The Ultimate Guide to A2A (Agent-to-Agent) Commerce

A2A (agent-to-agent) commerce is buying and selling in which AI agents do the work for people and businesses: they find, compare, negotiate, and pay other agents or merchant systems, all within limits a human has set. The name "A2A" covers two things. It is the general idea of agents transacting with each other, and it is also the name of a specific open standard, Google's Agent2Agent (A2A) protocol, which the Linux Foundation now hosts and which lets agents from different companies talk to each other.

Put simply, the A2A protocol is how agents talk to each other. Payment standards such as AP2, x402, and the card networks' agent programs are how they pay. Put the two together and you get A2A commerce.

A2A Explained Like You're in 5th Grade

The examples below are made-up stories that show the idea. They don't claim that any product does exactly this today.

You probably know about auto bill pay. Your parents set it up once. On the same day every month, the bank pays the electric bill. It follows one rule and never thinks about it. If the bill doubles, auto-pay still pays it.

An AI agent is like auto-pay that can think. You still make the rules, like "never spend more than $50" or "ask me first if it costs more than last time." Inside those rules, the agent can check, compare, and choose. It can even talk to another company's agent and pay it.

Here are some examples. The electric bill jumps: your home agent sees that the power bill went way up, checks other plans, finds a cheaper one that still meets your rules, and asks the power company's agent to switch you, showing you what it did. The milk runs out: your grocery agent knows you buy milk every week, sees you're almost out, and asks the store's agent for a price; the store's agent offers a deal if you also buy eggs, your agent checks your list, and since you need eggs, it says yes and pays, staying under your weekly food budget. The flight gets canceled: your family's flight is canceled late at night, your travel agent wakes up right away, asks the airline's agent for the next open seats, picks the best choice under your price limit, and pays the change fee — you wake up to a new plan, not a mess. The allowance agent: a kid gets $10 a week on an allowance agent, and a parent sets the rules — no more than $5 on games and nothing from unknown stores — so when the kid tries to buy a $7 game item, the agent says no and sends the parent a note asking if it's okay. The bakery runs low on flour: a small bakery's agent watches the shelves, and when flour gets low, it asks the supplier's agent for a price and a delivery day; the price is under the owner's limit, so the agent orders and pays, and if the price were too high, it would ask the owner first.

Auto-pay follows one rule. An agent follows your rules but can make smart choices inside them. You're still the boss. The agent is a helper with a spending limit.

How A2A Commerce Actually Works

Every agent purchase has the same basic parts, even though different companies build them differently.

1. Agents

An agent is AI software that can take actions, not just answer questions. In commerce there are usually at least two: a buyer-side agent working for you, and a seller-side agent or merchant system that represents a store, airline, or API. Meta's Muse, launched on September 8, 2026, is one current example of a buyer-side agent. Meta says it can "open a browser, fill out forms, and negotiate on their behalf," and it checks with the user before a purchase.

2. Discovery and agent cards

Before agents can do business, they need to find each other. In the A2A protocol, an agent publishes an Agent Card, a JSON "business card" listing its name, skills, service endpoint, and authentication requirements. The spec shows it at a standard web address (/.well-known/agent-card.json). Version 1.0 of A2A, released March 12, 2026, added Signed Agent Cards, which let other agents check the card cryptographically before trusting it.

3. Tasks

In A2A, the basic unit of work is a task. A task moves through defined states such as submitted, working, input-required, auth-required, completed, failed, canceled, or rejected. The "input-required" state is how an agent pauses to ask a human (or another agent) for a decision, which is how "ask me first" rules work in practice.

4. Mandates and permissions

This is where commerce differs from ordinary chat. A seller needs proof that a human actually authorized the purchase. Google's Agent Payments Protocol (AP2) handles this with mandates, which are cryptographically signed digital records of what a user allowed. The FIDO Alliance describes the current AP2 design as having two mandates: a Checkout Mandate (what the user wants to buy, and on what conditions) and a Payment Mandate (amount, payment method, timing). Each starts as "open," meaning your rules and budget, and becomes "closed" once it is tied to one specific, finalized checkout.

The card networks have their own permission layers. Visa says its Intelligent Commerce program lets consumers "set spending limits and conditions," and Mastercard says Agent Pay for Machines lets organizations set spending limits that are "programmatically enforced."

5. Payment rails

The money itself can move several ways:

• Cards, via tokens. Visa and Mastercard replace real card numbers with tokens. Visa says its tokens confirm that the consumer's chosen agent is allowed to act for them. Meta says Muse pays through Link by Stripe, which creates a one-time-use card so your real card details stay hidden.
• Stablecoins. Dollar-pegged digital tokens such as USDC can settle quickly and in very small amounts, which suits machine-to-machine payments.
• x402. Coinbase created an open protocol that brings back the long-unused HTTP status code 402 Payment Required. A server answers a request with a price, the client signs a payment and retries, and a "facilitator" verifies and settles it. Coinbase's docs say USDC is the most common asset.
• Other machine-payment protocols. Stripe and Tempo launched the Machine Payments Protocol (MPP) in March 2026. It covers stablecoins and fiat payments.

6. Verification

Finally, sellers need to know an agent is legitimate and not a scraper or a scalper bot. Visa's Trusted Agent Protocol has approved agents sign their web requests using the HTTP Message Signatures standard (RFC 9421), with timestamps and one-time values (nonces) that block replay attacks. Merchants check those signatures against public keys that Visa publishes. The signed Agent Cards in A2A 1.0 and the signed mandates in AP2 serve similar purposes in their own layers.

A2A vs. MCP: What's the Difference?

People often confuse these two, so here is the short version. MCP (Model Context Protocol) connects an agent to tools and data, such as a database, a calendar, or an API. A2A connects an agent to other agents. The A2A project describes MCP as working "inside agents" and A2A as working "between agents," and many systems use both.

Both are now under the Linux Foundation. Anthropic introduced MCP and, on December 9, 2025, donated it to the new Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation co-founded by Anthropic, Block, and OpenAI. A2A is a separate Linux Foundation project that Google contributed in June 2025.

The Key Players and Protocols

Real-World Use Cases: Today vs. What's Coming

What's live or piloting now:

• Checkout inside AI assistants. Google says UCP-powered checkout in AI Mode and Gemini lets shoppers buy from participating retailers using Google Pay, with the retailer remaining seller of record. A September 16, 2026 Search Engine Journal report cites a Google post saying UCP already enables direct checkout for "hundreds of thousands of brands and retailers," and that a new "cart transfer" option for finishing on the merchant's own site is rolling out in the U.S.
• Discovery in ChatGPT. OpenAI stepped back from native Instant Checkout in March 2026. It said the first version "did not offer the level of flexibility that we aspire to provide." Merchants now share product feeds over ACP and use their own checkout, and deeper integrations run as ChatGPT apps. Walmart launched one with account linking, loyalty, and Walmart payments.
• Personal agents that shop. Meta's Muse, rolling out in the U.S. since September 8, 2026, can make purchases after asking for approval. It pays through Link by Stripe using one-time-use cards.
• Pay-per-use for software. Coinbase's docs say its facilitator has processed more than 100 million x402 payments across Base and Solana. Stripe says MPP already supports agents paying per browser session (Browserbase), sending physical mail (PostalForm), and ordering sandwiches in New York (Prospect Butcher Co.).
• Card network pilots. Visa says Intelligent Commerce is live in the U.S. with real transactions, and its Agentic Ready testing program has 20+ partners in the U.K. and is expanding to 85+ partners across Asia Pacific and Latin America.

What's coming:

• "Human not present" purchases. AP2 v0.2 adds support for agents paying on their own under pre-approved rules. Google's example is buying limited-run tickets the moment they go on sale.
• Machine-speed B2B chains. Mastercard's launch materials describe an agent that builds a flower shop's web presence by buying a domain, hosting, and images within a budget, and a logistics agent that pays freight and warehouse fees automatically as a shipment moves.
• Shared standards. FIDO is standardizing AP2 and Verifiable Intent. The A2A roadmap includes an interoperability specification and registry work.

Risks and Guardrails

Fraud and fake agents. Merchants can't easily tell a helpful shopping agent from a scalper bot or an attacker. Visa's Trusted Agent Protocol says this plainly, noting that agent traffic could be confused with "bots (web crawlers, etc.) or nefarious actors." Signed requests and signed agent cards are the industry's main answer so far.

Liability for agent mistakes. Who pays when an agent buys the wrong thing? That question is still open. Google listed "accountability" as one of three core problems AP2 was built to solve, along with authorization and authenticity. AP2's signed mandates create an audit trail for disputes. A Jefferies research note quoted by American Banker said card networks can build trust "by setting rules around liability/disputes and what constitutes a valid agent-initiated transaction." Some providers are adding their own protections. Meta says Muse is the first agent covered by Link's purchase protections on eligible purchases.

Spending limits. Hard limits enforced outside the AI model matter more than instructions given to the model. Visa, Mastercard, and AP2 all put limits in the payment credential or mandate itself, so a confused agent can't simply ignore them.

Identity and platform access. In September 2026, Amazon blocked Muse from its store. The Register reported that Amazon said Meta hadn't obtained authorization and that the agent "fails to identify itself while browsing," while Meta says Muse cannot see users' passwords or payment methods. Expect more fights over which agents may shop where, and on whose terms.

Prompt injection. Attackers can hide instructions in web pages or product listings to hijack an agent. AP2's own security documentation is blunt: it "assumes that preventing prompt injection attacks is infeasible," so every model and agent is treated as a potential attacker. Signed merchant offers and enforced mandate constraints keep the worst-case financial damage "strictly bounded."

Regulation. The rules are still forming. For stablecoin payments, the U.S. GENIUS Act, signed July 18, 2025, created the first federal framework for payment stablecoins, including 100% reserve backing with liquid assets. The Treasury Department's August 2026 proposed rule says the law is expected to take effect January 18, 2027. For consent and delegation, FIDO argues that standard models can help "accelerate regulatory alignment."

AP2's own security documentation assumes that preventing prompt injection attacks is infeasible, so every model and agent is treated as a potential attacker — the entire design goal is keeping the worst-case financial damage strictly bounded, not preventing the attempt.

What This Means for Businesses and Consumers

Checklist for businesses:

• Make your catalog machine-readable. Clean, structured product data is how agents find you. Google's UCP and OpenAI's ACP both depend on merchant feeds.
• Pick your channels on purpose. Decide whether you want agents to check out on AI surfaces (UCP), refer shoppers to your own checkout (ACP discovery, UCP cart transfer), or both.
• Ask your payment provider what it supports. Stripe, PayPal/Braintree, Visa Acceptance Platform, and Mastercard partners are each adding agent support for different protocols.
• Learn to recognize good agents. Work with your CDN or bot-protection vendor on signed-agent verification such as Visa's Trusted Agent Protocol, so you don't block real customers.
• Publish an Agent Card if you run your own agent, and consider signing it under A2A 1.0.
• Consider pay-per-use pricing for APIs and data via x402 or MPP.
• Update terms, dispute handling, and fraud rules for agent-initiated orders.

Checklist for consumers:

• Set hard limits: per purchase, per month, and per merchant.
• Require approval for anything unusual, such as new merchants, larger amounts, or subscriptions.
• Prefer one-time or tokenized cards over sharing real card numbers.
• Review the agent's activity log regularly. Muse, for example, shows a full audit trail.
• Know which purchase protections apply before letting an agent buy on its own.
• Be careful with crypto rails. Stablecoin payments may not have the dispute options that cards do.

Follow the Agents: Why the Payment Rail Is Becoming an Infrastructure Fight

Added Oct. 5, 2026. At Robinhood's Summit in Houston, ARK Invest CEO Cathie Wood suggested that investors who once tracked "follow the developers" may soon need to "follow the agents." CoinDesk reported her comment on Oct. 1: "We're probably going to be talking more and more about 'follow the agents.'" It was a brief remark near the end of a wider discussion, with no figures or forecasts attached, and she did not name specific payment systems or coins. The substance in CoinDesk's piece came from elsewhere, mainly a BlackRock paper and comments from SharpLink's Joseph Chalom. The idea itself is simple and worth taking seriously: once software spends money, the places it spends reveal where demand is going, and the systems it pays through become infrastructure.

The BlackRock paper, "The Machine-Native Economy: How digital assets connect intelligence, commerce, and compute" (Sept. 22, 2026, by Will Su, Robert Mitchnick, Jay Jacobs, and William Helm), frames agents as "machine-native intelligence" and digital assets as "machine-native money." Its core claim is that existing payment systems "fit autonomous software poorly" because of account setup requirements, merchant fees, settlement delays, and scaling limits. It points to a stablecoin market above $300 billion, about $11.2 trillion in adjusted stablecoin transaction volume in 2025, and 80% annual growth between 2020 and 2025, while cautioning that comparisons to Visa and Mastercard volumes "are not directly comparable." It also projects a combined $1.1 trillion in cloud revenue by 2030 across AWS, Microsoft's Intelligent Cloud, and Google Cloud, a market where agents could one day buy compute directly.

The paper is candid about its limits. It describes agentic payment activity as "nascent," notes limited liquidity in compute markets, and says its research on AI model preferences rests on simulated model responses, not observed agent behavior. That matters: it is a thesis, not a measurement.

Three Rails, One Fight

This is our framing rather than a claim from the paper. Agents already have at least three routes to pay, each covered earlier in this guide:

• Card networks. Tokenized cards with spending controls, Visa Intelligent Commerce, and Mastercard Agent Pay give agents familiar rails with existing consumer protections.
• Stablecoin and on-chain rails. x402 and similar protocols let an agent pay per request in stablecoins with no account, which is what the BlackRock paper emphasizes.
• Platform checkouts. Google's UCP checkout and merchant-run flows keep payment inside a platform's ecosystem.

Which one agents default to will be shaped by merchant fees, settlement speed, dispute rights, identity requirements, and regulation, the same factors that decided earlier payment fights. That makes "follow the agents" a useful lens: transaction counts, merchant acceptance, and the share of machine-initiated payments by rail will show who is winning long before any market-size forecast is proven.

What to Watch

• Observed agent transaction volumes by protocol, not simulated ones.
• Whether card networks match stablecoin rails on micropayments and settlement speed.
• How dispute and liability rules treat agent-initiated payments on each rail.
• Regulatory clarity, including the U.S. stablecoin framework discussed in our GENIUS Act explainer.
• Security: every added rail adds more surface for the problems in our agent security deep-dive.

This section is general information, not investment advice.

Key Takeaways

• A2A commerce means AI agents buying and paying within human-set limits. "A2A" is also Google's Agent2Agent protocol, now a Linux Foundation standard at version 1.0.
• Communication and payment are separate layers: A2A and MCP handle how agents talk, while AP2, x402, MPP, and card-network programs handle how they pay.
• Trust is the central problem. Signed mandates, signed agent cards, tokenized credentials, and enforced limits are the main tools.
• The market is still shifting. OpenAI scaled back Instant Checkout, Google is expanding UCP checkout, and Amazon is blocking unauthorized agents.
• "Follow the agents" is a useful lens. Which rail agents pay through (cards, stablecoins, or platform checkouts) is becoming an infrastructure fight, though BlackRock's thesis is still unproven by observed agent behavior.
• Stablecoins are becoming a real agent payment rail, backed by the x402 Foundation's broad membership and a U.S. legal framework expected to take effect in January 2027.