What Agent Authentication Actually Requires

An AI agent walks into a checkout flow. It has your shopping preferences, your size, your dietary restrictions, and your instruction to buy the hand cream when it comes back in stock. The product is available. The agent adds it to the cart.

Now it needs to pay. How does a merchant verify that this agent has permission to spend your money?

This is the authentication problem that separates agentic shopping from agentic commerce. The shopping part works. Agents can browse catalogs, compare prices, and select products.

The payment part requires the agent to prove, to a merchant who has never seen it before, that a specific human authorized a specific transaction within specific limits. Card networks built their authentication stack around humans typing credentials into forms. Agents don't type.

Three approaches are shipping simultaneously

In September 2026, three different answers to this problem surfaced within a single week.

BLIK in Poland shipped a working transaction. An AI agent monitoring a sold-out hand cream at the Your KAYA online store detected when the product came back in stock, added it to the cart, and paid PLN 19.99 using BLIK.

The user had pre-authorized the payment in their banking app, defining the product, the store, and the spending limit. At transaction time, no human action was required. The agent paid autonomously within the boundaries the user had already set.

Visa, Mastercard, and Ant International announced a joint trust framework. The three largest payment networks are collaborating on standards for how agents identify themselves, authenticate transactions, and operate on behalf of users. No shipping product yet. The framework is still in development.

Catena Labs published the Agent Commerce Kit in 2025. The agent gets a cryptographic identity, trust scopes that limit what it can do, and a receipt layer so every transaction is auditable. The agent never touches card credentials. It holds a scoped authorization token that the merchant can verify independently.

Each approach solves the same problem differently. The differences matter because they determine who controls the trust layer.

What the BLIK model gets right

BLIK's approach is pragmatic.

The user opens their banking app, sets the conditions under which the agent can transact (which merchant, which product, how much), and confirms with a six-digit BLIK code.

The authorization lives in the banking app, not with the agent. The agent operates within a permission boundary that was defined before the transaction happened.

This solves the credential problem entirely. The agent never holds a card number, CVV, or billing address. It holds a reference to a pre-authorized payment consent. The merchant processes the payment through PayU, the same processor it already uses. No new infrastructure required on the merchant side.

But it only works when the user knows what they want to buy and from which merchant. It breaks down when the agent needs to comparison-shop across twenty merchants and buy from whichever one has the best price. The user can't pre-authorize a transaction at a merchant the agent hasn't selected yet.

BLIK's model works for delegated purchases with known parameters. It doesn't scale to open-ended agent commerce where the agent makes the merchant selection.

What the card network framework needs to solve

Visa's consumer survey found that 75% of respondents don't trust AI agents to make payments autonomously. When asked whether they'd trust an agent with Visa involved, 61% said yes. The card networks are betting that their brand is the trust layer.

The framework they're building needs to answer three questions that card rails weren't designed for.

Agent identity. When a transaction arrives at a merchant, is it from a human or an agent? If it's an agent, which agent, acting on behalf of which human, with what scope of authority? Card networks currently identify transactions by card number and cardholder. An agent transacting on behalf of a cardholder is a new actor that doesn't fit the existing identity model.

Scoped authorization. A human with a credit card can buy anything, anywhere, up to their credit limit. An agent needs tighter boundaries. "You can spend up to $200 at grocery merchants this week" is a fundamentally different authorization model than "you can spend up to $10,000 anywhere."

Card networks have merchant category codes and can tokenize credentials. Assembling those building blocks into agent-scoped authorization tokens is engineering work that hasn't shipped yet.

Dispute resolution. When an agent buys the wrong thing because it misinterpreted the user's intent, no existing chargeback reason code covers it. Visa's reason codes assume a human made the purchase or a human was defrauded. "My agent hallucinated and bought the wrong product" is a new category of dispute that the card networks haven't defined.

What Catena's model reveals

Catena Labs took a different approach entirely. Instead of retrofitting card rails, they built agent-native payment infrastructure from scratch. The agent gets a DID (decentralized identifier) as its cryptographic identity. Trust scopes define exactly what the agent can do: which merchants, which product categories, what spending limits, what time windows. Every transaction produces a machine-readable receipt that both parties can verify independently.

This model doesn't depend on the card networks at all. It runs on stablecoin rails. The agent pays in USDC, and the receipt is cryptographically signed. The entire card infrastructure, credentials, 3DS challenges, dispute codes, is bypassed.

The tradeoff is adoption. Card networks connect to millions of merchants. A new payment protocol connects to the merchants that have integrated it, which in September 2026 is a small number.

Catena's architecture may be technically superior for agent commerce. Visa and Mastercard's distribution is 40 years deep.

Where these converge

The three approaches will likely coexist, each serving a different slice of agent commerce.

Pre-authorized consent (BLIK's model) works for known purchases from known merchants. A subscription refill, a restock order, a price-triggered buy. The user defines the boundaries, the agent executes within them. This is the simplest model and the one closest to how recurring payments already work.

Card network authentication (Visa/MC/Ant framework) will handle agent commerce that looks like human commerce. The agent browses, selects, and pays through existing merchant checkout flows, but with agent-scoped tokens instead of card credentials. This model preserves the card networks' position and gives merchants agent commerce without new integrations.

Agent-native protocols (Catena, Stripe's Machine Payments Protocol) will handle agent-to-agent transactions where no human merchant is involved. An AI agent paying another AI agent for compute, data, or services doesn't need a checkout flow at all. It needs programmatic authorization, cryptographic verification, and machine-readable receipts.

The boundaries between these three categories will shift as agents get more autonomous. A grocery shopping agent that starts with pre-authorized consent may eventually need open-ended authorization across multiple merchants. The model that handles that transition without requiring the user to re-authorize for every new merchant is the one that scales.