Google’s Universal Commerce Protocol and its companion Agent Payments Protocol (AP2) represent the most significant structural change to online payments since the introduction of one-click checkout. The checkout flow itself is being abstracted into a protocol layer where AI agents transact on behalf of humans, governed by cryptographic mandates rather than session cookies and cart pages.
Announced at Google I/O 2026 and launched with more than 60 partner organizations including Mastercard, American Express, PayPal, Adyen, and Worldpay, AP2 establishes the trust architecture for a world where agents, not humans, are the primary participants in commerce.
Universal Commerce Protocol: A Common Language for Agents
The Universal Commerce Protocol (UCP), co-developed with Shopify, Wayfair, Target, Walmart, Nike, and Sephora, creates a standardized way for AI agents to discover products, assemble carts, and execute purchases across merchants. Google’s Universal Cart aggregates items across merchants and Google services (Search, Gemini, YouTube, Gmail), leveraging Gemini models to identify price drops, flag product incompatibilities, and highlight savings through loyalty programs.
UCP separates what consumers use to pay (instruments) from payment handlers (processors), enabling scale to a diverse set of existing payment providers. The protocol supports Shop Pay, Google Pay, and third-party payment handlers through a unified interface.
The US launch begins this summer across Search and the Gemini app, followed by YouTube and Gmail. Geographic expansion to Canada, Australia, and the UK is planned for the coming months, with new verticals including hotel booking and local food delivery.
Agent Payments Protocol: Trust Through Cryptographic Mandates
AP2 is the security architecture that makes agent commerce viable at scale. Every agent purchase is represented as three signed mandates, each cryptographically secured and backed by Verifiable Credentials:
Intent Mandate
Captures the user’s initial instruction to the agent. When a user says “buy concert tickets when they go on sale,” the Intent Mandate records that instruction with specific parameters: price limits, timing conditions, brand restrictions. This mandate is signed upfront, creating an auditable record of what the user actually authorized.
Cart Mandate
Generated when the agent assembles specific items for purchase. Creates a secure, unchangeable record of the exact items, quantities, and prices. Ensures what the agent selected matches what gets charged.
Payment Mandate
Links the verified payment method to the Cart Mandate contents, completing the chain of evidence from intent through selection to settlement.
The three-mandate structure answers the questions that would otherwise make agent commerce untenable: Did the user authorize this? Did the agent faithfully execute the intent? Can the transaction be disputed and resolved?
Who Is Building on AP2
The partner list reveals how quickly the infrastructure layer is consolidating around this standard. Payment networks (Mastercard, American Express, JCB, UnionPay International), processors (Adyen, Worldpay, Checkout.com, Airwallex), and commerce platforms (Salesforce, Adobe, Etsy) have all committed to the protocol.
By mid-April 2026, Stripe, Adyen, and Checkout.com were shipping integrations that translate AP2 Mandates into Mastercard Verifiable Intent artifacts for clearing on existing card rails. On May 26, 2026, the FIDO Alliance announced that AP2 and Mastercard’s Verifiable Intent had been contributed to the standards body that previously standardized passkeys.
This is no longer a Google product. It is becoming an industry standard, governed by the same body that manages the authentication layer of the web.
The Delegated Commerce Model
AP2 enables two distinct modes of agent commerce:
Real-time (human present): The user makes a request, the agent presents options, the user approves, and the Cart Mandate is signed at that moment. This is the familiar purchase flow, accelerated.
Delegated (human absent): The user signs a detailed Intent Mandate upfront with conditions and spending limits. The agent monitors for those conditions and executes autonomously when met. No additional human approval required.
The delegated model is where commerce changes fundamentally. An agent with a signed Intent Mandate can make purchases at 3 AM, respond to flash sales in milliseconds, and execute complex multi-step procurement workflows without human latency. The mandate provides the guardrails; the agent provides the speed.
What This Means for the Finance Leader
The implications extend well beyond consumer convenience.
Checkout conversion metrics become irrelevant
If purchases happen inside agent conversations rather than on checkout pages, cart abandonment rates stop measuring anything meaningful. Finance teams tracking revenue through funnel analytics will need new instrumentation for agent-mediated commerce, focused on mandate authorization rates rather than page-level conversion.
Procurement automation accelerates
The delegated mandate model maps directly onto enterprise procurement. Budget-constrained, rule-governed, multi-approval purchasing workflows become automatable at the protocol level. The infrastructure Stripe is building for agent wallets complements this: ephemeral cards per task, scoped to mandate parameters.
Dispute and reconciliation architecture must evolve
The cryptographic audit trail (Intent, Cart, Payment) creates a new evidentiary standard for disputes. Finance and legal teams should anticipate that agent-initiated transactions will carry stronger provenance than human-initiated ones, potentially reducing dispute costs while creating new categories of liability around mandate specification.
Google processes over one billion daily shopping queries, powered by a Shopping Graph of more than 60 billion product listings. AP2 gives those queries a direct path to transaction without the human ever touching a payment form. The checkout is not being simplified. It is being eliminated.
Source: Google Cloud Blog
