Agentic AI and the Infrastructure of Autonomous Commerce

Agentic AI extends a generative model with tools, state and control logic that allow software to work toward a goal. An agent can gather information, select a next action, call an external system, evaluate the result and continue without requiring a person to approve every step. When those actions include accepting terms, buying data or moving money, the agent becomes part of commercial infrastructure.

The National Institute of Standards and Technology now describes AI agents by this capacity for autonomous action. Its 2026 standards initiative focuses on two practical conditions for adoption: agents must operate securely on behalf of users and interoperate across the digital ecosystem. Those conditions also captured the most important technology lesson from this week's Avalanche Summit New York. The model is only one component. Identity, permissions, connectivity, evidence and settlement determine whether the resulting system can be trusted to act.

One Summit framework showed the progression clearly. The internet was designed mainly for a human who browses, chooses and pays for a service. The emerging system adds three new relationships: a person delegates a goal to an agent; an agent purchases a digital service; and two agents discover each other, negotiate work and settle the result. The last relationship is the most technically demanding because both sides must evaluate an unfamiliar counterparty while preserving the authority of the people or organizations behind them.

Adapted by Sender Consulting LLC from Avalanche Summit 2026.

What makes AI agentic

A language model generates an output. An agentic system combines that model with an execution environment. It needs an orchestration layer to decide which step comes next, tools that can read or change external systems, state that preserves progress, and controls that determine which actions are permitted. Credentials and payment capability may also be present, but they should remain separate from the model itself.

Two open protocols illustrate the connective layer. The Model Context Protocol gives AI applications a standard way to reach data sources, tools and workflows. The Agent2Agent protocol lets independent agents advertise capabilities, exchange messages and collaborate on tasks while keeping their internal implementations private. MCP helps an agent act on systems. A2A helps agents act with one another.

This capability also changes the security problem. A conventional application follows code written in advance. An AI agent may choose its sequence of actions from model outputs and information it encounters during execution. NIST's 2026 work on securing AI agent systems highlights indirect prompt injection, poisoned models and agents taking harmful actions even without an adversarial input. A content error can therefore become an operational action. The control boundary has to surround the tools, credentials and transactions, not only the text produced by the model.

Four stages of economic agency

The Summit material distinguished four interaction patterns that help locate the technology's current maturity. Human-to-service commerce is the familiar web. Human-to-agent systems let a person delegate a task and budget. Agent-to-service systems allow software to purchase a digital resource, often one request at a time. Agent-to-agent systems add counterparty discovery, negotiation, delivery and verification.

The clearest production evidence today sits in agent-to-service payments. Coinbase's x402 documentation describes a web request that can carry its own payment requirement, allowing a machine to pay for an API or digital service without a conventional checkout flow. Coinbase reports more than 100 million x402 payments across Base and Solana. The number is company-reported, but it shows that machine-initiated payment is moving beyond isolated demonstrations.

Agent-to-agent commerce remains earlier. A payment message can confirm that funds moved. It does not establish whether an agent was authorized to make the purchase, whether the seller delivered the promised result or how either side can challenge the outcome. Those questions turn an automated payment into a commercial transaction.

Trust requirements for autonomous transactions

The standards now emerging around agentic commerce address several distinct forms of trust. Google Cloud's Agent Payments Protocol uses cryptographically signed mandates as evidence of what a user intended and what an agent was authorized to buy. Visa's Trusted Agent Protocol is designed to let a merchant verify an approved agent and bind its authorization to a specific domain and operation. Mastercard's Agent Pay for Machines combines identity, spend rules and multi-rail settlement across cards, accounts and stablecoins.

These approaches converge on the same design principle. The agent should receive a scoped credential, not a person's reusable login or an unrestricted private key. The credential should identify the principal, define the permitted action, impose budget and time limits, and support revocation. NIST's recent guidance on agent identity and authorization makes the same point through established identity and access management practice: shared credentials weaken accountability because they obscure both identity and permission.

Legal attribution remains connected to that technical record. Under the U.S. E-SIGN Act, a contract cannot be denied effect solely because electronic agents were involved, provided the action is legally attributable to the person to be bound. An AI agent may perform the operational work of a counterparty, but the system still needs to show which person or organization authorized that work.

The emerging technology stack

No single protocol covers the full lifecycle. The Summit's landscape treats autonomous commerce as a five-layer technology stack serving three distinct transaction paths: human to agent, agent to agent and agent to service.

How to read the landscape

Read vertically from the bottom up. Layer 1 is settlement: the rails that move money and produce finality. Layer 2 is coordination: the mandates, contracts, workflows, exceptions and retries that govern a transaction. Layer 3 is discovery: the directories and machine-readable catalogs that let an agent find a service or another agent. Layer 4 is authorization: the identity, delegation, spend policy and revocation controls that connect an agent to a principal. Layer 5 is the access surface through which a person or another system initiates the work.

Read horizontally across three currents. Human-to-agent activity begins with intent and bounded delegation. Agent-to-agent activity adds bilateral identity, negotiation, evidence, disputes and settlement. Agent-to-service activity is narrower: a machine invokes an endpoint and pays per call or session. The workflows differ, but all three need shared identifiers and an authorization trail so a transaction can be reconstructed end to end.

The right edge of the landscape condenses the institutional functions the stack must provide: authorize and delegate; identify agents and establish reputation; manage a contract lifecycle; and connect payment to an audit record. This is a useful test for any claim about agentic commerce. A faster payment mechanism solves only the bottom layer. It does not establish who authorized the agent, what the parties agreed or what happens when delivery fails.

The interfaces between these layers will determine whether the market remains fragmented. An agent may discover a service through one protocol, receive authority through another and settle through a third. The transaction context must survive those handoffs so that the final payment can be traced back to the original instruction and the evidence of performance.

Separating execution agreement and money

A second Summit framework separated three kinds of state. The execution state contains the agent's private workflow: scheduled steps, tool activity, retries and pauses. The agreement state contains facts that both parties may need to rely on: proposed terms, commitment, submitted evidence, acceptance and dispute. The money state tracks whether funds are available, reserved, released, frozen or refunded.

The separation is technically useful because the three records have different owners and privacy requirements. A workflow may contain proprietary reasoning and sensitive data. The commercial record needs enough shared evidence to support a decision. The payment ledger needs deterministic commands and finality. Placing every internal agent action on a shared ledger would disclose too much and cost too much. Treating a private workflow log as the agreement would give the counterparty too little.

The Summit presentation used an EVM contract for the money state, but the principle is broader than blockchain. A smart contract can enforce the release of value when it receives a valid instruction. It cannot independently decide whether a dataset met a quality threshold or whether a research report satisfied its scope. Those judgments belong in the agreement and verification layer, and the resulting payment can travel over more than one rail.

Data as an early agentic market

A data purchase illustrated how agentic commerce could differ from a conventional online sale. A buyer agent may request a specific set of rows and columns, negotiate quality and permitted use, and accept restrictions on retention, copying, resale or deletion. A seller agent can price the requested slice dynamically. Funds can be reserved while the data is delivered and released after agreed checks pass.

The slide described a forthcoming demonstration, not a live production market. The scenario is still useful because data has properties that favor early automation. It is digital, divisible and often metered. Schemas and some quality thresholds can be tested by software. Licensing conditions can be represented as machine-readable terms. The delivery and verification steps are harder than paying for an API call, but more deterministic than evaluating a subjective professional service.

This suggests a practical adoption sequence for agentic AI. The first scaled markets are likely to involve digital outputs with clear specifications, repeatable validation and limited downside per transaction. Human review can remain available for failed checks and larger exposures. Markets based on judgment, physical performance or complex liability will require richer evidence and recourse before the same level of autonomy is credible.

What remains unresolved

Connectivity and payment are advancing faster than the agreement layer. MCP and A2A provide useful standards for tool use and collaboration. x402 supports machine-native payment. AP2, Visa and Mastercard are developing methods to carry identity and authority into a transaction. The remaining gap is a widely accepted way to record negotiated terms, evaluate delivery and resolve a disputed result across independent agent systems.

The draft ERC-8004 proposal addresses part of that gap through identity, reputation and validation registries. Its draft status matters. Reputation can help one agent assess another, but the market still needs standards for evidence, confidentiality, reversibility and liability. An agent may also change models, tools or owners over time, so identity must distinguish the principal, the agent and the temporary session that performed a particular action.

Security will remain a systems problem. Prompt injection can influence a model. Compromised tools can falsify results. Weak credentials can give an agent more authority than intended. Multi-agent workflows can make responsibility harder to reconstruct. Audit logs help only when they capture the relevant instruction, policy decision, tool call, evidence and payment reference in a form that another party can verify.

What financial institutions should do now

Financial institutions do not need to wait for a complete agent economy. They can prepare their products and controls for software that will increasingly discover, compare and invoke services through APIs.

Make products machine-readable. Expose eligibility rules, prices, service levels and usage rights in structured form so an agent can compare offers without relying on prose or screen scraping.
Separate identity from delegated authority. Record the principal, the agent and the session separately. Issue narrow credentials with budgets, approved tools, counterparties, expiry and revocation.
Preserve transaction context. Link the user's instruction, policy decision, negotiated terms, delivery evidence and payment receipt with stable identifiers.
Move controls into the execution path. Apply fraud, sanctions, privacy and entitlement checks through APIs before the agent commits an action, rather than relying only on retrospective monitoring.
Start with bounded use cases. Use low-value transactions, deterministic outputs and clear escalation rules before allowing broader discretion or open-ended counterparty selection.
Keep settlement flexible. Use cards, accounts or digital assets according to the transaction and regulatory setting. The authority and evidence model should remain valid when the payment rail changes.

Where the technology is heading

The Summit made agentic AI more concrete by showing what changes when software can act as well as generate. The relevant unit is no longer a single model response. It is a sequence of actions performed under delegated authority across tools, agents and payment systems. That sequence has to remain attributable from the original instruction through settlement.

Agentic commerce will develop as organizations become comfortable delegating narrow decisions without surrendering control. The strongest systems will combine capable models with conventional identity discipline, machine-readable terms, verifiable evidence and explicit exception handling. The payment rail matters, but the larger technical achievement is a trustworthy chain from human intent to machine action.

Agentic AI scales when autonomy is matched by evidence and control.

Enjoyed this analysis?

Research boundaries

Research is current through September 2026.
Primary and official materials were prioritized, including government publications, protocol specifications, developer documentation, statutory text, and author-supplied Avalanche Summit materials.
No protocol implementation, source code, smart contract, security control, interoperability claim, or production deployment was independently tested or audited.
Company adoption and transaction figures are identified as company-reported and should not be interpreted as independently audited market data. This includes Coinbase’s report of more than 100 million x402 payments across Base and Solana.
Maturity labels matter. The data market example was described as a forthcoming demonstration; Visa describes Trusted Agent Protocol as being developed and deployed; ERC-8004 remains a draft; and announcements or reference implementations do not necessarily demonstrate scaled commercial adoption.
Statements about where adoption is likely to begin, how financial institutions should prepare, and which commercial models may scale first are the author’s analysis based on the cited evidence—not forecasts supplied by the cited organizations.
Protocol specifications explain intended design and functionality. They do not prove that independent implementations will be secure, interoperable, legally enforceable, or commercially viable.
References to companies or protocols appearing inside the Avalanche Summit landscape are contextual. Their inclusion does not constitute endorsement or independent verification of their products.
The legal discussion is limited to the federal E-SIGN Act’s treatment of electronic agents. It is not a legal opinion concerning agency, liability, consumer protection, contracting authority, AML/KYC, sanctions, privacy, payments licensing, fiduciary obligations, or state law.
The legal reference is principally U.S.-focused, while the technical standards and commercial ecosystem discussed are international.
Agentic AI terminology remains unsettled. “Agent,” “autonomous,” “production,” “trusted,” and similar terms may be used differently across issuers.
Protocols, documentation, transaction counts, and proposal statuses can change after publication.

Sources

Avalanche Summit. Avalanche Summit New York. Official event site; September 16–17, 2026.
National Institute of Standards and Technology. AI Agent Standards Initiative. Created February 17, 2026; updated August 14, 2026.
National Institute of Standards and Technology. CAISI Issues Request for Information About Securing AI Agent Systems. January 12, 2026.
National Institute of Standards and Technology. Request for Information Regarding Security Considerations for Artificial Intelligence Agents. Federal Register, 91 Fed. Reg. 698; January 8, 2026.
National Institute of Standards and Technology. Back to the Future: Why Agentic AI Needs a Strong Identity Foundation. August 27, 2026.
National Cybersecurity Center of Excellence. Software and AI Agent Identity and Authorization. Project page and draft concept paper; current during the evidence window.
Model Context Protocol. What Is the Model Context Protocol?. Official protocol documentation; current during the evidence window.
A2A Project. Agent2Agent Protocol. Official open-source protocol specification and repository; current during the evidence window.
x402 Foundation. x402 Protocol. Official protocol specification and reference implementation; current during the evidence window.
Coinbase Developer Platform. x402 Overview. Developer documentation and company-reported transaction volume; current during the evidence window.
Google Cloud. Powering AI Commerce with the New Agent Payments Protocol. September 16, 2025.
Google Agentic Commerce. Agent Payments Protocol. Official technical specification, schemas and reference implementations; current during the evidence window.
Visa. Trusted Agent Protocol. Product and protocol documentation; current during the evidence window and described by Visa as in development and deployment.
Mastercard. Mastercard Launches Agent Pay for Machines to Unlock Super-Fast, Always-On Payments. June 10, 2026.
Ethereum.org. Introduction to Smart Contracts. Technical documentation; last updated February 25, 2026.
Ethereum Improvement Proposals. ERC-8004: Trustless Agents. Created August 13, 2025; draft status during the evidence window.
U.S. Government Publishing Office. 15 U.S.C. § 7001—General Rule of Validity. Subsection (h) addresses contracts involving electronic agents; 2024 edition, current during the evidence window.