Authenticate 2026 closes today with its busiest day yet for agentic AI. A morning session asks who’s on the hook when things go wrong, Mastercard covers Verifiable Intent, and PayPal looks at proving the human consent behind agent-driven crypto payments.
Together, today’s sessions tackle what it will take for the agentic economy to truly take off. And the answer keeps coming back to trust: every transaction an agent makes must be rooted in verified human approval, traceable to the person who granted it, and within the limits they set. This afternoon’s closing keynotes, with Dave Birch, Mastercard, PayPal, EMVCo, JPMorgan Chase and FIDO, look at the road ahead.
A huge opportunity
AI agents are already booking travel, comparing prices and making purchases. Mastercard has launched Agent Pay, and Visa has seen agent-initiated transactions go from pilot to real deployment within a year. Analysts including McKinsey estimate that agentic commerce could orchestrate $3 trillion to $5 trillion in global transactions by 2030. But the missing piece isn’t capability. It’s trust.
The trust gap
Right now, a merchant or bank has no reliable way to trace an agent’s action back to the person who authorized it. If an agent simply presents someone’s stored credentials, the merchant can’t tell a legitimate purchase from a hijacked one, or a responsible agent from a rogue one. Without that link back to a real person, there’s no chain of trust for agentic commerce to build on.
We’ve solved problems like this before
Online shopping took off once encryption and the browser padlock gave people a reason to trust a website with their card number. EMV chips cut in-person card fraud by around 70%. OAuth showed that limited, revocable delegated access can work at internet scale. Each time, trust came from open standards that the whole industry adopted.
It starts with a verified human
As we set out yesterday, verified human identity is the foundation all of this sits on. Once a service can prove that a real person stands behind a sign-in or transaction, whether they act directly or through an agent they’ve authorised, the agentic economy can become a reality.
What that looks like in practice
Imagine asking your agent to find a one-bedroom apartment close to your new job and within your budget. It finds three that fit and applies to them on your behalf. Then it finds a fourth with an ocean view, 40% over budget. That one is outside its authority, so it asks you first. You approve it with a passkey. The landlord receives proof that you said yes, along with exactly what they need: your ID, your right to rent and proof of income from your offer letter.
Three things make that possible:
- Verifiable user instructions. You authorize your agent through phishing-resistant mechanisms, so it performs only the actions you’ve approved, including transactions, without ever exposing your credentials.
- Agentic authorization. Your agent can sign in on your behalf in a controlled way, without needing your credentials, and with transparency, auditability and the ability to revoke access.
- Trusted delegation for commerce. Agent-initiated transactions stay within boundaries you control, with verifiable authorisation built for commerce and payment flows.
No single company can solve this
Agentic commerce involves AI platforms, merchants, issuers, payment networks, wallets and regulators, and trust has to carry across every handoff between them. No single company can build that, and none should try. That’s why this work is happening through the FIDO Alliance and why the industry needs to move quickly.
That’s a wrap on Authenticate 2026. Thank you to everyone who joined us in Carlsbad. Catch up on coverage from Monday, Tuesday and today’s coverage on AuthenticateCon.
