Section 1
The five challenges at a glance
The protocol landscape consolidated with unusual speed: MCP arrived in November 2024, and within twelve months ACP, AP2, Visa Intelligent Commerce, and Mastercard Agent Pay had all launched (Anthropic, 2024; Stripe, 2025; Google Cloud, 2025; Digital Commerce 360, 2025). Speed creates a familiar operator trap, the technology is real, but the demand projections attached to it are predictions, not measurements. Gartner's widely cited figure that AI agents will intermediate 90% of B2B purchases worth more than $15 trillion by 2028 is explicitly a strategic prediction, published in October 2025 (Gartner, 2025). Meanwhile the measured signal is already meaningful: Adobe Analytics recorded a 393% year-over-year jump in AI-sourced traffic to U.S. retail sites in Q1 2026, with that traffic converting 42% better than non-AI traffic by March (Adobe, 2026; TechCrunch, 2026). The five challenges below separate what is verified from what is forecast, and identify which operators carry the most exposure. The pattern across all five: the standards are public, free, and documented, but the readiness work, structured pricing, checkout APIs, dispute records, sits with the business, not the protocol authors.
Section 2
Challenge one: a fragmented standards stack
Four distinct layers now claim a piece of the agentic transaction, and operators need to know which is which. ACP, co-developed by OpenAI and Stripe and released under an Apache 2.0 license on September 29, 2025, defines how an agent runs checkout against a merchant it does not own, cart construction, delegated payment, and order lifecycle, while the business keeps the customer relationship as merchant of record (Stripe, 2025; OpenAI, 2025). It debuted with Instant Checkout in ChatGPT, starting with Etsy sellers and expanding to Shopify brands, and additional payment providers including PayPal joined within weeks (OpenAI, 2025). MCP sits a layer below. Released by Anthropic in November 2024 as an open standard over JSON-RPC 2.0, it standardizes how AI systems connect to tools and data sources, replacing one-off integrations (Anthropic, 2024). OpenAI adopted it in March 2025, and in December 2025 Anthropic donated it to the Agentic AI Foundation under the Linux Foundation, a strong signal of vendor-neutral permanence (Anthropic, 2025). Google's AP2, announced September 16, 2025 with more than sixty partners including Mastercard, American Express, and PayPal, handles payment authorization through cryptographically signed mandates (Google Cloud, 2025). Visa Intelligent Commerce and Mastercard Agent Pay, both announced in 2025, are the card networks' own agent rails (Digital Commerce 360, 2025). For operators, the practical takeaway: MCP is discovery and connection, ACP is checkout, AP2 and the networks are payment, complementary, not competing, in most stacks.
Section 3
Challenge two: the discovery and readability gap
Before an agent can buy from you, it has to find you, parse your offer, and price-compare you, and most service businesses fail at step two. Adobe's analysis found that even large retail sites, with far more structured data than the average agency or consultancy, lag badly in AI search visibility because their product and pricing information is not machine-readable (Adobe, 2026). For a service firm whose pricing lives in PDF proposals and discovery calls, the gap is wider still. The traffic at stake is no longer hypothetical. Adobe Analytics measured AI-sourced traffic to U.S. retail sites up 1,200% year over year in early 2025, up 693% during the November-December 2025 holiday season, and up 393% in Q1 2026 against that already elevated base (Adobe, 2025; Adobe, 2026). More important than volume is quality: by March 2026, AI-referred visitors converted 42% better than non-AI traffic, a complete reversal from March 2025, when they converted 38% worse, and generated 37% more revenue per visit (Adobe, 2026; TechCrunch, 2026). MCP matters here because it is becoming the default way agents query business systems. A service firm that exposes a scheduling tool, a scoped service catalog, or a quoting endpoint via MCP becomes legible to agents in a way a brochure site never will. The operators winning early are not the ones with the best models; they are the ones whose offers are easiest for someone else's model to read.
Section 4
Challenge three: payment rails, mandates, and delegated authority
The hardest problem in agentic commerce is letting software spend money without creating uncontrolled liability, and the payment layer is where the major players diverge most. AP2's core mechanism is a chain of three signed mandates, Intent, Cart, and Payment, carried as W3C Verifiable Credentials, creating tamper-evident proof of what the human authorized before the agent acted (Google Cloud, 2025). Visa's approach centers on verifying the agent itself through its Intelligent Commerce program, with agent-specific payment tokens and step-up cardholder verification (Visa, 2025). Mastercard's Agent Pay pairs Agentic Tokens with verified user intent (Digital Commerce 360, 2025). Beneath all of these sits an identity question: how does a website know a request really comes from a legitimate agent? Cloudflare's Web Bot Auth proposal, built on the RFC 9421 HTTP Message Signatures standard and undergoing IETF standardization, gives agents cryptographic identities that infrastructure providers can verify (Cloudflare, 2025). Operators should hold two facts in tension. First, the rails are real, funded, and shipping, these are production systems from the largest payment companies on earth. Second, the demand forecasts riding on them are predictions: Gartner's projection of $15 trillion in agent-intermediated B2B purchases by 2028 describes a possible future, and the same firm predicts over 40% of agentic AI projects will be canceled by end of 2027 (Gartner, 2025). Build for the rails that exist; budget against the demand you can measure.
Section 5
Innovative solutions
The encouraging news for resource-constrained operators is that early agentic readiness is mostly content and configuration work, not custom engineering. The first wave of solutions targets readability: emerging conventions like llms.txt files and machine-readable pricing pages let agents parse offers without scraping, and structured-data markup that already exists for SEO does double duty for agent discovery (Adobe, 2026). Stripe's ACP documentation shows that for businesses on modern commerce or billing platforms, protocol support increasingly arrives as a platform feature rather than a build project (Stripe, 2025). The second wave targets trust. Signing up for agent-verification programs as they open, Cloudflare's signed agents registry, the card networks' agent-ready programs, positions a business to accept agent traffic that is cryptographically attributable rather than anonymous (Cloudflare, 2025; Visa, 2025). American Express went further in early 2026, pairing its agentic developer kit with a commitment to cover erroneous purchases made by registered agents in its controlled environment, an early template for how liability may get priced (The Financial Brand, 2026). The third wave is sequencing discipline. Deloitte predicted that 25% of enterprises using generative AI would deploy agents in 2025, doubling toward 50% by 2027 (Deloitte, 2024), meaning agent buyers arrive gradually, segment by segment. The practical move is instrumenting your analytics to detect AI-referred traffic now, so investment scales with observed demand rather than press releases.
Section 6
Solution framework
Treat agentic readiness as four layers, in order of return. Layer one is discovery: can an agent find and understand your offer? This means a crawlable site, structured data, explicit service descriptions with scope boundaries, and pricing an algorithm can parse. It costs days, not quarters, and pays off immediately in conventional AI search visibility, where Adobe's data shows AI-referred visitors now convert better than any other channel (Adobe, 2026). Layer two is transaction: can an agent initiate a purchase or booking without a phone call? For productized services this means online checkout or scheduling with clean APIs; for bespoke work it means a structured intake that an agent can complete on a client's behalf. ACP compatibility flows through your payment platform, so the operator decision is platform choice, not protocol engineering (Stripe, 2025). Layer three is trust: signed-agent verification, clear terms governing automated purchasers, and mandate-style records of what was authorized, the AP2 pattern of provable intent applied at small-business scale (Google Cloud, 2025). Layer four is operations: routing agent-originated orders into your delivery workflow with the same rigor as human orders, including refund and dispute paths. Most firms should complete layers one and two in 2026 and watch layers three and four mature. The framework's discipline is refusing to start layer three before layer one is finished, verification of traffic you cannot convert is wasted spend.
Section 7
Evidence-based action plan
Days 1-30: measure and expose. Add AI-source segmentation to your analytics so you can see ChatGPT, Gemini, Claude, and Perplexity referrals as distinct channels, Adobe's data shows this traffic converting 42% better than baseline, which makes it worth isolating (Adobe, 2026). Publish a plain-language, machine-readable services and pricing page, even if prices are ranges. Audit whether your site renders without JavaScript for crawlers. Days 31-60: make one offer transactable. Pick your most standardized service and give it an agent-completable path: online checkout, deposit payment, or structured booking. If you run on Stripe or a comparable platform, review their agentic commerce documentation to understand what arrives natively (Stripe, 2025). Draft terms-of-service language covering automated purchasers and confirm your merchant-of-record obligations with your payment provider, because under ACP those obligations stay with you (Stripe, 2025). Days 61-90: build the evidence habit. Log what agent-originated buyers were shown, prices, scope, terms, with timestamps, the small-business equivalent of AP2's mandate chain (Google Cloud, 2025). Set a quarterly review of agent-referral volume and conversion, and pre-commit investment triggers: for example, deeper integration only when agent-referred revenue passes a defined threshold. This keeps you positioned for the future Gartner predicts, 90% of B2B buying intermediated by agents by 2028, without betting the budget on a forecast (Gartner, 2025). For adjacent evidence in this pillar, see [AI Agents as Employees: Orchestrating Agent Workflows Inside a Service Business](/blog/growth-ai-agents-as-employees-service-business-orchestration) and [The Trust Problem in Agent Transactions: Liability, Verification, and Dispute Evidence](/blog/growth-agent-transaction-trust-liability-verification).