Identity First, Money Later: The $0 GMV Problem at the Heart of Agentic Commerce

Hook

In March 2026, OpenAI — the shopping agent that had been demoed to death on every conference stage — went live with in-chat checkout across roughly a dozen Shopify merchants. The sales number came back at effectively zero. Not low. Zero. Within weeks the team had quietly retired the checkout flow and reverted to the thing they'd started with: a redirect back into the merchant's own app.

I didn't need a dashboard to understand what happened. I'd seen this failure mode before — not in an agent, but in a bridge. In 2022 I reverse-engineered the Wormhole Guardian set and found that the signature threshold was tuned for a transaction volume that never materialized, so the security assumptions were theoretical. Same shape here. The infrastructure was built for a flow nobody had validated end to end. Checkout was the throughput. The bottleneck wasn't the model. It wasn't the identity protocol. It was that nobody — not the merchant, not the payment network, not the AI provider — had agreed to own the loss when the agent bought the wrong thing.

Here's the number that should be stapled to every pitch deck in the sector: 93% of merchants say the AI provider should absorb the financial loss when an agent transacts incorrectly. Only 28% are willing to expose their full product catalog to agents. That 65-point gap is not a sentiment. It's a price. It's the market-clearing price of a liability layer that does not exist, and every protocol in this space has decided, rationally, to build everything except it.

Context

The industry has spent eighteen months shipping identity. Meta and Sierra shipped the Personal Agent Protocol — PAP — a specification for identifying, authenticating, and bounding the actions of a so-called Personal Agent against a merchant. Visa pushed the Trusted Agent Protocol — TAP — whose entire job is to emit a signal to the merchant that says, in effect, this transaction was initiated by an agent. Google rolled the Universal Commerce Protocol. Anthropic published a Claude Commerce Agents blueprint that keeps the model deliberately away from the checkout counter and the card number. And Stripe, working with OpenAI, shipped the Agentic Commerce Protocol — the only one of the group that actually touched money.

Read those five names again and notice what they have in common. PAP: identity and authorization. TAP: intent and signal. UCP: identity, intent, signal. Claude Commerce: a blueprint for what the model may and may not do. Even the one payment-layer entry, Stripe/OpenAI, constrains itself with a Shared Payment Token that binds authorization to a specific merchant and a specific cart total — which is a limit, but it is also a liability firewall. It says: we will let this transaction happen, and we will let it happen only inside a box small enough that our exposure is bounded.

Every one of these protocols occupies the gate. None of them occupies the till. And critically, none of them occupies the room behind the till, where disputes get adjudicated and losses get assigned.

This is the standard framing of the agentic commerce stack. Identity layer: who represents the consumer. Payment layer: how the authorization completes. Liability layer: who eats the loss when the agent buys wrong. The first two are being built in public, at speed, by the largest companies in technology and payments. The third is being built by no one, at any speed, and the silence around it is the loudest signal in the sector.

I have audited token distribution logic, lending protocol interest-rate math, bridge validator thresholds, NFT minting infrastructure, and the tokenomics of three separate "AI x Crypto" protocols. I have learned that the honest way to read an industry is not to read its announcements but to read the layer it refuses to build. Announcements tell you where the capital is. Refusals tell you where the risk is. In agentic commerce, the refusal is total and it is coordinated, and it is the single most important fact about the sector right now.

Core

The layering is not an architecture. It's a queue for avoiding blame.

Start with what each protocol actually does at the byte level, because the marketing is doing a lot of work that the specifications cannot support.

PAP is, stripped of its framing, an OAuth-adjacent extension. It defines a way for an enterprise to recognize an agent's identity and to scope what that agent is permitted to do. If you have ever implemented OAuth scopes or an SSO handshake, you already understand PAP's shape: a token, a set of claims, an authorization boundary, a relying party that checks the claims. This is mature Web2 technology wearing a new jacket. It is not a paradigm shift. It is a scoped credential with an agent-shaped subject. I say this without contempt — OAuth is load-bearing infrastructure for half the internet — but the point is that PAP solves a problem that was already solved. It is the cheap layer.

TAP is even thinner. Its core function is to attach a signal to a transaction that says an agent initiated it. That is a flag. It is not a settlement mechanism, it is not an arbitration mechanism, and by design it does not reassign the liability for a non-fraudulent error. Visa is explicit about the boundary: TAP tells the merchant an agent is transacting. It does not tell the merchant who pays when the agent transacts incorrectly. Those are different questions and only one of them has an answer.

UCP bundles identity, intent, and signal into a Google-shaped loop that terminates in search. It is a distribution play wearing a protocol costume.

The Claude Commerce blueprint is the most honest of the set, because it is explicit about abstention. The model does not touch the checkout counter. The model does not see the card number. This is framed as a safety property, and it is — but read it again as a liability posture and it says: we will not be in the room where the loss is booked. That's not a criticism. It's an accurate description of what a blueprint is for. A blueprint that keeps you away from the money is a blueprint that keeps you away from the liability.

Then there is Stripe/OpenAI. The only one that shipped money. And the only one whose failure is empirically documented.

The one that shipped money, and the number it shipped

OpenAI's in-chat checkout launched in March 2026 across roughly a dozen Shopify merchants. The reported sales figure was near zero. The team reverted to an app redirect. I want to be careful here, because a single case does not make a law, and because the sales number itself — attributed to Rye, dated March 5 — deserves independent verification before anyone builds a thesis on it. But the direction of the result is consistent with everything else in the stack, and the mechanism is not mysterious.

Here's the transaction sequence, decomposed the way I'd decompose a failing DeFi interaction:

1. A consumer's personal agent receives an intent — "buy the cheaper of these two."
2. The agent authenticates against the merchant via an identity protocol. Gate opens. Cheap step. Fast step. Works.
3. The agent constructs a purchase against a Shared Payment Token scoped to that merchant and that cart total.
4. The agent executes.
5. The agent buys the wrong thing — wrong size, wrong variant, wrong quantity, wrong merchant, wrong moment.
6. The transaction enters a state with no defined handler.

Step six is the whole article. In a lending protocol, step six would be a reverting transaction — the state never commits, the funds never move, the ledger stays consistent. In agentic commerce, step six is a committed transaction with an undefined owner. The money moved. The good shipped. Someone is unhappy. And there is no code path — not in PAP, not in TAP, not in UCP, not in the Stripe token — that says what happens next.

This is why the checkout flow died. Not because agents couldn't transact. Because agents could transact and there was no recourse when they transacted wrong, and merchants priced that absence into their willingness to participate, and the willingness collapsed.

A payment rail that cannot assign error is not a payment rail. It is a bet that error won't happen, and markets do not scale bets like that.

The 93/28 contradiction is a structural deadlock, not a temporary state

93% of merchants want the AI provider to carry the financial loss on incorrect agent transactions. 28% will open their full catalog. Read those two numbers as a system and you get the exact behavior of a party that wants the upside of agent commerce without the downside of agent error. That is not irrationality. It is the most rational posture available when the loss-assignment layer is empty.

Consider the merchant's actual decision. Open the full catalog and you capture agent-driven demand. Open the full catalog and you also accept that some fraction of agent transactions will be wrong, and that you — not the AI provider, not the payment network, not the consumer — will absorb the return, the restocking, the fraud exposure, and the reputational drag. The 28% who open fully are the ones whose margins and return policies can eat that. The 72% who don't are the ones who have correctly computed that, absent a liability layer, the expected value of opening is negative.

Now consider the AI provider's decision. Accept liability for agent error and you take on an unbounded, adversarial, hard-to-model exposure — the worst kind of risk. Don't accept it and you cap your addressable market at the 28%. Every provider is choosing the cap. Every provider is choosing the cap because accepting the exposure without a settlement mechanism to price and hedge it is a way to go bankrupt.

Now consider the payment network's decision. Visa built TAP to emit a signal. A signal is exactly enough to manage the fraud question — is this really the consumer? — and exactly not enough to manage the error question — who pays when the consumer's agent was authorized but wrong. Chargeback regimes were designed for human cardholders disputing human-initiated charges. An agent is a non-human initiator with a non-human authorization trail, and the chargeback rules simply do not have a slot for it. Visa is managing its own exposure by keeping agents inside the existing fraud model and outside the existing error model, and TAP's signal layer is precisely the mechanism that lets it do so.

Everyone is behaving rationally. Everyone is standing on the layer where they do not pay for mistakes. And so the layer where mistakes get paid for is empty, and stays empty, because occupying it is the one move that is irrational for any single player.

I have written before that complexity is often a cover for insecurity. This is the inverse. Here, the simplicity of the identity layer is the cover. Identity is easy, so everyone built identity. Liability is hard, so no one built liability. And the sector has managed to make an empty layer look like a full stack by shipping the easy layer loudly and the hard layer never.

What Stripe/OpenAI actually got right, and why it still wasn't enough

The Shared Payment Token deserves more credit than the sector gave it, and more scrutiny than the sector applied. Mechanically, it scopes payment authorization to a specific merchant and a specific cart total, without sharing the raw card number. This is a genuinely good primitive. It is least-privilege for money. It bounds the blast radius of a compromised or malfunctioning agent to a single merchant and a single basket. If you think about it as an authorization scope, it's the monetary equivalent of a narrowly-scoped OAuth token, and it is the correct instinct.

But notice what it does not do. It bounds the amount. It does not assign the error. A scoped token that says "this agent may spend up to X at merchant Y" is silent on the question of what happens when the agent spends X at merchant Y on the wrong thing. The token solved the authorization problem and left the liability problem exactly where it found it. That's why the checkout flow could be technically correct and commercially dead: it was a perfect rail with no court at the end of it.

The deeper lesson, and the one the sector keeps failing to internalize, is this: payment access is not payment responsibility. You can wire an agent to a card. You can wire an agent to a token. You can wire an agent to a bank. None of that tells you who is accountable when the wire carries the wrong instruction. Stripe and OpenAI proved you could build the wire. They also, inadvertently, proved that the wire alone is not the product.

The fragmentation tax nobody is pricing

There are at least three parallel identity protocols — PAP, TAP, UCP — plus a blueprint and a payment-layer entry, and no open standards body unifying them. I have watched this movie before. In the early bridge era, every team shipped its own validator set and its own message format, and the result was a decade of interoperability debt that is still being paid down in exploits. Fragmented identity is the same disease in a different organ.

If agent identity fragments, the failure is not aesthetic. It is that no agent can be trusted across merchants without re-authenticating, which means the identity layer never becomes a public utility, which means it never achieves the network effects that would justify anyone building the liability layer on top of it. A fragmented identity layer is a liability layer that can never be built, because there's no stable substrate to build it on.

The optimistic read is that a FIDO-style consortium or a W3C community group steps in and unifies the identity protocols before fragmentation calcifies. The pessimistic read — and my priors lean here — is that Meta, Google, Visa, and Stripe each have a distribution reason to keep their protocol sovereign, and sovereign protocols don't merge. Standards bodies unify interests that are already aligned. These interests are not aligned. They are competing for the same gate.

Where the liability layer could have lived, and why it's empty

The liability layer needs three things to exist: an entity willing to hold the risk, a mechanism to price the risk, and a source of truth to adjudicate the risk. Look at the current stack and every one of those is missing.

The entity. No single player wants to be the tort-bearer. The merchant won't, because the loss is operationally theirs but not morally theirs. The AI provider won't, because the exposure is unbounded. The payment network won't, because it has spent fifty years building a fraud model and an error model that both assume a human cardholder. There is no insurer in the stack. There is no escrow in the stack. There is no reserve pool in the stack. There is nothing that says "this pot of capital absorbs agent error, and here is how it is priced."

The pricing mechanism. You cannot price a risk you cannot measure. Nobody has a clean dataset of agent error rates, because agent transaction volume is near zero, because the liability layer is empty, because nobody will open their catalog. It's a circular dependency: you need volume to price risk, you need priced risk to get volume. Somebody has to break the circle by eating unpriced risk at the start, and eating unpriced risk is exactly what no rational player will do.

The adjudication source. When the agent buys wrong, who decides whether it was the agent's fault, the merchant's fault, or the consumer's fault? There is no log of agent intent, no attestation of agent authorization, no verifiable record of what the consumer actually asked for. The current stack cannot even answer what happened, let alone who pays. That's the deepest part of the gap, and it's the part that maps most cleanly onto what blockchains are actually good at.

The Web3 affinity argument, stated honestly

I want to be careful here, because the reflexive move in this industry is to declare that every unsolved problem is a blockchain problem, and that reflex is usually wrong. So let me state the affinity narrowly and defensibly.

The liability layer needs three primitives: a verifiable identity that the subject controls, a verifiable record of authorized actions, and a programmable escrow that can hold and release funds against conditions. Decentralized identifiers and verifiable credentials are a native answer to the first. An append-only ledger is a native answer to the second. Smart-contract escrow with an arbitration condition is a native answer to the third. And an on-chain insurance pool with risk-based pricing is a native answer to the entity problem — it's a mechanism for a community to collectively bear a risk that no single player will bear alone.

That last point is the one I find most interesting and most under-discussed. The reason no single player occupies the liability layer is that the risk is too concentrated for any one balance sheet. But concentrated risk is exactly what a pool is for. If you can price agent error — even crudely, even initially — you can let a pool hold it, and a pool can hold a risk that a single firm cannot. The 93/28 deadlock is a deadlock of concentration. The escape hatch is diversification. And diversification across a permissionless pool of capital is a thing blockchains do natively.

Is this certain? No. I'd put it at medium confidence, and I'd want to see the pricing model before I believed it. But the shape of the gap — an unowned risk, an unmeasurable exposure, an adjudication vacuum — is unusually well-matched to what on-chain primitives can actually provide, and unusually poorly-matched to what a single centralized player can provide. That's not a slogan. That's an architectural observation, and it's the strongest form of the Web3 opportunity argument I can honestly make.

The thing the sector is calling a delay that is actually a decision

Every protocol in this space has a payment story that is "coming." PAP commits to a v0.1 spec plus design workshops plus a reference implementation, with the payment extension described vaguely and scheduled loosely. TAP is a signal and stays a signal. UCP is a loop that terminates in Google's search economics. Claude abstains from the counter by design. Stripe/OpenAI shipped and retreated.

Read that as a queue and you get a comfortable story: the money layer is next, it's just not here yet. Read it as a set of choices and you get a colder story: every one of these players has looked at the liability layer and decided, individually and correctly, not to stand on it. The "coming soon" on the payment extension is not a schedule. It's a standoff.

I have spent a lot of my career reading specifications for the thing they omit. In 2017 I audited a token distribution against its GitHub repo and found five arithmetic overflows the team had not fixed — not because they were hidden, but because nobody had looked. The omission was the finding. Here, the omission is not an overflow in a contract. It's an overflow in a business model. The stack does not define what happens on error, and the absence is not an oversight. It is the load-bearing feature that lets every player stand on the layer where they don't pay.

Contrarian

Now the part where I have to be fair, because being a cold dissector means dissecting the bulls honestly too, and the bulls have one real point.

Identity first is not a mistake. It is the correct sequence, and I'll defend it. You cannot authorize what you cannot identify. You cannot scope what you cannot authenticate. You cannot audit a transaction you cannot attribute to an agent in the first place. The identity layer is a genuine prerequisite for the liability layer, and building it first is the right engineering order, not a dodge. PAP, TAP, and UCP are building the substrate that any future liability mechanism will have to stand on, and the sector is right to build it.

The second bull point is sharper: the gate is a real business. Whoever controls which agent is recognized by which merchant controls the entry point to the entire flow. That is not a cheap position just because it's the easy one to build. Distribution is worth more than infrastructure in almost every technology transition, and the gate is distribution. Meta and Google are not naive to be here. They are exactly where the strategic value sits.

The third bull point is the one I have to concede most fully: the OpenAI failure might be early, not fatal. Rye's figure is a single data point. A single merchant cohort is not a market. The 28% who open fully might be the seed of a flywheel, and the 93% who demand liability might soften as error rates turn out to be lower than feared. If agent error rates are 0.1% and not 5%, the liability layer is a rounding error and the whole deadlock dissolves on its own. I cannot rule that out. I can only note that the sector has not produced the data to rule it in, and that building the gate before knowing the error rate is a bet, not a plan.

But here is where the bulls' own logic turns on them. If the gate is the value, then the gate is also the chokepoint, and a chokepoint with no court behind it is a chokepoint that merchants will route around. The OpenAI retreat is not evidence that agents can't shop. It's evidence that a gate with no liability layer is a gate merchants won't walk through. The bulls are right that identity is the substrate. They are wrong that identity is the product. The product is the settled transaction, and the settled transaction requires the layer they're all deferring.

And a final contrarian note on the "AI x Crypto" overlap, because I have audited this exact space and I know how the pitch goes. When I pulled Dune data on three major AI-crypto protocols launching into the 2025 regulatory tightening, I found that roughly 80% of the claimed "AI compute usage" was basic API calls — a thin wrapper on a centralized endpoint, marketed as decentralized inference. The token price, in each case, correlated with the revelation, not the announcement. The lesson generalizes: in agentic commerce, the protocol that claims a liability layer and the protocol that can prove one are different things, and the market will eventually price the difference. The Web3 opportunity I described above is real, but it will be claimed by a dozen projects that cannot actually adjudicate an error, and the on-chain data — the escrow releases, the arbitration outcomes, the pool drawdowns — will be what separates them. I'll be reading those, not the whitepapers.

Takeaway

The identity layer is built and it works. The money layer is built once and it failed, and the failure was not technical. The liability layer is empty, and it is empty because every player on every other layer is behaving rationally by refusing to stand on it.

So the question for the next twelve months is not whether agents will shop. They will. The question is who — which entity, which pool, which contract — will sign the check when the agent buys wrong, and how the market will price that signature. If no one signs, the 28% stays at 28%, the OpenAI retreat becomes the sector's resting state, and the whole stack stays a beautiful gate with nothing behind it. If someone signs — and signs it with a verifiable record and a priced reserve — they don't just unlock a liability layer. They unlock every layer above it.

The gate is crowded. The court is empty. Watch who walks in, and watch what they bring to price the risk. That is where this sector's next real value gets created, and it will not be announced. It will be settled.

This analysis is based on public information and is not investment advice. Crypto assets carry extreme risk, including total loss of principal. Several key figures referenced — including merchant survey data and the OpenAI sales figure attributed to Rye, dated March 5 — require independent verification. The protocols and companies discussed have not been independently audited for this piece. DYOR.