Before trusting an AI agent in a transaction, ask three questions: whose authority does it carry, whose interest does it optimize, and who benefits from the outcome?
Agentic commerce is often described as a payment or interoperability problem. Those layers matter, but they do not settle the central trust question. A valid agent identity can tell us which software is speaking. It does not automatically prove that the software is acting within a current mandate or in the interest of the principal it claims to represent.
Trust is a relationship, not a property
The A2A specification gives agents a standard way to publish identity, capabilities, service endpoints, and authentication requirements. It also makes authorization an implementation responsibility. That is the right separation for a communication protocol, but it means protocol compliance cannot answer every governance question.
NIST frames the remaining problem directly: how can an agent prove its authority for a specific action, convey its intent, support delegated authority in an on-behalf-of relationship, and bind its activity back to a human or organization? These questions become different security problems in B2B, B2C, and C2C transactions.
Three markets, three trust models
| Transaction | Who the agents represent | Primary trust anchor | Distinctive risk |
|---|---|---|---|
| B2B | Two organizations with internal roles and policies | Corporate identity, signed delegation, and policy scope | Agents can bypass separation of duties or coordinate across firms |
| B2C | A commercial organization and an individual consumer | Consumer consent, disclosed incentives, and bounded authority | Recommendation, pricing, and payment incentives are asymmetric |
| C2C | Two individuals, often through platforms and agent providers | User-bound delegation, reputation, escrow, and dispute handling | Weak identity, fake reputation, and coordinated marketplace abuse |
B2B: authority comes from the organization
In a B2B transaction, an agent rarely acts for itself. It acts for a company, department, project, or employee. Trust therefore depends on a delegation chain: which organization authorized the agent, which role granted the mandate, what transaction limits apply, and which actions still require approval.
A purchasing agent may be allowed to request quotes but not select a related vendor. A compliance agent may review a contract but not waive a control. Both agents can be authenticated and technically authorized while their joint behavior defeats the policy that separated their roles.
This makes independence part of the trust model. Systems should record shared models, providers, memory, data sources, reward signals, and approval chains. Two differently named agents are not independent if they share the same hidden incentive or can repeatedly approve each other.
B2C: trust must account for asymmetric incentives
A B2C transaction connects agents with different economic positions. A merchant agent is expected to advance the seller's commercial interest. A consumer agent is expected to protect the buyer's preferences, budget, privacy, and ability to change course.
Visa's Trusted Agent Protocol illustrates one necessary layer. It lets a merchant recognize an approved agent, verify signed information, and identify a consumer's commerce intent. This helps distinguish a legitimate shopping agent from an unknown bot. It does not, by itself, prove that a recommendation was unbiased or that every commercial relationship affecting the agent was disclosed.
A consumer should be able to tell whether an agent is paid by a merchant, shares revenue with a marketplace, prefers products from its own provider, or optimizes conversion instead of user value. Consent also needs a clear scope: browsing is not purchasing, comparing is not accepting terms, and a spending limit is not permission to disclose all personal data.
C2C: trust has fewer institutional anchors
C2C transactions can involve two personal agents meeting through a marketplace, social network, or open protocol. Neither side may have a strong organization behind it. Identity may be pseudonymous, reputation may be platform-specific, and the agent provider may know more about the transaction than either counterparty.
Trust therefore depends more heavily on user-bound delegation, proof of control over the listed asset, reputation provenance, escrow, revocation, and dispute resolution. A signed request from a real agent is not enough if the principal is a disposable account or if several accounts are controlled by the same party.
The collusion surface is also broader. Agents can coordinate fake bids, reciprocal reviews, artificial scarcity, reputation farming, or payment release. These patterns are visible only when the platform examines relationships and repeated outcomes across transactions.
What should travel with an agent transaction?
- Principal. The human or organization represented by the agent, at the level of disclosure appropriate to the transaction.
- Delegation. A verifiable chain showing who granted authority, for which task, under which limits, and until when.
- Purpose. A machine-readable statement of the action being attempted, separate from the agent's broad capabilities.
- Interests. Commercial relationships, reward signals, and conflicts that could affect selection or negotiation.
- Evidence. A trace of messages, tool calls, approvals, data access, and changes to the proposed transaction.
- Recourse. A way to pause, revoke, challenge, reverse, or escalate the action when the relationship fails.
Why agent identity is not enough
Cryptographic identity can prove that a request came from a recognized agent and was not modified in transit. It cannot prove that the principal still wants the action, that the authority has not become stale, or that the agent's recommendation is free from an undisclosed conflict.
It also cannot reveal a joint plan by itself. A buyer agent and seller agent may both be legitimate, yet share a provider, memory layer, model, or optimization target. Trusting each identity independently can hide a relationship-level conflict.
Collusion looks different in each market
| Market | Example coordination | Evidence a monitor needs |
|---|---|---|
| B2B | A sourcing agent and audit agent repeatedly clear the same vendor | Delegation graph, role independence, approvals, and vendor benefit |
| B2C | A shopping agent steers users toward offers that reward its provider | Ranking rationale, commercial ties, alternatives, and user preference |
| C2C | Peer agents create fake demand, reviews, or reciprocal transactions | Account linkage, timing, transaction graph, escrow, and outcomes |
A Guardian Agent must monitor the relationship
A Guardian Agent focused on Agent Collusion should not merely check each message against a policy. It should reconstruct the relationship between principals, delegated agents, tools, incentives, and outcomes. Its controls should then reflect the market.
- In B2B, verify organizational mandates and enforce meaningful separation of duties.
- In B2C, protect consumer intent, disclose conflicts, and distinguish browsing authority from purchase authority.
- In C2C, combine user-bound delegation with graph-based abuse detection, escrow, and recourse.
Open research questions
- How should delegated authority remain verifiable across a chain of agents without exposing unnecessary personal or corporate data?
- Which conflicts of interest should be machine-readable before agents negotiate, rank, or purchase?
- How can systems distinguish normal agreement from coordinated manipulation across repeated transactions?
- What minimum evidence supports intervention while preserving privacy and commercial confidentiality?
- How should revocation and recourse propagate when one agent delegates work to several others?
The next trust layer is relational
Agentic transactions will not share one universal trust model. B2B needs organizational authority and role independence. B2C needs consumer protection under asymmetric incentives. C2C needs stronger provenance, reputation integrity, and recourse between peers.
A2A communication, agent recognition, and secure payment are essential infrastructure. The remaining task is to show whose authority and interests move through that infrastructure, and to detect when several valid agents produce an invalid joint outcome.
