What Businesses Need to Know to Support Trustworthy AI-Assisted Transactions
The building blocks of a reliable AI-powered purchase experience.
Chapter 4
Question: How do I know I can trust an AI agent acting on behalf of a customer?
This chapter of the Amex Business Playbook for Agentic Commerce includes contributions by Stripe subject matter experts.
When customers shop online today, the transaction is relatively straightforward. A person chooses a product, enters payment information, reviews the order, and decides whether to complete the purchase.
Agentic commerce introduces a new participant: an AI agent acting on a customer’s instructions. As these experiences evolve, customers may increasingly authorize AI agents to research products, compare options, assemble carts, and, in some cases, complete purchases on their behalf.
This is known as delegated authority, or permission for an AI agent to act within limits set by the customer. Those limits might include price, product category, payment preference, or whether the customer must approve the final purchase.
At this stage, merchants may not have full visibility into whether a transaction has come in through an AI agent or through other online searches. Whether a business can identify an AI-assisted transaction today will depend on the platform, payment flow, and providers involved. Businesses can prepare by understanding what information is currently available, and which providers can answer their questions.
Different providers may manage agent identification, customer authorization, payments, fraud prevention, and order information. Start by understanding what your business controls and where you rely on providers.
There are four basic questions businesses and their providers need to address to help support their customers while safeguarding their businesses:
- Which agent initiated the transaction?
- What did the customer authorize it to do?
- Did the purchase stay within those instructions?
- What happens if something goes wrong?
Welcome to the fourth chapter in our series on navigating agentic commerce. It’s one example of how American Express is backing businesses with practical insights, tools, and resources to help them prepare for what's next.
Summary: Four actions businesses can take now
New Amex Trendex research uncovered that fraud, privacy and security lead U.S. consumers’ concerns about allowing AI agents to complete purchases on their behalf. Fraud was selected among the top three concerns (34%), followed closely by data privacy (33%) and sharing payment credentials (31%).1
Disclosure: Amex Trendex figures are rounded for simplicity and ease of presentation.
1. Understand your role in building trust in agentic commerce. Identify what your business controls and where you rely on providers so responsibilities are clear before an issue arises.
2. Understand how your safeguards handle AI agents. Controls designed to block harmful bots may also encounter legitimate AI agents acting for customers. Understand who manages those controls, how they work today, and whether they need to change.
3. Ask your partners how they are preparing for agentic commerce. Understand how agent identity, authorization, fraud prevention, transaction records, and dispute support may be handled.
4. Prepare your customer service processes for AI-driven transactions. Make sure your business can support customers and respond clearly when a purchase does not go as expected.
"Trust is going to be the key," says Stefan Olofsson, Senior Vice President & General Manager, Amex Global Network & Products. "If you don't know who the agent is, who the customer behind it is, or where the transaction request came from, you have no visibility." That visibility can help businesses understand the transaction and support customers when questions arise.
Action 1: Understand your role in building trust in agentic commerce
Readiness question:
Do I know what my business is responsible for and where I rely on providers?
Your business will continue to manage areas such as its policies, fulfillment, customer service, and some checkout or fraud settings. Other parts of an AI-assisted transaction may depend on your payment processor, commerce platform, network, or other partners. Identify what your business manages and where it needs outside support.
"Businesses will want to know whether a Card Member delegated authority to an agent, and whether that authority was still valid at the time of transaction," says Mike Miller, Vice President of Global Rules & Standards at American Express. That information may not be available to the business directly today. The immediate priority is to identify which provider might hold it and where questions should be directed.
Businesses can direct questions first to the commerce and payment providers they already use rather than generally contacting AI platforms directly.
Map who manages each area
- Policies and fulfillment: Who sets and maintains return, cancellation, pricing, and fulfillment policies?
- Agent and authorization information: Start with your payment processor and commerce platform. Ask whether either identify that an agent was involved, what information may be available about the customer’s authorization, and who to contact if another provider holds that information?
- Checkout, payments, and fraud prevention: Which settings and controls does your business manage, and which are managed by your providers?
- Customer service and escalation: Who handles customer questions, and who contacts a provider when an issue cannot be resolved internally?
Action 2: Understand how your safeguards handle AI agents
Readiness question:
Do I know how my business currently handles fraud and bots, and which safeguards are managed by providers?
Businesses have historically treated bots and other automated online activity as a potential security risk. Agentic commerce complicates that assumption: some automated activity may come from a legitimate AI agent acting for a customer, while other activity may still be unauthorized or malicious.
"Trust is going to be the key,"says Stefan Olofsson, Senior Vice President & General Manager, Amex Global Network & Products. "If you don't know who the agent is, who the customer behind it is, or where the transaction request came from, you have no visibility."
Begin by identifying who controls them and how your current safeguards treat this activity. Your business may manage these safeguards directly, or they may be built into your website, commerce platform, fraud prevention service, or security provider.
The key is not to lower your defenses, but to understand how they work today so you can distinguish between unauthorized activity and customer-authorized AI agents.
"The thing merchants have been fighting for so long is now the thing they need to welcome in – or figure out how to welcome in," says Miller.
Review your current controls
- Who manages your fraud prevention and bot-management controls?
- When is bot or other automated activity blocked, allowed, or escalated?
- Can the appropriate team see why activity was flagged?
- Ask the provider managing these controls whether and how it is preparing for legitimate AI-agent activity.
Action 3: Ask your providers how they are preparing for agentic commerce
Readiness question:
Do I know what to ask the providers that support my business?
Action 1 helps identify where your business relies on providers. Once you’ve identified those providers, ask what they support today, what information may be available, and whether your business needs to make changes.
Whether a business can identify AI-assisted transactions will depend on the platform, payment flow, and provider involved. Focus first on the providers your business already uses, rather than contacting every AI platform directly.
Amex Trendex data revealed that 80% of U.S. merchants surveyed somewhat (43%) or strongly (37%) agree that payment companies and partners will need to play a larger advisory role in agentic commerce for their businesses to be successful.2
Identifying and Supporting AI-Assisted Transactions: Questions to Ask Your Providers |
|
Provider Category
|
Questions to Ask |
Payment processor, acquirer, payment provider or network
|
|
| Commerce platform, marketplace, checkout provider, or order-management provider |
|
| Fraud prevention, security, bot-management, hosting or commerce platform |
|
| Customer service, dispute management, or order-management provider |
|
The right questions will depend on the providers your business uses and the role each one plays. Not every provider will have answers today. Record the primary contact, what is available now, what is still being developed, and how the provider will communicate future updates.
Agentic commerce is still developing, and businesses may not need to act on every new capability or announcement. Assign a person or team to review relevant provider updates and determine whether they affect your business. Periodically review whether existing processes have changed and whether employees need updated guidance or training.
What American Express is Doing
Managing identity, authorization, fraud risk, and liability are of paramount importance for agentic commerce to be adopted broadly. American Express has the expertise to help support the next evolution of commerce—one that is not only intelligent, but trusted. The powerful combination of our Membership assets and closed-loop model makes us well positioned to help shape the next evolution of commerce.
The company has completed thousands of AI-assisted transactions through pilots with leading AI platform partners, helping inform how trusted transaction frameworks may evolve.
The Agentic Commerce Experiences (ACE)™ Developer Kit is a framework that intends to provide technical specifications to bring American Express-issued Cards and Membership value into AI-powered interactions with trust and control. It is designed to support capabilities including:
- Registering and verifying AI agents
- Enabling Card Members to register Cards for agentic transactions
- Capturing Card Member purchase intent to support authentication, authorization, and disputes
- Enabling verified agents to complete payments using tokenized credentials
- Using available cart details to support validation, authorization decisions, and dispute investigations
The ACE Developer Kit is also designed to work with existing and emerging agentic commerce protocols and standards. Some services and specifications remain under development.
American Express also made an industry-first announcement that we intend to launch Amex Agent Purchase Protection™ to protect eligible Card Members and Merchants from charges related to errors by registered AI agents (terms and conditions will apply).
What Amex Merchants need to know now: At this stage, Merchants do not need to make any updates to their Amex payment acceptance systems. Amex agentic tokens follow the same format as Card numbers. Meaning we expect that Merchants will be able to accept Amex transactions that come through registered agents when those agents implement our Amex payment protocols. Authorizations are submitted through existing authorization flows. Merchants should work with their payment processor to understand how transactions originating from agents may be identified.
Action 4: Prepare your customer service processes for AI-driven transactions
Readiness question:
If a customer questioned an AI-assisted purchase, would my business know how to respond?
Customers may still turn to the business when an AI-assisted purchase does not go as expected. Businesses and their customers also need confidence that they are both supported when something goes wrong.
According to the Amex Trendex, 60% of consumers surveyed are somewhat (32%) or strongly (28%) concerned they will not receive good customer service when an AI agent makes a purchase.1
Customers will still contact a business when a delivery is late, inventory is inaccurate, or a customer receives the wrong item, even if an AI agent helped initiate the purchase. New questions may also arise about what the customer authorized the agent to buy.
Businesses can prepare by reviewing customer service and dispute processes and updating them when a specific information gap, escalation need, or process change is identified. For example, if your payment provider introduces new transaction information or an escalation route, document where employees can find it and when to use it.
Review the process your business uses today
- Can my business locate the purchase and related customer service history?
- Can it confirm the order details and applicable policies?
- Does it know how to respond if a customer says a purchase was unauthorized or did not match expectations?
- Are contacts and escalation routes documented?
As these transactions develop, customer service teams may need additional information about agent involvement, customer authorization, and available transaction records.
Read the next article in this series: Stand Out When AI Narrows The Choices
The bottom line
Even as AI agents introduce a new way for customers to shop, the basic expectations for a transaction remain the same: customers want purchases to be secure and reflect what they asked for, while businesses need to know where to turn if something goes wrong.
Start with what you can control. Know who manages each part of the transaction, understand how your business handles fraud and bots, and make sure customer service teams know how to respond and escalate issues. Ask your providers what they will manage, what information may be available, and whether your business needs to make changes.
Frequently asked questions
Delegated authority is the permission a customer gives an AI agent to act on their behalf within defined limits. Those limits might include price, product category, payment method, timing, or whether the customer must approve the final purchase.
It depends on the platform, transaction flow, and providers involved. Ask the company that manages your online store, marketplace, or checkout, along with your payment processor, whether agent involvement can currently be identified and what information may appear in your systems.
No, not on its own. Payment processors, commerce platforms, identity and fraud prevention providers, and agent platforms may support different parts of agent identification and transaction authentication. Ask the providers your business already uses what they manage, what information may be available, and whether your current systems or controls need to change.
No. Some bots, or automated activity, may be malicious or unwanted, while a recognized AI agent may be acting on a customer’s instructions. Businesses should understand how their current safeguards handle bot activity and ask the providers managing those safeguards how they are preparing for legitimate agent activity.
Review the customer service and dispute processes you already use. Confirm the order details and applicable policies, determine whether the issue can be resolved internally, and escalate payment, authorization, fraud, or platform questions to the appropriate provider. Ask providers in advance what information and support may be available.
Map who manages your current payment, checkout, fraud prevention, customer service and dispute processes. Identify where ownership or escalation is unclear, then use those gaps to guide your conversations with your providers.
Additional Chapters
Research Methodology:
1 The Amex Trendex: Agentic Commerce Edition consumer survey is based on a sample of 2,005 U.S. adults age 18+ who have made an online purchase three or more times in the past 6 months based on self-report. The sample for the study came from an online panel. The anonymous survey was conducted online August 10-14, 2026.
2 The Amex Trendex: Agentic Commerce Edition merchant survey was conducted among a sample of 502 business leaders in the U.S. who have responsibility for making decisions regarding customer payment options or online sales/digital strategy and planning. Respondent companies accept online or mobile payments and are not franchisees. The sample for the study came from an online panel. The anonymous survey was conducted online August 10-18, 2026.