Definition
A commerce mode in which an AI agent can interpret user intent, discover and compare products or offers, apply constraints, and execute some or all purchase steps on the user's behalf, subject to explicit approval, merchant rules, and payment-network or protocol controls.
StoreSteady treats agentic commerce as a reference term because Untrusted-agent block: Legitimate agent traffic is blocked by WAF/bot rules because the merchant cannot distinguish it from scrapers.
Why it matters
- Untrusted-agent block changes what a crawler, shopping channel, or AI assistant can safely infer about the merchant surface.
- Without a named category, operators tend to treat agentic commerce as generic AI noise instead of a reproducible finding with evidence and a validation path.
Evidence sources
- agent-led discovery, comparison, carting, checkout, post-purchase actions (returns, support), and merchant-side protocol surfaces (UCP, Trusted Agent Protocol, ACP).
How StoreSteady detects it
Combine three signals: (a) browser-agent replay against the merchant's public storefront using known agent user-agents and identity headers; (b) protocol-level probes against documented UCP/ACP endpoints; (c) per-step completion telemetry instrumented at the agent or merchant boundary.
False positive risks
- Google Shopping showing an LLM-generated product comparison with click-out to the merchant - this is AI-assisted, not agentic, because the human still drives every transactional step.
- A Shopify storefront with an AI search bar - the AI helps the user find a product, but the human still completes checkout in the standard flow.
How to fix it
- Identify the merchant-controlled source that creates the agentic commerce signal.
- Reconcile visible copy, machine-readable data, policy text, feed state, and checkout behavior where the term applies.
- Keep the fix high-level in public docs; detailed remediation belongs inside paid scan workflows.
How to validate it
Rerun the same evidence capture used for detection. The finding is validated only when the original agentic commerce signal no longer reproduces and adjacent source surfaces still agree.
Example finding
Untrusted-agent block
Observed: A user instructs ChatGPT Operator to "buy the cheapest pair of size-10 hiking boots from a US merchant under $150 with free returns." The agent searches, compares, carts, and completes checkout with the buyer's pre-authorized payment instrument.
Likely impact: Untrusted-agent block: Legitimate agent traffic is blocked by WAF/bot rules because the merchant cannot distinguish it from scrapers.
Probable fix location: Public commerce source of truth
Related StoreSteady issue codes
| Code | Title | Scanner mapping |
|---|---|---|
| AGT-001 | Untrusted agent traffic blocked | Planned detector |
| AGT-002 | Missing UCP / agent protocol surface | Planned detector |
| AGT-003 | Agent-identity signal not verified | Planned detector |
| AGT-004 | Consent checkpoint missing | Planned detector |
| OFF-005 | Feed/markup parity gap | shopify_products_missing_from_merchant |
Related standards
See also
Sources
Run a scan against this category
StoreSteady scans public commerce evidence and maps findings back to documented taxonomy terms.
Run a free scan