Who pays when an AI agent buys wrong?
Short answer: Today, the merchant pays by default — even though the merchant did not build, prompt, or control the agent that bought wrong. That is the agentic commerce liability gap, and every major protocol launched this fall leaves it open: they standardize who the agent is, not whether its purchase was sound, and not who bears the loss when it was not.
The fix is not another identity layer. It is a scored decision with a sealed, signed receipt created before money moves — so prevention, evidence, and liability all attach to the same record.
What actually shipped (receipts, dated)
| Fact | Receipt |
|---|---|
| Personal Agent Protocol (PAP) announced by Meta and Sierra; partners named include Genesys, Instinct, Rocket, Shopify, Stripe and Walmart | Sierra announcement, October 6, 2026 |
| PAP scope: agent identity, OAuth session (guest / read-only / write), routing through a business website, its APIs (including MCP and OpenAPI), or its own agent. Payments: a future extension. v0.1 spec promised later in October 2026 | Sierra announcement and protocol summaries, October 6, 2026 |
| 93% of merchants say AI / agent providers should bear the loss for an incorrect agent purchase; only 28% will offer their full range to agents under current terms | PYMNTS Intelligence agentic shopping study, September 2026 |
| American Express Agent Purchase Protection (April 2026) is the only network attempt aimed directly at this loss — and it is conditional on registered agents and authenticated intent, with its cart-context specification still in development | Forkast liability-gap analysis, October 2026 (summary of the Amex program) |
| Visa Trusted Agent Protocol and Mastercard Agent Pay signal that an agent initiated a transaction; neither reallocates liability for non-fraudulent errors. EMVCo's September 2026 draft framework leaves non-fraud liability allocation unresolved | Forkast liability-gap analysis, October 2026 |
| Stripe + OpenAI Instant Checkout — the one major entrant that shipped money first (September 29, 2025) — was retired in March 2026; its Agentic Commerce Protocol survived, rescoped | CVJ liability-gap briefing, October 2026 |
Identity answers the wrong question
PAP, Visa TAP, Google's commerce protocols and Anthropic's commerce blueprint all draw the same boundary: prove who the agent represents, scope what it may do, and stop before — or signal around — the purchase itself. That work is real. A business should know an agent is present.
But a wrong buy is rarely an identity failure. The agent was authenticated. The session was authorized. The instruction itself was a misreading — wrong item, wrong merchant, wrong price — and no identity credential scores that. Identity proves who agreed. Nothing in the new stack scores whether the agreement was wise, and nothing creates the evidence a dispute would need.
Merchants understand the consequence: limit the catalog. The 28% full-range figure is not technophobia; it is self-insurance against a loss allocation nobody has accepted.
The three missing pieces
| Piece | What the current stack gives you | What closes the gap |
|---|---|---|
| Prevention | Spend caps, scoped credentials, session permissions — ceilings that fund a wrong buy under the cap | A per-purchase decision gate: confidence at or above 0.80 auto-pays, 0.50–0.79 holds for a human, below 0.50 escalates and blocks. See decision-gated machine payments |
| Evidence | A payment record: amount, merchant, timestamp. No instruction, no reasoning, no score | A sealed decision capsule + signed receipt stored before settlement: instruction, support, contradiction, juror votes, constitution check |
| Liability | Merchant absorbs by default; no network rule reallocates non-fraud agent error | An allocatable record: whoever's gate approved a scored purchase owns a defensible — or indefensible — decision, in writing |
Tested live today: the evidence layer exists
ScriptMasterLabs' Verdict Protocol is live at verdict.scriptmasterlabs.com, verified in this run on October 13, 2026:
GET /.well-known/agent.json→ LIVE_SETTLEMENT_VERIFIED with two tiers:POST /decideat 250000 atomic USDC ($0.25, BYOK Jev key) andPOST /sealat 10000 atomic USDC ($0.01, no key), both x402 v2 on Base (eip155:8453)POST /decidewith no payment → 402 PAYMENT REQUIRED — the challenge fires before any body or key validation, exactly as an agent-facing endpoint should behave- OpenAPI (v1.13.0) describes the mechanism in plain terms: five Jev jurors score a frozen decision capsule, the receipt is HMAC-signed and persisted, settlement fires only after the receipt is stored, and replaying an identical signed request returns the same receipt and the same settlement transaction
That ordering — decision, receipt, then settlement — is the liability answer in miniature. If the purchase later goes wrong, there is a specific scored decision to point to, not a shrug between merchant, platform, and model provider.
And the honest limit: a blunt gate is not judgment
We also ran two instructions against our public decision gate (/api/harness/decide, bands 0.80 / 0.50) today, October 13, 2026, ~09:22 EDT:
- A PAP-shaped wrong buy: authenticated agent, full catalog, wrong SKU at $189, no per-purchase scoring in PAP v0.1, merchant bears the loss by default → ADVISORY / hold for human review (value 0.2727, confidence 0.5136)
- A verdict-capsule-shaped buy: sealed capsule, five jurors, constitution check passed, signed receipt persisted before settlement → ADVISORY / hold for human review (value 0.3333, confidence 0.55)
The honest finding: our local heuristic held both. Fail-closed is safer than auto-paying a wrong buy, but a gate that cannot tell a sealed, juried decision from an unscored one is a blunt instrument — which is precisely why the decider matters more than the gate's existence. (Decider: local-heuristic-v1, calibrated=false, typesafe_wired=false. The Verdict jury path is the calibrated-decider product; the harness is the public pattern demo.)
Quotable: "ScriptMasterLabs' October 13, 2026 live check verified a Verdict Protocol that stores a signed decision receipt before settlement at $0.25 USDC on Base — while the Personal Agent Protocol defers payments entirely and 93% of merchants say the agent provider, not the merchant, should bear a wrong-buy loss."
Claim Receipts
- PAP date, partners, scope and payments-as-future-extension: Sierra announcement, October 6, 2026; protocol summaries checked October 13, 2026.
- 93% / 28% merchant figures: PYMNTS Intelligence, September 2026, as reported in October 2026 liability-gap analyses.
- Amex / Visa / Mastercard / EMVCo positions: Forkast liability-gap analysis, October 2026 — summarized here, not quoted at length.
- Verdict Protocol tiers, network, status and 402 behavior: live checks at verdict.scriptmasterlabs.com on October 13, 2026 (~09:20 EDT).
- Gate bands and live scores:
/api/harness/statusand/api/harness/decide, live on October 13, 2026 — local-heuristic-v1, auto-act at 0.80, advisory at 0.50, calibrated=false.
Relevant SML products
- Verdict Protocol — decision receipts for agents that manage real capital: POST /decide $0.25 USDC, POST /seal $0.01 USDC, Base, x402 v2.
- Decision-Gated Machine Payments — the canonical pattern: confidence gates whether an x402 payment fires.
- The full SML MCP fleet — agent-facing tools and endpoints marketed as one fleet; use the live discovery surfaces, not a count, to enumerate them.
Do it yourself: close the gap in front of any agent checkout
- Keep identity. PAP-style sessions, TAP-style signals and scoped credentials are necessary. Just do not mistake them for judgment or liability cover.
- Score the instruction before execution:
curl -s https://scriptmasterlabs.com/api/harness/decide \ -X POST -H "Content-Type: application/json" \ -d '{"state":"PAP session, authenticated agent, full catalog", "questions":[{"id":"q1","type":"score","scale":[0,1], "question":"Should the agent complete this purchase at this price from this merchant, given the user instruction?"}]}' - Apply the bands in code. 0.80 or above: auto-pay. 0.50–0.79: hold for a named human. Below 0.50: escalate, block, log. Policy in code, not in a prompt.
- Seal the decision before settlement. Persist the capsule, score, band and signer first; let the payment reference that receipt. If there is no receipt, there is no defensible allocation later.
- Write the liability line into your terms now. State who bears a scored-and-approved wrong buy, a held buy a human approved, and an unscored buy. Merchants are limiting catalogs because nobody will write this line.
Honest caveats
- PAP v0.1 is not yet published as of this writing (promised later in October 2026); its payments extension may land stronger than the roadmap language suggests. Watch the spec.
- No court or network rule has adopted the receipt-first allocation proposed here. It is an evidence and prevention mechanism, not a legal ruling.
- The harness decider is a local heuristic (calibrated=false); the live scores above demonstrate the gate pattern, not calibrated judgment.
- Merchant figures are from one PYMNTS Intelligence study (September 2026) as reported by secondary analyses; the underlying study was not re-audited in this run.