Securing the Front Door of Agentic Commerce: Four Channels, One Identity Layer

Customer commerce has changed. Customer behavior is shifting from individuals clicking through websites to automated agents acting on their behalf. We believe this is the biggest shift in customer identity since mobile, and the businesses that win will make every agent-driven interaction secure enough to trust and smooth enough to convert on every channel where agents now show up.

The Four Main Channels of Agentic Commerce

For two decades, digital commerce had a simple shape: bring people to your website or app, then convert them there. Agentic commerce breaks that shape. A customer can now discover, compare, and buy from you without ever loading your homepage.

We see four channels emerging at the same time. Each has a different owner, a different protocol, and a different trust model. Most brands will need to be present in all four, just as they learned to be present on the web, mobile, marketplaces, and social.

This is a classic identity challenge. The channels differ, but the agentic enterprise security questions do not: Who is the agent, who is it acting for, and what is it authorized to do?

1. First-party embedded agents

The first channel is the one you own: a shopping assistant, concierge, or support agent built into your website and app. The agent is yours, and so is the customer relationship. Identity's job here is to make that agent as aware of the customer as your best store associate, without letting it overreach.

Key security and identity requirements

In practice, the identity layer must support three things:

• Act as the customer, not as a superuser. The agent works inside the signed-in customer's session and permissions, never through a broad service account that can see everyone's orders.
• Step up when the stakes rise. Browsing and recommendations are low-risk. Changing a shipping address, using a stored card, or redeeming loyalty points should trigger a quick passkey check.
• Convert in the conversation. When an anonymous visitor is ready to buy, they become a known customer in one step, with a passkey or social login, without leaving the chat for a separate sign-in page.

The business impact

• Higher conversion on the channels you own
• Richer first-party data
• An assistant customers trust because it never does more than they asked

2. Third-party assistant connectors

The second channel puts your brand inside the AI assistants where customers already spend their day: Model Context Protocol (MCP) Apps and connectors in Claude and ChatGPT. MCP enables connectors to display an interactive user interface, not just text, inside the conversation. This is the underlying standard powering Claude Connectors and ChatGPT custom integrations.

Through MCP Apps, major brands like Booking.com, Instacart, and Uber Eats create rich experiences within these platforms.

Every one of these apps starts with the same question: which of your customers is this? Both platforms answer it with OAuth.

The business impact

You meet customers where they already are, signed in with their loyalty status and order history, instead of showing up as an anonymous catalog, to capture demand directly inside conversational discovery engines.

3. Agentic commerce protocols: UCP

The third channel is checkout inside AI platforms, built on open protocols designed from the ground up for agentic commerce. Google announced the Universal Commerce Protocol (UCP) earlier this year, co-developed with Shopify, Etsy, Wayfair, Target, and Walmart. Amazon, Meta, Microsoft, Salesforce, and Stripe have since joined its Tech Council.

Key security and identity requirements

When it comes to identity, the most important part of UCP is Identity Linking. It lets shoppers on UCP platforms "receive the same loyalty or member benefits" they get when signed in on the retailer's own site, allowing the agent to act on the user’s behalf. The spec sums it up in one line: Linking upgrades the experience; it does not gate it. The retailer stays the merchant of record and keeps its own sign-in, consent, and policy. Businesses that already run a modern authorization server can plug in quickly. This is why Auth0 announced support for Auth for UCP at Oktane.

Checkout is moving into other assistants too. Microsoft launched Copilot Checkout earlier this year with PayPal, Shopify, and Stripe, and Target is a launch partner for account-linked loyalty there.

The business impact

Your best customers keep their member prices, points, and saved details when they buy through Gemini, AI Mode, or Copilot, so the agent has a reason to choose you.

4. Personal agents with their own computers

The newest channel is also the one you control least. Meta says Muse runs on "a dedicated secure computer with its own browser." OpenAI says dots work through "their own cloud computer, their own browser, and the apps you've connected." The same goes for Grok Bot, Instinct, and other personal agents. These agents do not need your API. They can open your site, fill in your forms, and check out the way a person would, at any hour.

A personal agent brings its own computer and browser, and can reach you three ways.

That puts every business at a fork:

• Block them as bots: You block customers who chose to shop through an agent, and the agent simply buys from the competitor whose site lets it through.
• Let them in anonymously: You cannot tell a customer's trusted agent from a credential-stuffing script, nor can you tell which human authorized the purchase.

Recognizing personal agents is the only path that is both safe and good for sales.

Today, many personal agents sign in by replaying a customer's saved password. While this works for regular passwords, it adds friction when users choose to sign in with a social account, use passkeys, or have multi-factor authentication (MFA) enabled. Furthermore, your website cannot distinguish an agent from a human, scope what the agent may do, or revoke the agent without forcing a password reset.

The solution is to make the agent a first-class identity. Recognize it by a cryptographic signature, let the customer link their account and grant scoped permissions, and step up only when the stakes rise. The platforms are already adopting this model. Muse checks out with one-time Stripe Link cards and requires a separate Sentinel agent to approve external internet access. Microsoft gives Autopilot "its own identity, memory, computer, and workspace."

Poppy, the Personal Agent Protocol, standardizes this pattern. With it, a personal agent arrives as a recognized client with verified consent from a signed-in customer, not as a replayed password.

The outcome: you turn a fast-growing source of automated traffic into recognized, authenticated, converting customers instead of blocked sessions.

How identity management drives revenue in agentic commerce

The commercial opportunity is massive and arriving quickly. McKinsey & Company estimates that generative and agentic AI could unlock $3 trillion to $5 trillion in global economic impact, with retail and customer operations representing a primary share of that value. Within customer digital commerce specifically, Bain & Company projects the US agentic commerce market will capture $300 billion to $500 billion, representing roughly 15% to 25% of total digital commerce. Traffic is already shifting: Target reported that AI-driven traffic surged 2,000% year over year in Q1 2026, compared to roughly 400% across retail websites overall.

Identity architecture determines how much of that spend a business captures. We see five outcomes:

• Higher conversion: A recognized, linked agent bypasses CAPTCHAs, guest checkout forms, and password resets. Microsoft found that shopping journeys incorporating Copilot yielded 53% more purchases within 30 minutes. Eliminating identity friction converts agent-assisted intent into completed orders.
• Customer acquisition through new entry points: Agents shortlist merchants on behalf of customers who may never have visited your site. Agents naturally favor merchants they can transact with programmatically. A single-screen consent flow converts that initial agent transaction into a known, addressable customer.
• Portable loyalty and margins: Account linking allows member pricing, earned points, and saved preferences to follow the customer into Gemini, ChatGPT, Copilot, or a personal agent. Without it, the agent evaluates your products solely on generic list price.
• Trust as a differentiator: Bain found that shoppers trust a retailer's proprietary agent three times more than third-party alternatives. Explicit consent, clear boundaries, and one-click revocation establish that same level of trust across external channels.
• Reduced fraud and operational overhead: When verified agents identify themselves, non-conforming automated traffic becomes easier to isolate and block. Bot defenses become sharper, ensuring legitimate customers never absorb the latency or friction intended for bad actors.

Standards Will Help Us Create Secure and Delightful Experiences

Sierra published the first draft of Poppy, the Personal Agent Protocol, three days after announcing the initiative alongside Meta, Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart. More than 35 design partners have since joined, including Adyen, Bank of America, Cloudflare, OpenAI, PayPal, Visa, and Okta.

The idea of Poppy is simple: Customers decide what access to give their personal agents, and companies set limits on what those agents can do. Poppy gives personal agents a front door instead of a password field. Its draft 0.1 specification is, at heart, an identity protocol built on OAuth.

As an inaugural design partner, Okta is actively contributing to the development of Poppy. We are collaborating with Sierra and fellow partners as the specification evolves to ensure experiences built on it remain both low-friction and cryptographically secure. That means passkeys at sign-in, clear consent screens, step-up verification when high-value transactions occur, and centralized visibility with instant revocation for every agent a customer connects.

To Win, You Need Delight AND Security

In agentic commerce, security and user experience are not a trade-off. The control that stops a rogue agent is the same control that lets a trusted agent skip the CAPTCHA, the password reset, and the re-registration. Across all four channels, the same seven identity moments decide whether an agent-driven interaction converts or stalls.

These steps are not new to identity teams. What is new is that with agentic commerce, each control must execute when the actor initiating the request is autonomous software operating on behalf of a person, often within a third-party channel you do not control.

Where We Are Going

At Okta, our core mission has always been to ensure the right people get access to the right resources, whether they are employees signing in to enterprise software or customers completing a purchase. Autonomous agents do not alter that premise; they extend it to a new class of actor.

A personal agent booking flights and hotels for a trip or shopping for insurance quotes on behalf of a customer raises the same four questions: Who is this agent? Who does it act for? What is it allowed to do? Who can stop it? We believe one identity layer should answer all four, for both audiences.

That belief shapes what we build:

• Open standards first: We build on, and help shape, open protocols for agent identity, delegation, and commerce rather than proprietary silos. That commitment begins with Poppy.
• Every channel, one identity layer: Embedded assistants, MCP connectors, commerce protocols, and personal agents must share a single engine for authentication, consent, policy enforcement, and audit logging.
• The human remains in control: Scoped consent, contextual step-up verification, and immediate revocation are baseline requirements, not optional features.
• Visibility, control, and governance: Runtime observability and controls allow teams to measure and optimize agentic experiences, driving revenue growth while actively decreasing risk.
• Days, not quarters: Enabling a new agentic sales channel should require a straightforward configuration update, not an architectural re-platforming effort.

Partner With Us to Shape the Future of Agentic Commerce

Open protocols succeed when they reflect the operational realities of modern brands. As an inaugural design partner for Poppy and a supporter of UCP, Auth0 is working with retailers and platforms to define consent boundaries, test reference implementations, and turn automated agent interactions into lasting customer relationships. To explore our architecture and learn how to prepare your storefront for autonomous agents, visit our agentic commerce identity hub.