What Embedded Checkout Teaches Us About the Trust Architecture of Agentic Commerce

By Mitesh Shah, Product Lead for AI Personalization and Agentic Commerce at PayPal

I helped build Buy with Prime, which brought Amazon’s checkout and fulfillment promise to independent merchant sites. Buy for Me now sends an AI agent in the opposite direction, from Amazon’s app into those sites. The two products reveal the same lesson: autonomous commerce will scale only when every participant can verify what the agent was allowed to do and what happens when the transaction fails.

The Button Was a Compact Between Companies

I was the founding product manager for Buy with Prime. From the shopper’s perspective, the product looked simple: a familiar button on a merchant’s website. Underneath it sat a negotiated division of responsibility among the shopper, the merchant, Amazon, and the payment system.

When a Prime member used the button, Amazon supplied more than stored payment details. It supplied a verified identity, a delivery estimate backed by inventory in Amazon’s fulfillment network, order tracking, customer support, and a returns experience. The merchant kept its storefront and remained the seller. Amazon made a set of promises portable.

That portability mattered because conversion depends on more than form fields. A shopper is also asking whether the product will arrive on time, whether a return will be painful, and whether someone accountable will answer if the package disappears. Buy with Prime reduced those uncertainties together; Amazon later reported participating merchants saw an average conversion increase of 25 percent. The lift came from a system of connected guarantees, not the button alone.

The constraints made those guarantees credible. Eligible inventory sat in Amazon fulfillment centers. Delivery dates were calculated from an operating network. Amazon managed the defined post-purchase experience. The merchant knew which parts of the transaction Amazon controlled and which parts remained its responsibility. Trust scaled because the operating boundary was specific enough to test, monitor, and enforce.

Buy for Me Reverses the Direction of Trust

Amazon’s Buy for Me, introduced in April 2025, starts from the same ambition but reverses the flow. A shopper discovers an item in the Amazon app, confirms the order details, and asks Amazon’s agent to purchase the item from the brand’s website. The agent supplies encrypted customer and payment information to the merchant. The brand fulfills the order and manages returns, exchanges, and customer service, while Amazon shows order tracking in its app.

That division is instructive. The shopper experiences one journey, but responsibility crosses several systems: Amazon hosts discovery and takes the instruction, the agent transacts with the merchant, the merchant fulfills and services the order, and the payment network authorizes the charge. A smooth interface can hide those seams during purchase; it cannot erase them when the item is wrong, the price changes, or the shopper disputes what the agent selected.

Embedded checkout exported a known trust bundle into a merchant surface. Agentic checkout asks multiple companies to assemble a new trust bundle for a piece of software. The hard work is not teaching an agent to click a button; it is making the agent’s authority, identity, payment credential, and resulting order legible to every party that may later have to defend or reverse the transaction.

Agent Commerce Requires Four Verifiable Layers

The current protocol activity can look like a winner-take-all standards race. In practice, each effort covers a different part of the transaction. A durable architecture needs four layers of proof:

1. Authority: What did the shopper permit? A signed mandate recording scope, limits, timing, substitutions, and any approval requirement.
2. Agent identity: Which software is acting? A verifiable identity tied to an approved agent and to the user on whose behalf it acts.
3. Payment: Can this credential fund this purchase? A constrained token with controls, authentication, issuer visibility, and transaction-specific context.
4. Order and recourse: Who owns the promise after payment? A durable order record with merchant-of-record clarity, lifecycle events, and defined paths for changes, returns, and disputes.

Google’s Agent Payments Protocol handles intent through cryptographically signed mandates. Visa’s Trusted Agent Protocol lets a merchant verify that an agent is legitimate and authorized. Mastercard Agent Pay applies registered agents and constrained payment tokens. The Agentic Commerce Protocol from Stripe and OpenAI defines how agents and merchants exchange catalog, checkout, payment, and order information.

No single token or API can carry the whole trust burden. A payment credential can prove that a charge is authorized; it cannot prove that a blue shoe was an acceptable substitute for a black one. A signed mandate can preserve the shopper’s instructions; it does not guarantee that inventory was current or that the merchant will honor a return. The transaction is trustworthy only when the proofs connect.

The Hardest Product Problem Is Delegated Intent

A human clicking Buy with Prime is present at the moment of commitment. The shopper sees the item, merchant, price, delivery date, and return terms before confirming, so the final decision is contemporaneous and visible.

An agent can act after the shopper leaves. That changes a preference into a policy. Consider a request such as, “Buy these running shoes when they fall below $120.” Does the limit include tax and shipping? Is a different color acceptable? Can the agent switch retailers to meet the price? Should it use a nonreturnable promotion? How fresh must the inventory and delivery estimate be? What if the shopper already bought the shoes elsewhere? Each unanswered question is a future dispute disguised as convenience.

The product challenge is to translate natural language into an enforceable permission object without forcing the shopper to complete a legal form. The interface should expose the few constraints that change the decision, show how the agent interpreted them, and require fresh approval when the proposed purchase falls outside those bounds. This is progressive autonomy: the agent earns a wider operating range through predictable behavior and low-friction recourse.

Google’s AP2 makes a similar distinction between a real-time purchase, where the shopper approves a specific cart, and a delegated task, where the shopper signs the conditions in advance. That distinction should become a basic design primitive. Human presence is not a cosmetic UX detail; it changes the evidence required to show a transaction reflects the user’s intent.

Payment Authorization Does Not Validate the Purchase Decision

Card systems are designed to answer a narrower question than an agent must answer. The issuer evaluates whether the credential is valid, whether authentication and risk signals are sufficient, and whether the account can support the charge. Those controls do not determine whether the agent chose the right product or complied with the shopper’s preference hierarchy.

Agent-aware credentials improve the picture: they identify the agent to issuers and merchants, constrain where and how much it can spend, and create a better audit trail. But they do not eliminate semantic disputes. A shopper may have authorized the agent and still reasonably argue it exceeded its instructions.

That means the industry needs a new evidence chain alongside the conventional payment record. The relevant receipt includes the shopper’s instruction, the constraints the agent derived, the options it considered, the cart it approved, the credential it used, and the policy that determined whether another confirmation was necessary. This evidence should be concise enough for customer service and durable enough for a merchant, issuer, or network to inspect in a dispute.

Protocols can make that evidence portable, but commercial rules must still decide who bears the loss: did the agent violate its mandate, did the merchant supply bad product data, did a payment provider ignore a control, did the shopper approve the exact cart? The architecture cannot settle every dispute in advance, but it can make responsibility observable instead of reconstructing intent from logs after the fact.

For Merchants the Storefront Becomes Structured Operations

Buy with Prime asked a merchant to add a capability to a site designed for people. Agent commerce asks the merchant to make the business itself legible to software. Product titles and images are only the beginning. An agent needs reliable variants, inventory, delivery dates, taxes, shipping fees, promotion rules, return eligibility, warranty terms, loyalty benefits, and order-status events.

Data quality now influences distribution. If two merchants sell the same product, an agent will favor the one whose price and inventory are current, whose delivery promise can be verified, and whose policies can be evaluated before purchase. A beautiful product page can persuade a person while concealing operational ambiguity. An agent treats that ambiguity as risk.

This shift also raises a strategic question: when the agent owns discovery and comparison, it becomes the primary customer interface. The merchant may gain conversion while losing control of presentation, cross-sell, attribution, and the relationship. Merchants should evaluate agent channels on customer ownership and lifetime economics, not conversion alone.

Brand will still matter where taste, identity, service, or authenticity shapes the purchase, but its expression will change. Some signals stay visual and narrative; others become machine-readable proof: authorized seller status, warranty coverage, fulfillment reliability, verified reviews, or a loyalty benefit tied to an identified customer. The next generation of merchandising will be designed for both people and their agents.

Five Design Rules for Accountable Delegation

5. Match autonomy to consequence. Let agents complete low-risk, reversible purchases within clear limits. Require explicit approval when price, irreversibility, regulated goods, delivery urgency, or uncertainty crosses a defined threshold.
6. Bind the evidence. Connect the user mandate, agent identity, payment token, merchant domain, final cart, and order record with shared identifiers. A set of disconnected logs is not an audit trail.
7. Make interpretation visible. Show the shopper the constraints the system inferred from the request and the few assumptions that can change the result. Provide a simple way to revise them.
8. Design the exception path first. Before automating the happy path, define who handles price changes, substitutions, duplicate purchases, late delivery, returns, and disputes. Trust is often won after the transaction fails.
9. Preserve legitimate merchant control. Give merchants a way to identify approved agents, decide which products and policies are available to them, apply fraud controls, retain merchant-of-record status, and serve the customer after purchase.

The Winning Product Will Make Delegation Boring

Agentic commerce will progress because it removes work that shoppers do not value: searching across nearly identical listings, re-entering credentials, watching prices, and tracking routine orders. Intelligence makes that possible. Infrastructure determines whether people will keep using it.

The successful systems will make every purchase easy to explain: the shopper knows what authority was granted, the merchant knows which agent arrived, the issuer has the context to evaluate the payment, and the customer has a clear path to change, return, or dispute the order.

That is the enduring connection between Buy with Prime and Buy for Me. Buy with Prime packaged identity, payment, fulfillment, and recourse into a bounded promise that could travel beyond Amazon. Agent commerce must make the promise travel again, through software acting for the shopper. The companies that solve accountable delegation will shape commerce more than the companies that merely build the most fluent shopping agent.

At PayPal, where I work on AI personalization and agentic commerce, I see this as a systems design problem. Better models will expand what agents can understand, but durable adoption will come from the less theatrical work of permissions, identity, credentials, order state, and recourse. When those parts work, the agent fades into the background, which is exactly where trusted payment infrastructure belongs.

Sources and Notes

Amazon. Buy with Prime merchant overview and conversion methodology

Amazon. How Buy with Prime works

Amazon. Amazon’s new Buy for Me feature helps customers find and buy products from other brands’ sites

Google. Announcing Agent Payments Protocol

Visa. Trusted Agent Protocol

Mastercard. Mastercard unveils Agent Pay

Stripe. Developing an open standard for agentic commerce

OpenAI. Agentic Commerce Protocol

Views are the author’s own.

About Author:

Mitesh Shah is a product lead for AI personalization and agentic commerce at PayPal, where he works on AI-driven commerce, wallets, payments, and decisioning platforms. He has previously held product leadership roles at Amazon, Uber, and Block (Square).