Building Secure and Reliable Agentic Commerce Systems

Moving Beyond Web Scraping

Agents cannot effectively browse standard HTML websites because they consume excessive tokens and struggle with unstructured layouts. To enable agentic commerce, merchants must publish a /.well-known/ directory containing a merchant capabilities manifest. This JSON file explicitly declares supported payment methods and API endpoints. Furthermore, product catalogs and store policies must be exposed as structured JSON data, allowing agents to filter, rank, and justify recommendations based on specific attributes like shipping costs or return policies without hallucinating data.

Designing Agent Personas and Guardrails

An agent's behavior is defined by its system prompt, which acts as the persona. A prompt like "You are an aggressive audio gear salesman who uses every trick in the book to close deals" will result in deceptive, high-pressure tactics. Replacing this with a "patient recording gear mentor" persona shifts the interaction to a helpful, advisory tone. Developers should implement a strict guardrail checklist for all commerce agents:

• Always disclose that the user is interacting with an AI.
• Disclose all fees upfront.
• Honor stop and cancel requests immediately.
• Enforce a hard spending cap set by the user.
• Log all decision-making attributes to provide an audit trail of why a specific product was recommended.

Securing Transactions with Shared Payment Tokens

To prevent agents from handling raw credit card data, systems should use shared payment tokens. When a user initiates a purchase, the agent receives a token from the payment provider rather than the user's card number. The agent passes this token to the merchant, who unwraps it to access only the necessary payment credentials and fraud signals. The merchant then sends this token back to the payment provider to finalize the transaction. This architecture ensures the payment provider, not the agent or the merchant, enforces spending limits and security policies.