3. Standards bodies are involved. W3C and GS1 ran a two-day workshop in Zurich on September 8 and 9. Google and Mastercard donated AP2 and Verifiable Intent to the FIDO Alliance; Google donated A2A to the Linux Foundation. Voice commerce had no standards process — only Amazon's and Google's proprietary APIs.

4. Merchants are organizing on the record. The Merchant Advisory Group used its Zurich session to set conditions, warning that without them merchants are "exposed to risks they did not cause and have limited ability to identify or manage." The group proposes a liability waterfall placing responsibility on whoever controlled the failed function, and demands merchants keep the right to route their own payments. No equivalent merchant position paper existed for voice shopping.

Google's agentic checkout asks permission first

Google's agentic checkout is live now on Search and in AI Mode with Wayfair, Chewy, Quince, and select Shopify merchants. It watches a price and buys via Google Pay when it drops. Google says: "We'll always ask for your permission first, and only buy after you've confirmed the purchase and shipping details."

That makes it human-present — an interface change, not a structural one. FIDO's Human Not Present class is a target for harmonisation by the end of 2026, not a live standard. The trillion-dollar projections are priced on the structural change, which is not what you can buy today.

The forecasts echo voice shopping's failed predictions

McKinsey projects $1 trillion in U.S. retail revenue orchestrated by agents by 2030. Gartner predicts 90% of B2B purchases handled by agents by 2028, intermediating $15 trillion. These are the same class of number, from the same class of firm, about the same class of behaviour change, as OC&C's $40 billion. The last such prediction about machines buying on our behalf was out by an order of magnitude.

What payment companies would publish if this were working

Shopify says it runs these protocols across millions of merchants — storefronts speaking protocols their owners never evaluated, under unsettled liability terms. Removing the build obligation also removed the merchant's decision to join; friction was consent. The burden of proof belongs to those selling this, not the merchants absorbing it.

Documentation read on 14 September 2026 shows the gaps. Visa's Trusted Agent Protocol, Visa Intelligent Commerce, Mastercard Agent Pay, and PayPal name no live merchants; Stripe names none either; Google names three. Visa's two products carry no version number or date; Mastercard's and PayPal's carry none; Stripe publishes 2026-04-22.preview, the only payments company that does. Visa's page says the product "is in the process of development and deployment" and depicts "representations of potential features." Stripe says preview, twice, and lists 34 countries by name. The rest say nothing.

Nobody says who pays when it goes wrong — the Merchant Advisory Group's central demand, unanswered by any protocol on the table. Three of these four disclosures cost nothing. Mastercard's Agent Pay page calls this "a paradigm shift" offering "unparalleled convenience and efficiency" while naming no merchant, version, or status.

An unfinished technology is not a scandal. Refusing to say it is unfinished, while merchants' storefronts already answer agents, is a choice five companies have made — and merchants carry the risk. Until somebody publishes the version, the status, a merchant name, and liability terms, nobody outside those five companies can tell the difference between a payments rail and a press release.