AI agents placed real purchase orders last holiday season. AI traffic to U.S. retail sites grew 693% year-over-year during the 2025 holiday season (Adobe Digital Insights, January 2026). Most of those sessions ended without a completed transaction, because the checkout infrastructure those agents hit was built for humans. Authentication logic, 3DS challenge flows, fraud rules: all of it assumes a person is present. That assumption is now a revenue problem.
This post covers what merchants with significant payment volume can actually verify today when an AI agent initiates a transaction, how AI in payment orchestration maps to the authentication frameworks Visa and Mastercard have shipped, and where the gaps still sit. There are no speculative standards here, only what exists, what is deployable, and what we see from Yuno's position in the orchestration layer.
Key Takeaways
- AI agents cannot complete standard 3DS cardholder challenges, making orchestration-layer exemption routing essential for agent-initiated transactions to authorize.
- Visa's Trusted Agent Protocol and Mastercard's Verifiable Intent framework both bind agent credentials cryptographically to consumer consent; merchant readiness for these signals varies widely today.
- FIDO Alliance launched a dedicated Agentic Authentication Working Group in April 2026, signaling that interoperable standards are 12 to 18 months away from broad merchant applicability.
- Merchants can enforce agent-specific controls today at the orchestration layer: velocity rules, category limits, and conditional 3DS routing applied before a transaction reaches any acquirer.
- AI in payment orchestration means the routing decision layer is the only neutral place to apply consistent authentication logic across all PSPs simultaneously, without rebuilding checkout.
Why Standard Checkout Breaks When an Agent Is the Buyer
AI agents fail standard checkout flows because those flows require a human to take an action, confirm intent, or complete a challenge in real time. The agent has the card credential. It does not have the ability to pick up a phone, read a one-time passcode, or respond to a 3DS challenge screen.
We see this pattern consistently across enterprise merchants on Yuno's platform who have begun receiving agent-originated traffic. The transaction reaches the 3DS step, the challenge triggers, and the agent abandons. From the acquirer's perspective, it looks like drop-off. From the merchant's perspective, it looks like a failed payment. The underlying cause is an authentication architecture that was never designed for non-human initiators.
The practical consequence is asymmetric. Tighten authentication, and agent purchases never complete. Loosen it, and fraud rules designed for human behavior cannot catch the anomalies that agent-pattern transactions produce. Merchants caught between those two outcomes are, right now, effectively blocking an entire purchase channel.
What Visa and Mastercard Have Already Shipped
Both major card networks have moved from concept to deployable infrastructure for agent-initiated transactions. Merchants with compatible acceptance stacks can access these signals today.
Visa's response is Visa Intelligent Commerce, which includes a Trusted Agent Protocol. The protocol attaches verifiable agent credentials to a transaction at the point of initiation. An authorized agent carries a cryptographic token that identifies it as acting within a consumer's defined permissions. Merchants and issuers reading that signal can distinguish a permissioned agent purchase from an unauthorized transaction (Visa, October 2026).
Mastercard went further with its Verifiable Intent framework, co-developed with Google and published in March 2026. The premise is that consumer consent needs to be provable, not assumed. When a consumer instructs an AI agent to buy something, Verifiable Intent captures that instruction as a standards-based attestation. That attestation travels with the transaction through the authorization chain (Mastercard, March 2026). Separately, Mastercard's Agentic Token Framework, announced in late 2025 and integrated into Fiserv's merchant acceptance infrastructure in early 2026, creates agent-specific tokens distinct from cardholder tokens, so agent spend can be tracked and controlled independently.
These frameworks do not eliminate the authentication problem by themselves. They provide the signal. The merchant's payment stack needs to be capable of reading it, enforcing rules against it, and routing accordingly. That capability lives at the orchestration layer.
How AI in Payment Orchestration Addresses the Agent Authentication Gap
AI in payment orchestration closes the agent authentication gap by applying consistent rules across every PSP simultaneously, without requiring the merchant to rebuild individual integrations. This is the structural reason orchestration is the right place to handle agent verification logic.
Consider what happens if a merchant tries to solve this PSP by PSP. Each provider has its own API for exemption handling, its own 3DS configuration, its own risk rule syntax. A merchant with four active acquirers would need to replicate agent-specific logic four times, then maintain consistency across all four as the standards evolve. That is not a payments strategy. That is engineering debt.
At the orchestration layer, the logic sits once. When Yuno routes a transaction, every rule applied at that layer applies regardless of which acquirer ultimately receives the authorization request. That means agent-specific 3DS exemption routing, velocity controls, and credential validation rules all operate from a single configuration point. Updates to those rules propagate across the entire PSP estate immediately.
In our integrations across enterprise retail and platform merchants, the pattern that works today looks like this: the orchestration layer interrogates the transaction for agent-origin signals, routes it to a frictionless 3DS path if those signals match a pre-defined trust profile, and applies tighter fraud scoring if they do not. The merchant defines the trust profile once. The orchestration layer enforces it everywhere. For merchants exploring how this connects to active AI shopping channels, the authentication logic and the commerce activation sit on the same stack.
What Merchants Can Actually Verify Right Now
Today's verifiable signals for AI agent transactions fall into three categories: token-bound credentials, behavioral pattern matching, and network-level attestations. Each has different maturity and coverage.
Token-bound credentials are the most mature. Mastercard's Agent Pay and Visa's Trusted Agent Protocol both produce agent-specific tokens. Merchants integrated with compatible acceptance infrastructure can receive these tokens and apply rules based on them. Coverage is partial: not every issuer passes the full credential chain, and not every acquirer surfaces it in authorization response data today.
Behavioral pattern matching is available now through Risk Conditions at the orchestration layer. Agent transactions have distinct signatures: consistent device fingerprints, velocity patterns that differ from human browsing, absence of behavioral mouse-movement or session-duration signals. Merchants can build risk rules that flag or approve based on these patterns without waiting for any standard to finalize. Yuno's Risk Conditions module supports this configuration today, and we have seen it reduce fraud on agent-pattern transactions by meaningful margins in early deployments, consistent with the 29% fraud reduction Yuno platform data shows across Risk Conditions use cases (Yuno product data, 2026).
Network-level attestations are the least mature for broad merchant use. FIDO Alliance announced its Agentic Authentication Working Group in April 2026, with a mandate to build interoperable specifications for agent interactions across commerce contexts (FIDO Alliance, April 2026). That work is in progress. Merchants should watch for FIDO-compatible agent credential formats in 2027, but building a blocking dependency on those specifications today would be premature.
The practical verification stack for a merchant ready to accept agent transactions today combines all three layers: token checks where available, behavioral rules at the orchestration layer, and 3DS exemption routing for agent-eligible transactions. The goal is keeping legitimate agent purchases authorized while maintaining fraud controls that do not rely on human behavioral signals that agents will never produce.
The 3DS Question Every CTO Should Ask Their Platform
Standard 3DS challenge flows will decline AI agent purchases every time, because agents cannot complete cardholder authentication steps. The right question is whether your orchestration layer can route agent transactions through frictionless exemption paths before a challenge triggers.
PSD2 and SCA rules in Europe create a specific version of this problem. SCA requires strong customer authentication on in-scope transactions. Frictionless 3DS satisfies SCA when the issuer grants a frictionless outcome, but the merchant's system needs to request authentication correctly and carry the right transaction data for the issuer to make that determination. Agent transactions that arrive without correct context get challenged. Challenged transactions do not complete.
Yuno's native 3DS module applies custom exemption logic based on transaction context, risk score, and geography. For agent-initiated transactions, merchants can configure routing rules that request frictionless paths for transactions carrying recognized agent credential signals. This does not bypass SCA. It routes transactions correctly so the issuer can grant frictionless outcomes where the risk profile supports it.
The alternative, applying 3DS indiscriminately to all agent traffic and accepting the decline rate, costs the merchant the entire AI purchase channel. Given that Gartner projects 20% of digital commerce transactions will be executed via AI platforms by 2030 (Gartner, 2025), the cost of that default increases compounding every quarter.
Where Standards Are Heading and Why Merchants Should Not Wait
The industry is converging on interoperable agent authentication standards, but convergence is 12 to 18 months from broad merchant applicability. Merchants who wait for complete standards before activating agent payment flows will enter the channel late, at higher cost, with lower customer capture.
Bain forecasts U.S. agentic commerce at $300 to $500 billion by 2030, representing 15 to 25% of total eCommerce (Bain and Company). That revenue does not materialize at a single moment in 2030. It builds incrementally as agents move from browsing to purchasing, starting now. Merchants already operational in agent channels are accumulating transaction history, building issuer trust profiles for their agent tokens, and refining risk rules against real data. Late entrants start that process from scratch.
From our work with enterprise platform merchants, the readiness gap is rarely technical. The infrastructure to accept agent payments, route them correctly, and apply appropriate fraud controls exists today on a modern orchestration stack. The gap is organizational: payment teams waiting for a security team sign-off that requires a finalized standard, engineering teams that have not been asked to build the configuration yet, product teams that have not prioritized the channel because internal traffic data does not yet show agent volume. That last point is circular. Agent volume does not appear in internal data until the merchant activates the channel.
The practical first step is an audit of existing authentication and routing configuration against agent-transaction requirements. That audit does not require a new integration or a policy decision on which agent standard to back. It requires understanding whether your current stack can route a non-human-initiated transaction through a frictionless authentication path without declining it or triggering a challenge the agent cannot complete. If you want context on the broader infrastructure questions this unlocks, the merchant checklist for accepting AI agent payments covers the pre-activation review in detail.
What Yuno Provides at the Orchestration Layer Today
Yuno's role in agent payment authentication is at the decision layer, not the credential layer. The credential frameworks belong to Visa, Mastercard, and eventually FIDO. The routing, rule enforcement, and 3DS logic that determines whether a credentialed agent transaction actually authorizes: that is the orchestration layer's job.
Concretely, what Yuno provides today for agent-initiated transactions includes the following capabilities.
- Conditional 3DS routing that sends agent-origin transactions to frictionless paths, configured by risk profile and geography, without requiring a separate integration per acquirer.
- Risk Conditions that apply agent-behavioral rules (velocity, device pattern, session characteristics) at the orchestration layer before authorization, producing a consistent risk signal across every PSP in the merchant's stack.
- Smart Routing that selects the acquirer most likely to authorize a given agent transaction type, based on historical authorization data across the merchant's PSP estate. Enterprise merchants on Yuno's platform see an average 8% authorization rate uplift from smart routing (Yuno platform data, 2026).
- Agentic Commerce activation that connects the merchant's catalog directly to ChatGPT, Claude, Gemini, Perplexity, and Copilot through a single integration, so the purchase flow is native to the AI environment rather than redirected to a human checkout.
- Payment Concierge visibility that surfaces agent transaction performance separately from human transaction performance, so merchants can see authorization rates, decline codes, and routing outcomes for agent traffic in real time.
No single orchestration layer can solve the authentication problem alone. The card network frameworks, the FIDO standards in progress, and the issuer-side recognition of agent tokens all have to mature in parallel. What the orchestration layer can do is ensure that every signal that exists today reaches the right place in the authorization chain, and that every rule the merchant needs to enforce applies consistently regardless of which acquirer is in the path.
Merchants evaluating their readiness should start with the question their platform should be able to answer: can a transaction initiated by an AI agent, carrying a Mastercard or Visa agent token, route through a frictionless 3DS path and authorize without triggering a human challenge? If the answer is not a clear yes, the infrastructure gap is at the orchestration layer. That is a configuration problem, and on Yuno's platform it is solvable before the next major agent commerce wave arrives.
For context on how the broader agentic commerce infrastructure question maps to merchant-of-record and liability, the analysis of MOR and liability in agent transactions covers the questions that typically surface after the authentication layer is resolved.
