Frontier spoke

Agent Commerce Orchestration — which checkout stack agents can transact through

Agent Commerce Orchestration is whether your stack supports at least one of the converging agent-commerce protocols — ACP (OpenAI + Stripe, Shared Payment Tokens) or UCP (Google + Shopify, cryptographic Mandates over MCP / A2A / AP2 transports). Most merchants will adopt through their platform, but they have to opt in. Picking neither is the failure mode.

By Chris Mühlnickel · 2026-05-16

What is Agent Commerce Orchestration?

Agent Commerce Orchestration is whether a merchant's checkout supports at least one of the converging agent-commerce protocols — ACP (OpenAI + Stripe) or UCP (Google + Shopify) — so an AI agent can transact on a user's behalf with verifiable consent and without breaking PCI scope.

By the numbers

Why it matters

Agent commerce in 2026 looks like the original web in 1996 — two competing stacks, both shipping, both routing real revenue, and a wide-open question about which merchants are reachable. The orchestration layer is where that question is answered. ACP and UCP are the two stacks; ChatGPT Shopping uses ACP, Google's agent surface uses UCP, and the merchants reachable by each are the ones that opted into the corresponding protocol. The merchant who supports neither is invisible to both agent-commerce funnels.

The two stacks are converging, but the act of picking up matters now. ACP and UCP look like rivals in the press; in the spec they share more than they differ. Both solve the same two problems: prove the agent is acting with verifiable user consent, and authorize the payment without breaking PCI scope. ACP solves it with Shared Payment Tokens that keep credentials at the AI platform. UCP solves it with cryptographic Mandates and Verifiable Digital Credentials carried over MCP and A2A. The Linux Foundation's Agentic AI Foundation is positioned as the venue where these stacks cross-compatibilize. The merchant question is not "which stack wins" — it's "are you on at least one of them today, while the rosters are still being learned."

Most merchants adopt through their platform, but the platform won't do it without permission. Shopify reports 1M+ U.S. merchants eligible for UCP at launch — eligibility is not enrollment. Stripe makes ACP available to every merchant on Stripe Checkout — availability is not configuration. The merchant who treats agent commerce as "my platform will handle it" without flipping the toggle ends up eligible-but-unenrolled, which renders identically to unsupported. The work is real but small: opt in, configure which products are eligible, decide on the chargeback posture, ship.

The prerequisites are non-negotiable. No orchestration protocol can work if the underlying checkout is hostile to agents. Guest checkout has to function end-to-end — mandatory account creation defeats current-generation agent checkout. Product pages need valid Schema.org/Product markup so the agent can read price and stock without scraping the DOM. Bot-fingerprinting at the cart or payment layer — the kind that Cloudflare bot-fight mode and Akamai bot manager apply by default — will block the agent before any protocol gets to negotiate. The orchestration layer rides on top of basic agent-friendliness; without it, ACP and UCP support is theatre.

The routing roster compounds. Agent shopping systems are explicitly trained to skip non-functional sites and re-route to merchants that completed a transaction last time. The brands already in pilot rosters — Etsy, Walmart, Instacart, URBN, SKIMS, Glossier, Coach — earn disproportionate routing because they're known-good. Tomorrow's defaults are being set today, and the cost of being late is not a single missed sale; it's progressive removal from the category.

Where it's heading

Cross-compatibility between ACP and UCP lands in 2026-2027. The Linux Foundation's Agentic AI Foundation, announced in December 2025 with eight platinum members (AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, OpenAI), is positioned as the venue for this convergence. ACP already supports REST and MCP transports; UCP adds A2A and AP2. Expect partial cross-compatibility — a UCP-authorized agent presenting a Mandate that an ACP-mediated checkout can accept, and vice versa — before either declares victory.

Merchant tooling proliferates. Shopify, Stripe, Adobe Commerce, BigCommerce, WooCommerce, and Salesforce Commerce Cloud all have agent-commerce roadmaps for 2026. The pattern is the same across platforms: surface a one-click toggle, expose configuration for product eligibility and chargeback posture, abstract the protocol details. Custom-stack merchants will have more control but more work; platform-mediated merchants will compound faster as their platform handles protocol versioning.

Surfaces stabilize and defaults harden. ChatGPT Shopping, Perplexity Shop, Gemini Shopping, and Claude commerce are converging on small sets of "default" merchants per category — outdoor gear, beauty, home goods, etc. Once those defaults stabilize in 2027-2028, displacement gets harder. The reason this Frontier is "act now" and not "watch carefully" is that the cost of late entry compounds at two layers: the protocol layer (you have to retrofit) and the routing layer (the agent's parent system already learned defaults that aren't you).

Identity-for-agents standards mature underneath. The next layer of work — delegated authorization (scoped credentials the user grants an agent), capability tickets (the agent presents proof of authorization for a specific action), agent-specific KYC — is in active development across the same vendor coalition. These primitives sit beneath both ACP and UCP and unblock harder transaction types (high-ticket, regulated, B2B) that today's protocols handle uncomfortably.

Regulation arrives, probably from the EU first. Agent-initiated transactions raise consumer-protection questions (consent durability, chargeback exposure, age verification) that PSD3 in Europe and state-level AGs in the U.S. are starting to look at. Expect 2027-2028 to bring agent-specific authorization rules that the existing protocols largely already comply with — but merchants who hand-rolled their own integrations may have to retrofit.

Common mistakes

  • Waiting for the dust to settle. The dust does not settle in 2026 in a way that lets a merchant skip implementation. Two protocols converging is the dust settling. Pick one and ship.
  • Accepting ACP but refusing UCP (or vice versa). Each protocol corresponds to a distinct agent-routing surface. Refusing one removes the merchant from half the agent-commerce funnel for no benefit — the protocols don't conflict at the merchant layer.
  • Refusing all bot-UA traffic on checkout. Default 'block bots at the cart' CDN config (Cloudflare bot-fight mode, AWS Shield, Akamai bot manager) blocks legitimate agents before any protocol gets to negotiate. The fraud team thinks they're protecting the site; they're routing it out of agent-driven shopping.
  • Hand-rolling agent integrations instead of using the protocols. The protocol layer exists so merchants don't have to implement per-agent shims. Custom integrations don't compound; protocol support does. Hand-rolled also means hand-maintaining when each agent platform ships a breaking change.
  • Mandatory account creation at checkout. A prerequisite for current-generation agent checkout is functioning guest checkout. If the account-creation step is required to complete the purchase, the agent-conversion path is eliminated regardless of protocol support.
  • Treating platform eligibility as platform enrollment. Shopify merchants are eligible for UCP at launch — that does not mean their store is enrolled. Stripe merchants are eligible for ACP — that does not mean their checkout has it configured. The toggle has to be flipped.
  • No machine-readable product data. Missing or malformed Schema.org/Product markup forces the agent to scrape the DOM for price and availability. Most agents will fall back to a different merchant rather than risk a stale price at checkout.

Frequently asked

What is ACP and what is UCP — and why are there two?

ACP is the Agentic Commerce Protocol from OpenAI + Stripe, launched September 2025. It uses Shared Payment Tokens — tokenized credentials that stay with the AI platform so the merchant never sees raw card data. UCP is the Universal Commerce Protocol from Google + Shopify, launched January 2026. It covers the full commerce journey across REST, MCP, A2A, and AP2 transports, using cryptographic Mandates for user-consent proofs. There are two because OpenAI and Google each own a major agent surface and a major payment partner. They're solving the same problem (verify agent consent + authorize payment without breaking PCI) and will likely cross-compatibilize.

Do I need to support both ACP and UCP, or can I pick one?

The honest answer for 2026 is: support whatever your platform exposes, and don't refuse the other when it ships. Stripe Checkout merchants get ACP. Shopify merchants get UCP. Adobe Commerce, BigCommerce, WooCommerce, and Salesforce Commerce Cloud are exposing one or both through their roadmaps. Picking neither is the failure mode — picking one and refusing the other is the second failure mode.

Will my merchant platform handle this for me?

Mostly, yes — but you have to opt in. Shopify reports 1M+ U.S. merchants eligible for UCP at launch, but eligibility is not enrollment. Stripe's ACP is available to any merchant on Stripe Checkout. The platform handles the protocol implementation; the merchant configures whether agent transactions are allowed and which products are eligible.

What's the difference between an orchestration protocol and a payment network?

Orchestration covers the full commerce journey — discovery, cart, checkout, fulfillment — including the moment payment is authorized. The payment-network layer (covered in Agent Payment Networks) is the cryptography that proves the agent is authorized to spend on the user's behalf at the moment of payment. ACP and UCP are orchestration protocols; AP2, Visa Trusted Agent, and Mastercard Agent Pay are payment-network primitives that ACP and UCP ride.

What do I have to get right before any orchestration protocol can work?

Guest checkout has to work end-to-end. Product pages need valid Schema.org/Product markup with price, availability, and offers. No bot-fingerprinting at the cart or checkout layer — most sites in our calibration corpus break here. Prices and stock need to be server-rendered or available via OpenAPI-style endpoints. If those four are wrong, ACP or UCP support doesn't matter — the agent gives up before it reaches the protocol layer.

If I refuse agent transactions, what do I lose?

Routing inside the agent surface. Agent shopping systems (ChatGPT Shopping, Perplexity Shop, Gemini Shopping) learn which merchants accept transactions and route there next time. Refusing once tends to compound — the agent's parent system treats the merchant as a negative prior. The cost is not a single missed sale; it's progressive removal from agent-routed traffic across the category.

Are the protocols stable enough to implement against today?

ACP shipped 1.0 in September 2025 and is in production at Stripe-mediated merchants including Etsy, Walmart, and Instacart. UCP launched at NRF 2026 with Shopify and a partner roster. Both are versioned, both have official SDKs, both have running deployments. The convergence layer (cross-compatibility, shared identity primitives) is the part that's still moving — but a 1.0 implementation against either today is durable.