Google, AmEx and Shopify moved on agentic commerce trust in the same week: what merchants need to understand

Within four days in October, three major commerce and payments companies moved different parts of the agentic commerce trust layer forward:

• American Express: on 13 October, American Express published its Intent Intelligence Framework, designed to capture, authenticate, and preserve a customer's purchase intent before an AI agent completes a transaction;

• Google: on 15 October, Universal Cart launched in the US across Google Search and the Gemini app, bringing products from multiple retailers into one cart with price and inventory tracking and UCP-powered checkout;

• Shopify: on 16 October, Checkout MCP and Cart MCP added support for UCP buyer consent, allowing compatible agents to carry privacy and marketing choices through cart and checkout.

Three organisations. Three different parts of the same challenge.

The timing is notable because agentic commerce needs more than product discovery and payment capabilities. It also needs a way to establish what the shopper authorised, preserve their consent choices, and give them control over how a purchase is completed.

That trust infrastructure is now becoming more concrete.

Why trust is the bottleneck

We've spent weeks covering the infrastructure for agentic commerce: Shop MCP, WebMCP, the Universal Commerce Protocol and the growing number of AI shopping agents.

The technology for agents to discover products, build carts, and help complete purchases increasingly exists. One of the remaining challenges is establishing trust around those actions:

• Authorisation: how does the payment network know the agent is acting within instructions the customer actually approved?

• Consent: how are privacy, marketing and data-sharing choices preserved when an agent operates the checkout?

• Control: how does the shopper remain in control when more of the shopping journey happens through an AI interface?

These aren't edge cases. They determine whether agent-assisted transactions can move from technical capability into repeatable commerce infrastructure.

That's why the developments from AmEx, Google and Shopify matter together.

What each piece does

American Express: Intent Intelligence

The Intent Intelligence Framework addresses the authorisation problem.

When a consumer tells an AI agent to find a pair of running shoes below a certain budget and purchase the best option, there is a gap between that instruction and the eventual transaction. The payment ecosystem needs a way to know what the customer actually approved and whether the purchase still fits those conditions.

American Express proposes four stages:

• Create and confirm intent: capture purchase instructions and constraints such as merchant, maximum budget and other preferences, then have the customer authenticate and approve that intent;

• Establish proof of intent: generate an Intent ID and a Proof of Intent Token representing the approved constraints;

• Scope the payment credential: use that proof to obtain a secure digital payment credential aligned with what the customer authorised;

• Carry intent through the transaction: use the intent record as context for validation, authorisation, fraud controls and potential disputes.

The important shift is timing. AmEx's model makes authorised intent available to the issuer before the agent executes the purchase, rather than trying to reconstruct the customer's instructions after a transaction has already happened.

For merchants, this is less about implementing an AmEx feature themselves and more about understanding how payment networks are beginning to distinguish an authorised agent transaction from an AI system simply attempting to use a customer's payment credentials.

Google: Universal Cart

Google's Universal Cart addresses a different problem: fragmentation.

Customers routinely move between products and retailers while shopping. Google's Universal Cart brings those items into one persistent cart across Search and Gemini instead of forcing shoppers to manage separate tabs, screenshots or wish lists.

The cart can:

• Combine products: save items from multiple retailers in one place;

• Track changes: monitor price drops and products returning to stock using Google's Shopping Graph;

• Surface savings: show promotions and relevant card benefits through Google Wallet;

• Support checkout: let shoppers use Google Pay with participating retailers or transfer items into the merchant's own cart to finish the purchase.

The checkout layer is powered by UCP, but the merchant remains the seller of record and continues to provide order confirmation and customer support.

That distinction matters. Google is not replacing the merchant transaction. It is creating a shopping layer above multiple merchant experiences that can carry product consideration much closer to checkout.

The scale behind that layer is significant. Universal Cart draws from 60+ billion product listings in Google's Shopping Graph.

For merchants, being represented accurately in that product ecosystem matters. But Google has not said that Universal Cart compatibility determines AI recommendation rankings, so merchants should avoid treating checkout integration as a guaranteed visibility advantage.

Shopify: UCP buyer consent

Shopify's update addresses another part of the trust problem: preserving the shopper's consent choices when an AI agent manages cart and checkout.

Checkout MCP and Cart MCP now support the UCP buyer_consent extension for agents negotiating UCP version 2026-08-25.

When supported, the response includes a buyer.consent object describing the consent purposes available for that shop, including:

• Analytics;

• Preferences;

• Sale or sharing;

• Marketing, including email and SMS.

The agent can show those choices to the shopper and send their selections back when creating, updating or completing the cart or checkout.

If no choice is sent, Shopify applies the shop's default settings for the buyer's country. If the country is unknown, the consent state defaults to opt-out.

This means the agent does not need to invent its own interpretation of a merchant's privacy and marketing options. It can retrieve the shop-specific choices, present them to the customer and return the customer's decisions with the transaction.

There is an important qualification. This does not make every agent-mediated checkout automatically compliant. The extension only applies when the agent and platform negotiate the supported UCP version and buyer-consent capability, and merchants remain responsible for their wider privacy and regulatory obligations.

What it does do is reduce the amount of custom logic needed to preserve store-specific consent choices across an agent-mediated checkout.

What eCommerce merchants should understand

The common thread across these developments is that merchants are not expected to build every part of agentic trust themselves. Payment networks, commerce platforms and protocols are increasingly handling identity, intent, consent and transaction controls around them.

But merchants still need to understand whether their own commerce stack can participate.

• Product data influences discovery: Google's Universal Cart is built on the Shopping Graph, while Shopify's agentic commerce infrastructure relies on structured catalogue data. Accurate titles, attributes, pricing, availability, and imagery give these systems better information to use when matching products to shopping requests.

• Checkout compatibility reduces transaction friction: Universal Cart can complete eligible purchases through Google Pay or transfer products into the merchant's cart. Shopify's Cart MCP and Checkout MCP expose structured cart and checkout capabilities to compatible agents. Merchants should understand which agentic channels their current platform supports and where customers still need to return to a conventional checkout.

• Consent needs to travel with the customer: If an agent performs the checkout interaction, marketing and privacy choices cannot simply disappear. Shopify's buyer-consent extension shows how those preferences can travel through the agent flow instead of being treated as a separate merchant-side problem.

• Payment authorisation is becoming more contextual: AmEx is building purchase intent directly into the payment lifecycle. Mastercard has also developed an Agent Pay Trust Framework around identity, intent, controls, execution and intelligence, while Visa is developing trusted-agent infrastructure of its own.

For merchants, the important question is not whether they should create their own payment-intent standard. It is whether their payments and commerce partners are prepared to support agent-initiated transactions as these standards mature.

The bigger picture

The timing of these developments matters. They arrived within days of one another ahead of the 2026 holiday trading period, as agent-assisted shopping moves from experimentation towards live commerce experiences.

There is also an early signal that usage is growing. Stripe president John Collison said the company's agentic commerce activity started going "vertical" in September. He did not publish transaction volumes, so that comment should be treated as directional evidence rather than a quantified measure of adoption.

What is clearer is the amount of infrastructure now appearing around agent-led transactions.

Product discovery is being standardised. Cart and checkout tools are becoming machine-readable. Payment networks are working on agent identity and purchase intent. Commerce platforms are building consent directly into agent protocols.

The developments from AmEx, Google and Shopify don't prove that agentic commerce has reached mass adoption, and there is no evidence that the three launches were coordinated.

They do show that the industry is moving from asking whether an AI agent can buy something towards defining the controls required for it to buy something responsibly.

For eCommerce merchants, that changes the preparation question.

You don't need to build the trust layer yourself. But you do need to understand how your product data, checkout, consent settings, and payment stack connect to the trust infrastructure being built around you.

For merchants assessing their next steps, the starting point is understanding what their current platform and integrations support. Talk to On Tap about your eCommerce setup and where product data, checkout, consent, and payment dependencies may need closer review as agentic commerce develops.