How Agentic Commerce Works: The Technology Behind AI-Powered Purchasing

Q1. How Does Agentic Commerce Actually Work, End to End?

A friend on a growth team tried to buy snowboard pants through Gemini last winter. She typed, "buy these and do the checkout for me, end to end." The agent looped twice, stalled, and quietly gave up. The product existed. The store was live. The machine just could not finish the job.

Agentic commerce works through a four-layer technology stack. First, an AI agent discovers products via machine-readable data (MCP). Second, it builds and completes a cart through a checkout protocol (ACP or UCP). Third, it proves the user authorized the spend using cryptographic mandates (AP2). Fourth, payment settles over card rails or machine-native rails (x402, MPP). No human clicks checkout at any step.

🛒 The four layers, in one purchase

Picture a single order moving through the stack, one hop at a time.

1. Discovery. The agent reads a structured product feed, not your web page (MCP).
2. Checkout. It builds the cart and starts the transaction through ACP or UCP.
3. Authorization. It proves you approved this exact spend with signed AP2 mandates.
4. Settlement. Money moves over card rails or machine-native rails like x402 or MPP.

Each layer has an owner. MCP came from Anthropic. ACP came from OpenAI and Stripe. AP2 came from Google and now sits with the FIDO Alliance. Stripe reports that 78% of the Forbes AI 50 build on its rails, which tells you how fast this plumbing is being laid.

⚠️ Why the human web keeps breaking the flow

Most sites are built for a person who clicks. An agent does not click. When it hits a JavaScript dropdown or a UI-only cart, it stubs the call and fails silently, exactly like that snowboard-pants loop. The technology is real, but it only fires when your store speaks the machine's language. Our agentic commerce service starts by testing exactly where that machine language breaks down.

I think of it as a Ghost Kitchen. Your website is the dining room. Your data feed is the kitchen. The AI agent is the delivery driver fulfilling orders for buyers who never walk in the door. If the kitchen is not wired, the driver leaves empty-handed, and you never even see the miss.

At MaximusLabs, we map every client's stack against these four layers before we touch a word of content. If the agent cannot discover you or check you out, ranking is beside the point. This is my current read, and it is shifting monthly as the protocols firm up. If you want the full picture, our state of agentic commerce 2026 report traces each layer in depth.

Q2. Why Is Agentic Commerce Different From Traditional SEO and E-commerce?

For fifteen years, the job was simple to describe. Rank the page, win the click, nudge the human down a funnel. A Head of Organic Growth could stare at a rankings dashboard and feel in control. That control is quietly slipping.

Traditional e-commerce and SEO optimize for a human who browses, clicks, and compares. Agentic commerce optimizes for a machine that reads structured data and transacts in one shot. The funnel collapses: discovery, comparison, and checkout merge into a single agent decision. Winning shifts from ranking blue links to being the vendor the agent can actually transact with. If the agent can navigate your store and not your rival's, you win by default.

📉 The complication: the funnel just folded in on itself

Here is the tension nobody on the old dashboard wants to name. When an agent handles the whole journey, impressions and click-through rate stop mapping to revenue. PwC describes agentic commerce restructuring the retail funnel itself, with discovery happening before or instead of a site visit. The snowboard-pants loop was not a fluke. It was the click-based web failing a machine buyer.

• Old world: many pages, many clicks, one human deciding slowly.
• New world: one feed, one agent, one decision made in milliseconds.
• The trap: your conversion-optimized funnel is now a high-latency liability for a machine.

The resolution is a mental flip. Intent becomes the interface. Instead of a UI to click through, merchants will expose a canonical intent endpoint that accepts structured desires. Ethan Smith of Graphite notes Webflow saw a 6x conversion-rate difference between LLM traffic and Google search traffic, which is why being the agent's pick matters more than a ranking. As the operators say, the snippet is the new rank. This is the core of GEO vs traditional SEO.

"Whether you call it GEO, LLMO, or AEO, it all boils down to just doing good SEO."
Ryan Law, Ahrefs, Surfer Academy AEO session

I hold a friendly disagreement here. Good SEO is the floor, not the ceiling. The standard read gets this backwards: it treats GEO as a coat of paint on old tactics, when the buyer is now a machine with different eyes.

This is why we built MaximusLabs around generative engine optimization and answer engine optimization, not legacy SEO. The goal is not a #1 blue link. It is being the answer the agent acts on, tied to pipeline rather than pageviews. In one engagement, we tracked a 64% citation rate across AI platforms against a legacy competitor sitting at 30%, which is the kind of number that actually moves revenue.

Q3. What Is the Agentic Commerce Protocol Stack, and Who Wins Each Layer?

Ask three vendors "is it ACP or AP2?" and you will get three confident, contradictory answers. The confusion is not academic. It decides where a merchant spends its scarce engineering hours.

The agentic commerce stack has four layers, each with its own protocol. MCP (Anthropic) handles discovery. ACP (OpenAI and Stripe) and UCP (Google) handle checkout. AP2 (Google, now FIDO Alliance) handles payment authorization via signed Intent, Cart, and Payment mandates. x402 and MPP handle settlement. They aren't rivals: ACP does the checkout, AP2 proves consent. Model providers fight for checkout; card networks fight for authorization.

🗺️ The stack at a glance

🧩 The dated facts that make this citeable

These are the atoms most brand pages skip. AP2 was announced September 16, 2025, then donated to the FIDO Alliance on April 28, 2026. UCP launched in January 2026; MPP launched in March 2026 with Stripe and Tempo. OpenAI even scaled back parts of its native in-chat checkout in early 2026, a reminder that the stack is still moving.

The micro-level wiring matters too. OpenAI's Agentic Commerce feed uses an is_eligible_search boolean, a true/false gate that decides whether your product can even appear in bot recommendations. It also reads popularity_score (0 to 5) and return_rate (0 to 100%) as optional ranking inputs. Miss the gate, and you are invisible before ranking even starts. Getting these signals right is core technical GEO implementation work.

💰 Who wins which layer

Here is my honest, and possibly wrong, read on the strategy. Card networks like Visa and Mastercard are fighting to own authorization, because trust is their historic moat. Model providers like OpenAI and Google are fighting to own checkout, because that is where the agent lives. For a merchant, that means integrating at the checkout layer your buyers' agents actually use, then staying payment-agnostic underneath.

"We optimized for some of their super important bottom-of-the-funnel keywords. We conducted research on the best principles like Universal Commerce Protocol, Agent-to-Agent Protocol, and WebMCP. After this, the sales from their e-commerce website doubled over six months."
Krishna Kaanth, Founder, MaximusLabs AI Verified Case Study

That is the MaximusLabs habit: research protocol fit before writing a single line of content. I want to be transparent, that "doubled in six months" figure is our own reported result, not a third-party audit. You can see the full engagement in our nutrition SEO agentic commerce case study.

Q4. How Do AI Agents Discover and Rank Your Products?

Watch an agent "shop" and the first myth dies fast. It does not scroll your beautiful product page. It reads a feed, grabs attributes, and moves on. If the data is not in the feed, to the agent, it does not exist.

AI agents discover products through machine-readable data, not by browsing pages. They read structured feeds (via MCP) carrying attributes like fabric, closure, material, price, and stock. Agents can't click JavaScript facets, so metadata hidden behind dropdowns is invisible to them. Ranking then leans on supplied signals: eligibility flags, popularity scores, and return rates. A clean, complete feed decides whether an agent can even consider you.

❌ The hidden-facet problem

Most stores bury their best data inside JavaScript filters. Color, fabric, closure, neck style, all locked behind a dropdown a human clicks and a bot cannot. As Ethan Smith puts it, LLMs cannot find information hidden behind JavaScript facets. Your richest selling detail is often the exact thing the agent never sees. Surfacing it is exactly what our GEO/AEO for e-commerce engagements fix first.

✅ How to make your catalog machine-legible

The fixes are unglamorous and effective. Pull the facet data into plain text.

• Surface closure, fabric, material, and neck style inside FAQs and text headers, not just filters.
• Move your help center to a subdirectory (domain.com/help), because subdomains get treated as separate filing cabinets and retrieve worse.
• Link deep pages point-to-point, like Southwest's route map, so no product page is orphaned.

Then there is ranking. Once you are discoverable, agents weigh supplied signals. OpenAI's feed reads an is_eligible_search gate, a popularity_score from 0 to 5, and a return_rate from 0 to 100%. Stripe frames MCP as giving agents structured, machine-readable access to inventory and prices instead of scraping, so the agent can know with near-certainty that an item is in stock. A technical SEO and website audit is where most brands find these gaps.

💡 The reframe: data beats ad spend

Here is the contrarian line I keep repeating to founders guarding their cash. Visibility is now earned through the data, not the ads. You can pour hundreds of thousands into PPC and still lose to a competitor with a cleaner product feed. That is not a reason to kill paid media tomorrow, your cash is real and finite, but it is a reason to fund the feed first. This is the heart of a revenue-focused GEO framework.

One caution on effort. Do not pour weeks into technical-SEO security blankets that lack evidence of impact, like standalone LLM.txt files no major engine confirms using. From what surfaces when you actually run this work, the feed and the exposed facets move the needle. The audit theater does not. If you want a per-layer readiness check, contact us.

Q5. How Do Agent-Initiated Payments and Authorization Work Securely?

Hand a stranger your credit card and say "buy what I need." That is, roughly, what you do when an AI agent checks out for you. The obvious question follows fast: how does anyone trust that spend?

Agent-initiated payments work through delegated, cryptographically signed authorization. Protocols like AP2 attach three mandates, Intent, Cart, and Payment, proving a real user approved a specific spend. Settlement then runs on tokenized credentials or single-use virtual cards, with fraud checks and an audit trail. "Know your agent" (KYA) verification confirms the agent is legitimate. This shifts trust from behavioral guesswork to protocol-level proof of consent.

⚠️ The complication: who pays when the agent gets it wrong?

Here is the tension that keeps risk teams up at night. An agent buys the wrong size, the wrong quantity, or the wrong item entirely. Who eats the cost, the shopper, the merchant, or the model provider? The liability question is genuinely unsettled today.

The deeper problem is fraud. Old defenses read human behavior, mouse movement, typing speed, and time on page. A machine buyer has none of that, so those heuristics quietly break. The system was built to spot a suspicious human, not a fast, headless agent.

💰 The resolution: cryptographic consent, not vibes

This is where the mandate model changes the game. AP2 wraps each purchase in three signed proofs.

• Intent mandate: you authorized this kind of purchase.
• Cart mandate: you approved this exact cart.
• Payment mandate: this specific spend is sanctioned.

Settlement then rides tokenized credentials or single-use virtual cards, each with fraud screening and a full audit trail. KYA verification confirms the agent itself is real and permitted. The scale here is not small. Roughly 1.3% of global GDP already flows through the financial APIs now being wired for agentic transactions. This is exactly where GEO/AEO for financial services intersects with commerce.

The felt shift, from what surfaces when you actually run this work, is that trust stops being a guess. It becomes math. At MaximusLabs, our trust-first content playbook now extends to the machine layer, where we help brands surface the verifiable trust signals, clear return policies, stock certainty, and structured guarantees, that agents check before they buy. I might be wrong on the exact liability split that wins, but the direction toward provable consent looks settled.

Q6. What Does an Agent-Ready Tech Stack Look Like in Practice?

A founder asked me last month, "what do I actually change on Monday?" Fair question. The protocol talk means nothing if it does not turn into a task list your engineer can ship this sprint.

An agent-ready stack exposes clean data at every layer. Discovery: a complete, machine-readable product feed with attributes pulled out of JavaScript facets. Checkout: an ACP-compatible or UCP-compatible endpoint plus a canonical intent endpoint. Authorization: AP2-ready mandate handling and tokenized payments. Structure: point-to-point internal links (not hub-and-spoke), help docs in subdirectories, and schema (Product, FAQ, HowTo) so agents parse and cite you.

✅ The per-layer readiness checklist

Work it layer by layer, cheapest fixes first.

1. Discovery: publish a full product feed; pull fabric, size, closure, and stock out of JavaScript filters into plain text.
2. Checkout: expose an ACP-compatible or UCP-compatible endpoint, plus one canonical intent endpoint that accepts structured requests.
3. Authorization: wire AP2-ready mandate handling and tokenized or virtual-card payments.
4. Structure: move help docs to a subdirectory, link deep pages point-to-point, and add Product, FAQ, and HowTo schema.

Getting the last step right is core schema markup work, and it pairs naturally with a full technical SEO and website audit.

❌ Where not to burn your cash

Now the honest part, because your budget is finite. Not every "best practice" earns its keep. Ethan Smith of Graphite is blunt: most SEO work is true but zero-impact, and in eighteen years he has never seen Core Web Vitals drive a traffic increase.

So skip the audit theater. Standalone LLM.txt files and Markdown-only pages lack evidence of real impact, and they eat hours you could spend on the feed. Spend where agents actually read. We cover this trade-off in our technical GEO implementation guidance.

"Our approach is entirely different from a traditional agency. We optimize for how ChatGPT, Perplexity, and Gemini each rank sources, then build the feed and schema around that, not around a Google-only checklist."
Krishna Kaanth, Founder, MaximusLabs AI Published Methodology

This per-layer readiness audit is the first thing we run at MaximusLabs, kept cost-effective and tied to pipeline, not pageviews, through our agentic commerce service. One caution I hold loosely: the exact checkout protocol you integrate may change as ACP and UCP mature, so build the feed first, since that layer pays off no matter who wins checkout.

Q7. How Big Is Agentic Commerce and How Fast Is Adoption Moving?

Every founder weighing this asks the same thing: is this real yet, or is it another conference buzzword? The numbers answer cleanly. This one is real, and it is moving faster than the last three hype cycles combined.

Agentic commerce is scaling fast. McKinsey projects $3 to $5 trillion in global agentic transactions by 2030. IBM reports 45% of consumers already use AI in part of their buying journey, while 83% cite privacy concerns. Stripe notes 78% of the Forbes AI 50 build on its rails, with 700+ agent startups launched in 2024. The core infrastructure, ACP, AP2, UCP, and MPP, all shipped between late 2025 and mid-2026.

📊 The proof, in dated numbers

Stack the evidence and the trend is hard to argue with.

• $3 to $5 trillion in global agentic transactions projected by 2030 (McKinsey).
• 45% of consumers already use AI in part of their buying journey (IBM).
• 83% cite privacy or data-misuse concerns (IBM).
• 78% of the Forbes AI 50 build on Stripe, with 700+ agent startups in 2024.
• Core protocols shipped in a tight window: UCP in January 2026, MPP in March 2026, and AP2 to the FIDO Alliance in April 2026.

For context on the broader shift, Gartner projects that over 50% of search traffic will move from traditional engines to AI-native platforms by 2028, which is why merchants are wiring for agents now. Our state of agentic commerce 2026 report tracks these figures in full.

💡 The trust gap is the opening

Here is the payoff most reports miss. That 83% privacy concern is not just a risk, it is a wedge. The brands that solve machine-readable trust first will capture the early curve while competitors hesitate.

There is a real debate on timing. Ethan Smith calls first-mover advantage a "false concept," arguing rank can be won later if authority exists. I disagree, respectfully. Trust compounds, and early movers build a moat that late entrants pay dearly to close. The nuance that reconciles us: general questions favor an earned strategy (publishers cite you), while specific "money queries" favor an owned strategy (your own vendor data wins). So put your owned, bottom-of-funnel data in place now, because that is where the compounding starts, and it maps directly to a revenue-focused GEO framework.

Q8. What Are the Hardest Unsolved Problems and Risks in Agentic Commerce?

The demos look magical. A prompt, a pause, a confirmed order. Then you sit inside the real work and watch the same agent stall on a checkout it should have breezed through. The gap between the keynote and the console is where the honest story lives.

The hardest unsolved problem is checkout reliability: agents still stub API calls and fail silently on click-based sites. Liability is unsettled, who pays when an agent buys the wrong item? Trust is the biggest barrier, with 83% of consumers citing privacy concerns. Fraud defenses built for human behavior break against machine buyers. Until intent endpoints, KYA, and cryptographic mandates are standard, agentic commerce stays uneven across merchants.

⚠️ The complication: four things still genuinely break

Name them plainly, because operators respect candor over hype.

• Silent checkout failure. Agents stub calls and loop, exactly like the snowboard-pants attempt in Gemini.
• Liability ambiguity. No settled answer on who pays for a wrong purchase.
• Fraud-model breakage. Human-behavior heuristics do not read machine buyers.
• Trust and privacy. 83% of consumers cite data-misuse worries.

The infrastructure itself is young. OpenAI scaled back parts of its native in-chat checkout in early 2026, and AP2 only reached the FIDO Alliance in April 2026. These are foundations still being poured, not finished floors. We track these shifts in our future trends in GEO coverage.

⏰ Where this resolves, and my honest hedge

Standards will mature. Intent endpoints, KYA verification, and cryptographic mandates will likely become table stakes, which smooths most of the failures above. But the timeline is genuinely uncertain, and this is my current thinking, subject to change as the protocols settle. If you want a candid read on your own gaps, contact us.

There is also a live disagreement worth sitting with. Ethan Smith of Graphite argues first-mover advantage is a "false concept," since authority can win rank later. My read is the opposite: trust compounds, so prepared brands build a wedge now. Either way, the practical move is the same. Get discoverable and checkout-ready before your category does, and you are covered whichever view proves right. At MaximusLabs, our GEO/AEO for e-commerce team would rather tell a founder "this part is not solved yet" than sell certainty we cannot back.

Q9. What Should You Do on Monday Morning to Prepare for Agentic Commerce?

Picture your storefront in two years. The pretty homepage still exists, but most sales never touch it. An agent reads your feed, confirms stock, and checks out, all before a human would have found the "add to cart" button. The dining room stays open. The kitchen does the real work.

Start by auditing whether an AI agent can even discover and check out on your site. Pull product attributes out of JavaScript facets into readable text. Add Product, FAQ, and HowTo schema. Move help docs to subdirectories and link deep pages point-to-point. Then plan for ACP or UCP checkout and AP2-ready payments. Prioritize BOFU "money query" pages where owned data wins, that's where agentic revenue compounds first. This is the core of our agentic commerce service.

⏰ The complication: waiting has a price

Here is the tension. This does not feel urgent, because your Google traffic still looks fine today. That comfort is the trap. Trust compounds, so every quarter you wait, an earlier-moving competitor banks citations and authority you will later pay to catch. We unpack this dynamic in our zero-click search brand economy report.

There is a credibility tax on latecomers. When Gartner projects over 50% of search traffic shifting to AI-native platforms by 2028, the brands wiring their feeds now are the ones agents will default to then. You do not need a huge budget for this. You need the right feed, which is the cheapest lever most founders are ignoring, and our pricing reflects that.

✅ Your prioritized Monday checklist

Do these in order, cheapest and highest-impact first.

1. Audit agent access. Test whether an agent can discover and check out on your site at all, using our AI crawlability checker.
2. Free the facet data. Pull fabric, size, closure, and stock out of JavaScript filters into plain text.
3. Add schema. Mark up Product, FAQ, and HowTo so agents parse and cite you, following schema markup basics.
4. Fix structure. Move help docs to subdirectories; link deep pages point-to-point, guided by a technical SEO and website audit.
5. Plan the rails. Scope ACP or UCP checkout and AP2-ready payments next.
6. Model demand cheaply. Turn your search-query data into question variants; ask ChatGPT for phrasings when no truth set exists, or use our query fan-out generator.

Think of the model as a Universal Intent Decoder, a machine that translates a messy human prompt into a structured request for your product data. Your job is to make that data clean enough to decode. That is the whole game, stripped of jargon, and it drives our GEO strategy framework.

💬 What I am sitting with

Here is my open question, and I genuinely do not know the answer yet. When the UI storefront becomes a legacy interface, will brand still matter as much, or will the cleanest feed simply win? My hunch is that brand becomes the tiebreaker when two feeds are equally clean, but I hold that loosely.

If you want a per-layer agentic-readiness audit tied to pipeline, that is the work we do at MaximusLabs. Even so, the checklist above will move you ahead of most competitors this quarter, with or without us. I would rather trade notes than pitch you, so if you are testing any of this, tell me what breaks. That is where the real learning lives.