Agentic Authentication and Verifiable Intent: Trusting AI Transactions
Design authentication for AI-assisted transactions by separating customer identity, agent identity, delegated authority, purchase intent and payment.
By AUZtec Innovations
Agentic authentication is the process of proving not only who a customer is, but which AI agent is acting, what authority it received and whether the final transaction matches the customer’s intent. A normal login answers only the first of those questions.
For an AI-assisted purchase, trust must be bound to a specific action: seller, item, amount, currency, recurrence, delivery context and expiry. The payment credential should not become a reusable permission for an agent to make broadly similar decisions later.
Four identities exist in one transaction
Treat the parties separately:
- Customer: the person or organisation receiving the product and accepting the obligation.
- Agent: the software that researches, recommends or acts.
- Agent provider: the organisation operating or distributing that software.
- Merchant: the seller and its payment, fulfilment and support systems.
The agent may use the customer’s session, but it should still have an observable identity. Otherwise the merchant cannot distinguish a deliberate customer action from an automated or compromised tool.
Mastercard’s 2026 agentic-commerce vision includes a concept called Verifiable Intent, while the FIDO Alliance is bringing payment and authentication stakeholders together around agentic standards. These initiatives are developing; they should inform architecture without being represented as settled universal rules.
Separate delegation from confirmation
Delegation might allow an agent to:
- search within a budget;
- create a basket;
- reserve an available item;
- prepare a purchase for approval;
- complete a transaction below a defined threshold.
Express the permission in machine-readable claims with scope, limits and expiry. Require fresh customer confirmation when the agent changes a material attribute or encounters an exception.
A strong confirmation screen names the merchant, items, total, delivery, recurring terms and the fact that an agent prepared the action. Avoid generic prompts such as “Allow” that hide the consequence.
Bind evidence to the transaction
Create a signed or otherwise tamper-resistant record linking:
- authenticated customer;
- agent and provider identifiers;
- delegation and its expiry;
- offer and terms version;
- confirmed purchase intent;
- payment authorisation reference;
- merchant result and timestamp.
Do not put unnecessary personal or payment data into a general event stream. Store evidence according to a defined retention and access policy.
This is an extension of least-privilege identity for AI agents, not a replacement for it.
Design failure as carefully as success
Assume the agent sends a duplicate request, the price changes after recommendation, an item becomes unavailable, the user revokes delegation or the payment succeeds while order creation times out.
Use idempotency, short-lived offers, explicit state transitions and reconciliation. The customer should be able to see the authoritative order state without returning to the agent. Support staff need the same evidence and a safe reversal route.
Do not confuse passkeys with delegated authority
Passkeys can provide phishing-resistant customer authentication. They do not, by themselves, prove what an agent was allowed to buy. Use strong human authentication for enrolment and material confirmation, then a separate delegated token for bounded agent action.
Likewise, a payment-network token can protect account details without expressing why the purchase was authorised. Identity, intent and payment are complementary layers.
An implementation sequence
Start with agent-prepared baskets and human-confirmed checkout. Instrument this path to understand abandonment, changed offers and disputes. Next, introduce bounded delegation for a narrow, repeatable product with low exception cost.
Put the policy engine and transaction API behind a secure business integration. Test stolen tokens, altered parameters, replay, confused-deputy behaviour and agent-provider outages. Obtain payments and legal advice for the markets you serve.
Only then consider broader authority. Increase spending limit, product scope or duration one at a time, with a clear revocation control.
The commercial test
Agentic authentication is successful when it reduces friction without increasing ambiguity. Measure completion, confirmation failures, fraudulent or disputed transactions, exception handling time and customer understanding.
Our agentic commerce readiness guide covers the surrounding catalogue and checkout architecture. For a threat model and implementation plan spanning security and e-commerce, contact AUZtec Innovations.