Part 1 of this series mapped the protocols: the Agentic Commerce Protocol from OpenAI and Stripe, Google's Universal Commerce Protocol and Agent Payments Protocol, Anthropic's Model Context Protocol, and the trust frameworks the card networks are building around them. A protocol map tells you what the standards are. It does not tell you what happens when a person actually buys something.
This post does. We follow a single purchase from the moment a shopper speaks to an assistant until a parcel arrives, stopping at every component on the way. The agentic stack is not one system. It is roughly a dozen of them, owned by different companies, connected by the protocols from Part 1, and each has a job, a handoff, and a way to fail. A merchant accepting agentic orders has to understand the whole chain, because a break anywhere in it looks, to the shopper, like the merchant's fault.
The example: a shopper types into an AI assistant, "I need trail running shoes for wide feet, under 140 dollars, that can arrive before Saturday." Here is what that one sentence sets off.
Where this capability came from
Buying inside a chat interface is recent. OpenAI shipped Instant Checkout in ChatGPT in September 2025, built on the Agentic Commerce Protocol with Stripe, starting with Etsy sellers and expanding toward Shopify's merchant base. Google announced its Universal Commerce Protocol at NRF in January 2026 with Shopify and a long list of retailers and networks behind it. Inside roughly a year, the buy button moved off the storefront and into the assistant.
Most of the mechanics borrowed from things that already existed: the product feed from the shopping feeds merchants have sent to Google for years, the payment token from the network tokenization that has protected card numbers in digital wallets since the mid 2010s, the checkout API from headless commerce APIs a decade old. What is new is the orchestration, an AI assistant standing where the shopper's browser used to stand and talking to the merchant through protocols without a human clicking anything. The pieces are familiar. The conductor is not.
The purchase, component by component
1. The instruction and the assistant
The chain starts with the shopper's sentence and the assistant that receives it. The assistant's first job is interpretation: parse "wide feet" as a fit attribute, "under 140 dollars" as a price ceiling, "before Saturday" as a delivery deadline, "trail running" as a category. This is ordinary language model work, and it is the first failure point. If the assistant misreads the budget or the deadline, every later step inherits the error, because nothing downstream re-checks intent.
What can go wrong: misinterpretation. The merchant cannot prevent it and is not liable for it, but feels it anyway, because a shopper who gets the wrong thing rarely blames the assistant.
2. Product discovery and the merchant feed
The assistant now needs candidate products, and it does not crawl the open web for this. It queries a structured product feed that merchants submit directly. Under the Agentic Commerce Protocol the merchant pushes a feed over encrypted HTTPS to an OpenAI endpoint. The feed carries the fields an agent needs to reason: product ID, title, description, price, sale price, inventory level, images, brand, and merchant policies. OpenAI's feed spec also defines fields like enable_search and enable_checkout that control whether an item is discoverable and buyable, plus performance signals such as a popularity score and a return rate.
Two things about this feed decide whether our shopper ever sees a given merchant's shoes. First, freshness. The ChatGPT feed accepts updates as often as every 15 minutes, so price and stock can be near real time; a merchant feeding stale data gets recommended for shoes that are sold out, then has to cancel, which the assistant remembers. Second, structure. "Wide feet" only filters correctly if the catalog carries a width attribute; a feed that lacks it is invisible to that query. This is the practical core of agent-readiness, and surveys through early 2026 suggested a large share of retailers had not finished the work.
What can go wrong: the merchant is not in the feed, the feed is stale, or the catalog lacks the attribute the query needs. All three end the same way: the merchant is simply not considered.
3. Ranking and selection
Several merchants match. The assistant now ranks them, and this is where the agentic channel diverges hardest from the old storefront. A human browsing weighs brand, photography, reviews, and design. An agent weighs delivered value: price against the ceiling, genuine availability, delivery speed against the Saturday deadline, and return terms. McKinsey's October 2025 research on agentic commerce is blunt that agents optimize for delivered outcomes, and it sizes the channel at 3 trillion to 5 trillion dollars in orchestrated retail revenue globally by 2030. The merchant with clean stock data, an honest delivery estimate, and a clear return policy becomes a default supplier. The merchant with "ships in 3 to 5 business days" and vague stock loses to one that can promise Friday.
What can go wrong: the merchant is outranked on data quality, not product quality, and a better product still loses if its operational data is worse.
4. Cart construction and the checkout session
The shopper picks a pair. Now the assistant stops guessing and talks to the merchant directly. Under the Agentic Commerce Protocol it opens a checkout session, a call to the merchant's checkout_sessions endpoint with the item and quantity. The merchant, not the assistant, owns every number from here. It returns a session ID, the line items with prices, applicable discounts, tax calculated for the shopper's address, and the fulfillment options with their costs and delivery estimates. As the shopper adjusts the address, shipping speed, or quantity, the assistant calls the session again and the merchant returns fresh totals.
The assistant presents the cart; the merchant computes it. Tax, shipping cost, discount eligibility, and the real delivery date are all the merchant's outputs, because only the merchant's systems know them. The protocol is a thin pipe over commerce logic the merchant already runs.
What can go wrong: the merchant's pricing or tax service is slow or errors, and the session stalls or shows a number that will not match the final order.
5. Payment authorization and the agent credential
The cart is correct. Time to pay, the part with the most new machinery, because the shopper's real card number must never reach the assistant.
The shopper authorized payment earlier, when they connected a payment method to the assistant. That authorization is held as a scoped credential, not a card number. Stripe's Shared Payment Token is one implementation: a limited-use token, scoped to a specific merchant, capped to a specific amount, with an expiry, that the assistant hands the merchant to complete one purchase and nothing else, with an agentic network token from Visa or Mastercard provisioned behind it. Google's Agent Payments Protocol formalizes the same idea as cryptographically signed Mandates that record the rules the shopper set, their approval of one cart, and the resulting transaction. Mastercard and Google's Verifiable Intent framework adds a biometric step, often a passkey. The common thread: the assistant never holds raw credentials. It holds a grant.
To complete the purchase the assistant calls the merchant's session complete endpoint with the payment token and billing details. The merchant runs that token through the payment service provider it already uses, and accepting agentic payments does not require switching processors.
What can go wrong: the token is expired, scoped to the wrong amount, or declined, and the authorization fails cleanly, which is the system working. The harder problem is a token that authorizes correctly for a purchase the shopper did not really intend, which leads to the trust layer.
6. Fraud and trust checks
Before and during payment, the merchant has to answer a question that barely existed a few years ago: is this agent legitimate, and is it genuinely authorized. Merchant sites are crawled constantly by bots that scrape prices, test stolen cards, and hoard inventory, and a legitimate shopping agent and a malicious one can look identical at the network layer. Visa's Trusted Agent Protocol, introduced in October 2025 with Cloudflare, lets agents present cryptographic signatures that merchants or their content delivery network validate against a registry of approved agents. It carries signals for agent intent and for whether the shopper is a recognized returning customer, and it builds on Web Bot Auth, the emerging standard for agent verification. This reframes fraud detection: the old signals were browser fingerprints and device history, and the new ones are agent identity, the scope of the permission granted, the spend limit attached, and whether the transaction stayed inside that scope.
But here is the part merchants must not miss. The merchant remains the merchant of record. In the Agentic Commerce Protocol and the other live protocols, OpenAI and Google are not; the merchant processes the payment, owns the order, issues refunds, and absorbs chargebacks and fraud loss. Under the card networks' current rules a disputed agentic purchase is still, in most cases, an ordinary card-not-present transaction governed by a dispute framework written for human intent. Trust protocols may eventually earn a verified mandate its own liability treatment, but a merchant accepting agentic orders today should assume it carries the disputes.
What can go wrong: a fraudulent agent passes a check, or a real shopper disputes a real agent purchase, and the merchant eats it. Agent verification reduces the first risk, not the second.
7. Order acceptance
The merchant now makes a decision the protocol explicitly leaves to it: accept the order or decline it. The complete call is a request, not a command. The merchant validates stock one final time, runs its fraud rules, confirms it can hit the delivery promise, then creates the order and confirms back with an order ID and a permalink.
This is the merchant's last clean exit. Accepting an order it cannot fulfill converts a checkout into a cancellation, a refund, and a black mark in the assistant's memory. The failure mode is a merchant that rubber-stamps acceptance and skips the final check.
8. Fulfillment
From here it looks almost like a normal order, with one difference: the assistant is watching. The order flows into the merchant's order management system, which decides where to source each item, routes it, and hands it to a carrier. The agentic channel raises the stakes because the delivery date was not decorative. The assistant promised Saturday on the strength of the merchant's own fulfillment data, and if the parcel slips, the agent recorded the promise and weighs the miss next time it ranks this merchant. Fulfillment reliability is now a ranking signal.
What can go wrong: the order sources from a location that turns out short, splits into slow shipments, or misses the carrier cutoff. The Saturday promise breaks.
9. Post-purchase
The purchase is not finished when the box ships. The merchant emits order lifecycle events back to the assistant by webhook: order created, updated, shipped, delivered, returned, refunded. The Universal Commerce Protocol covers this post-purchase span explicitly, where the Agentic Commerce Protocol concentrates on checkout. These events keep the assistant in sync, so the shopper can ask "where is my order" and get a true answer, and a return flows back through the same channel. Returns matter doubly, because reversibility is one of the things an agent weighs when it ranks merchants in the first place.
What can go wrong: the merchant skips the webhook events, the assistant goes blind, and the shopper's follow-up questions get stale answers blamed on the merchant.
What a merchant actually needs in place
Trace those nine steps and the merchant's checklist falls out of them. A structured, attribute-rich product feed, refreshed fast. Accurate, near real time inventory, because the feed and the order acceptance step both depend on it. A checkout API exposing real pricing, tax, and fulfillment logic, on the Agentic Commerce Protocol, the Universal Commerce Protocol, or both. A payment setup that accepts scoped agent tokens through the merchant's existing processor. Agent verification at the edge. An order management system that makes honest delivery promises and keeps them. Webhook plumbing to report order status back. And a clear-eyed view of the economics: the merchant stays merchant of record and carries the disputes, and the channel is not free. OpenAI charges Shopify merchants a 4 percent fee on purchases completed through Instant Checkout.
The strategy is still moving under the merchant's feet. In early 2026 OpenAI shifted Instant Checkout toward merchant-run apps inside ChatGPT rather than purchases completed in the chat response, after merchants and Shopify pressed to keep control of checkout, tax, shipping, and their transaction data. The direction of agentic commerce is set. The exact shape of the checkout is not.
The point of the walk-through
The takeaway is the structure itself. An agentic purchase is not a feature a merchant switches on. It is a chain of about a dozen handoffs; the shopper sees one sentence and one parcel, and the merchant has to make every link between them hold. The merchants that win this channel are not the ones with the best storefront. They are the ones whose data, payments, and fulfillment are clean enough that an agent can trust the promise and complete the sale.
Council summary
This post argues that an agentic purchase is not a switch a merchant flips but a chain of roughly a dozen handoffs, and that the merchant carries the consequences of a break at any link. The review verified every named protocol, product, company, and date against primary sources: OpenAI's Instant Checkout (September 2025), Google's Universal Commerce Protocol from NRF in January 2026, Visa's Trusted Agent Protocol (October 2025), the Mastercard and Google Verifiable Intent framework, and Stripe's Shared Payment Token all hold up. One figure was sharpened, replacing a vague "trillions" with McKinsey's October 2025 estimate of 3 trillion to 5 trillion dollars in orchestrated retail revenue globally by 2030. The reader takeaway is concrete: clean feed data, accurate inventory, scoped payment tokens, agent verification, and reliable fulfillment decide who wins this channel, because the assistant keeps score and the merchant stays merchant of record.
Comments