Definition
A cryptographic or protocol signal that claims an agent's identity, intent, or delegated authority and is verifiable by the merchant or payment network.
StoreSteady treats agent trust assertion as a reference term because Trust signal accepted without verification: The merchant accepts agent identity headers without cryptographic verification.
Why it matters
- Trust signal accepted without verification changes what a crawler, shopping channel, or AI assistant can safely infer about the merchant surface.
- Without a named category, operators tend to treat agent trust assertion as generic AI noise instead of a reproducible finding with evidence and a validation path.
Evidence sources
- signed agent identity headers, delegation tokens from a buyer's wallet/identity provider, attestation signatures from trusted agent issuers, intent declarations (e.g., "purchase intent for SKU X up to $Y").
How StoreSteady detects it
Probe merchant endpoints with (a) no agent identity, (b) unsigned agent identity, (c) signed agent identity. Compare responses; flag if (b) and (c) succeed identically (no verification) or if (c) is blocked while (b) succeeds (broken trust handling).
False positive risks
- A bot identifying itself by user-agent string only.
- An agent claiming identity via a custom header that no merchant has agreed to verify.
How to fix it
- Identify the merchant-controlled source that creates the agent trust assertion signal.
- Reconcile visible copy, machine-readable data, policy text, feed state, and checkout behavior where the term applies.
- Keep the fix high-level in public docs; detailed remediation belongs inside paid scan workflows.
How to validate it
Rerun the same evidence capture used for detection. The finding is validated only when the original agent trust assertion signal no longer reproduces and adjacent source surfaces still agree.
Example finding
Trust signal accepted without verification
Observed: An agent presents a Visa Trusted Agent Protocol signature on every checkout request. The merchant validates the signature against Visa's public key, confirms the agent's certification level, and processes accordingly.
Likely impact: Trust signal accepted without verification: The merchant accepts agent identity headers without cryptographic verification.
Probable fix location: Public commerce source of truth
Related StoreSteady issue codes
| Code | Title | Scanner mapping |
|---|---|---|
| AGT-001 | Untrusted agent traffic blocked | Planned detector |
| AGT-003 | Agent-identity signal not verified | Planned detector |
Related standards
See also
Sources
Run a scan against this category
StoreSteady scans public commerce evidence and maps findings back to documented taxonomy terms.
Run a free scan