · v2026-08-25
More of a sale can be described
- The limit
- Describing a term doesn’t check that it is fresh, accurate, in stock, free or in live use, that the business can offer it, or that it will be delivered. It creates no reservation hold or cancellation guarantee by itself.
The release adds payment terms and schedules, including deposits and instalments, policy snapshots, location and delivery context, and identity and consent changes. It also includes breaking changes.
Google Merchant Center
Tools to test a checkout before it goes live
- The limit
- A limited US pilot for participating merchants and US products, with Google approval as a gate. A validated endpoint is not a completed payment.
Google’s UCP integration lets participating merchants set up, test in sandbox and production environments, validate endpoints and monitor readiness.
Sources dated 14 to 24 September 2026
A draft booking contract and three named routes, each narrower than it sounds
Four official sources, rechecked on 5 October 2026. None of them shows a business making a booking promise through an agent.
UCP · merged 24 September 2026, still a draft
A draft contract for hotel bookings
- The limit
- A draft that may still change in breaking ways. It doesn’t show any hotel has built it or can honour a particular stay.
UCP merged a lodging booking capability and a cancellation-policy extension. Unless an extension called AP2 Mandates is supported, the guest must finalise each booking by hand through a trusted interface.
Tapestry · 16 September 2026, vendor-reported
Coach and Kate Spade in Gemini and Google Search
- The limit
- One named US retail route, not evidence that local-service bookings work.
Tapestry says Coach and Kate Spade products can be bought in the US through the Gemini app and Google Search, including AI Mode, with checkout powered by UCP: one item at a time through Google Pay, each purchase explicitly approved by the shopper.
Worldline · 14 September 2026, announced
A UCP payment handler
- The limit
- A route for taking money. It doesn’t check stock or make a reservation promise.
Worldline announced a UCP payment handler, available with its cross-border Global Collect platform.
GoCardless · 22 September 2026, vendor-reported
An agent sets up a monthly donation in the UK
- The limit
- Taking part in the programme is not an FCA endorsement, and one donation doesn’t mean retail or hotel bookings are rolling out.
GoCardless reported what it calls the first agentic account-to-account payment in the UK, straight from one bank account to another: a recurring donation to Trussell. The donor picks £5, £10 or £15 a month and gives bank details so the agent can set up a Direct Debit on their behalf. It was built within the FCA’s AI Live Testing programme.
Sources checked 1 November 2026
The November reading: 69.1% of valid profiles on the newest release, still no orders shown
We read UCP Checker’s public census again on 1 November 2026. What it counts and how it divides the count changed since September, so each reading here is its own dated snapshot. Don’t subtract one from another.
On 1 November 2026 the census tracked about 25,000 domains [UCP Checker · 2026-11-01 21:13 UTC]. Of the profiles that passed its validator, 69.1% were on the newest UCP release, dated 25 August 2026 [UCP Checker · 2026-11-01 21:13 UTC]. Across those valid profiles, 95.6% declared checkout, 62.5% order management and 61.9% identity linking [UCP Checker · 2026-11-01 21:13 UTC].
The same page lists buyer consent at 64.4% without saying what it is a share of, so we don’t set it beside the figures above [UCP Checker · 2026-11-01 21:13 UTC]. The same block, also without a stated base, shows 0.3% for AP2 mandates and 0% for Embedded Checkout [UCP Checker · 2026-11-01 21:13 UTC]. In our reading, these are the parts that would let an agent act on a signed instruction or pay inside its own conversation.
Not every domain answers. Of the /.well-known/ucp checks, 70.1% were verified, 9% not found, 12.1% unreachable, 3.5% blocked and 5.4% invalid [UCP Checker · 2026-11-01 21:13 UTC].
Our earlier snapshot from 26 October 2026 also tracked about 25,000 domains, with 59.6% on the newest release, 95.1% declaring checkout, 56.3% order management, 55.7% identity linking, 55.9% buyer consent and 0% Embedded Checkout [UCP Checker · 2026-10-26 07:20 UTC]. It stays as it was read, and so does the September reading above.
How to read this: a declaration is a public file saying what a storefront will accept. It is not an order, a transaction or sales volume, and a rising share doesn’t show more people buying through agents. UCP Checker says a valid profile is one its schema validator accepts; its methodology page doesn’t say how the list of domains is built.
The live counter and its method, read on 1 November 2026:
What to do now
Five ways to own step three
None of this needs a new protocol. It starts with your own booking system and policies.
Write your terms down as separate items
Deposit, amount due now and later, cancellation window, no-show and late rules, and any real hold. Never treat a deposit as a hold.
Keep the facts agents read accurate
Hours, availability, services and which location offers what, complete enough to be safe to fulfil, not only easy to find.
Apply the same rules everywhere
Ask your booking or checkout provider to enforce your rules on its own systems, so your website, wallets and agents all get the same terms.
Test what works, not just what is declared
A valid /.well-known/ucp file is not a completed checkout. To see whether your site or booking tool publishes one, open your web address followed by /.well-known/ucp, or ask the provider. Then check the real responses and a real test order separately.
Keep a record of what the customer accepted
Save the terms version, their acknowledgement and the order, so a refund or dispute is settled on what you wrote.
Keep reading
Where the promise meets the payment
The flagship Briefing behind this framework, the latest Signal mapped onto it, and what a business’s own facts and commitments look like in practice.
- Card networks are teaching AI agents to pay. Only you can say what’s for sale.Why the payment side is moving fast while your prices, free slots and terms stay yours to keep right.Read the Briefing
- AI agents are being given tools to find you, fill a cart and payThe recent Signal that maps the new agent tools onto the ladder, and the commitment step still missing.Read the Signal
- Merchant infrastructureThe business facts and commitments AI agents depend on, kept accurate at the source.See how it works
Talk to us about merchant readiness
Write to Obenan Research if you want to compare notes on what your business can promise an AI agent, and keep.
Sources
Where this comes from
Built from public sources only. The ladder is Obenan’s framework, and the gap at step three is our reading of what companies have announced. Census figures are what UCP Checker’s public counter showed at the stamped moment and at no other. Sources added in the September evidence update carry that update’s date, 22 September 2026, as their check date; pages without a publication date show only that date. Obenan doesn’t process payments, settle transactions or own any payment protocol, has no partnership, endorsement, certification, pilot approval, integration or special access with Mastercard, Visa, Adyen, Google, OpenAI, Stripe, American Express, PayPal or any company named here, and no Obenan merchant is certified or committable by any public network or protocol. This is not an Obenan product implementation or customer capability, and no vendor named here controls how an AI agent ranks, recommends or transacts with a business. Nothing here guarantees ranking, recommendation, transaction completion, revenue or platform inclusion.
01Universal Commerce Protocol (GitHub) Checked
Universal Commerce Protocol release v2026-08-25Payment terms and schedules, policy snapshots, location and fulfilment context, identity and consent changes, and breaking changes.
02Shopify Checked
Shopify: draft-order deposit fields for Admin and Customer Account APIsThe deposit field on Shopify Plus draft orders.
03Shopify Checked
Shopify: server-side cart and checkout validation migrationMoving checkout rules to server-side validation; the old hook still works and its removal is in the future.
04Google for Developers Checked
Google Merchant Center: limited UCP pilot and validation toolsThe limited US pilot, its testing and endpoint-validation tools, and Google approval as a gate.
05UCP Checker Checked
UCP Checker: August 2026 point-in-time censusThe August census, whose figures the stamped September reading supersedes.
06UCP Checker Checked
UCP Checker: census methodologyWhat the census counts, and that its optional checks are read-only and don’t exercise checkout.
07Visa Checked
Visa public rulesOne card network’s example of keeping evidence of what a customer agreed to; not a shared Shopify or UCP implementation.
08Universal Commerce Protocol (GitHub) Published Checked
Universal Commerce Protocol release v2026-04-08Versioned contracts for cart state, catalogue, eligibility, signing and totals, behind the checking and promise steps.
09Universal Commerce Protocol Checked
Universal Commerce Protocol checkout specificationOpen checkout contracts behind the payment step; a living specification.
10Visa Published Checked
Visa: New AI, stablecoin, and token innovations at Visa Payments ForumAgent Score, an Agentic Directory and a large transaction model, behind the checking step.
11Stripe Published Checked
Stripe: agentic commerce and checkout expansionMore payment methods and protocols for agents, behind the payment step.
12Google Published Checked
Google: Shopping updates from Google Marketing LiveUniversal Cart and the move into hotel booking and local food delivery, behind the finding step.
13UCP Checker Checked
UCP Checker: live declaration statisticsThe stamped September reading [UCP Checker · 2026-09-22 20:58 UTC]: a live counter re-crawled every 24 hours that counts what public files declare, not adoption, market share or purchases.
14Universal Commerce Protocol (GitHub) Checked
UCP pull request 780: lodging booking capabilityThe draft lodging booking capability and cancellation-policy extension, merged 24 September 2026 and still marked draft.
15Tapestry Published Checked
Tapestry: Coach and Kate Spade in the Gemini app and Google SearchThe US single-item checkout through Google Pay, with explicit approval for each purchase.
16Worldline Published Checked
Worldline press release: UCP payment handlerThe UCP payment handler on the Global Collect platform.
17GoCardless Published Checked
GoCardless: the first agentic account-to-account payment in the UKThe recurring donation to Trussell, built within the FCA’s AI Live Testing programme.
18UCP Checker Checked
UCP Checker: live declaration statisticsThe November reading [UCP Checker · 2026-11-01 21:13 UTC]: declarations in public files, not orders, transactions or volume.
19UCP Checker Checked
UCP Checker: census methodologyWhat a valid profile means, and the difference between declared and observed capabilities, read for the November reading.