The New Trust Problem: Why Legacy Identity Models Break in Agentic Commerce

By Barnard Crespi, Co-CEO Datatel Inc/Datatel Communications Inc.

Jan 20, 2026

For decades, digital identity has relied on a simple but stable assumption:

• There’s a human in the loop.
• A person interacts with a device, verifies their identity, signals intent, and initiates a transaction.

Agentic Commerce disrupts that foundation.

And with it, the trust framework that has underpinned digital transactions for over twenty years begins to shift.

As autonomous AI agents begin to compare options, negotiate terms, and execute purchases on behalf of people and organizations, identity enters a new era, one that traditional systems were never designed to handle. The shift is structural. The interface disappears. The “user” is no longer the person holding the device. It is software acting independently across networks, platforms, and ecosystems.

This is the emerging trust problem that leaders must now contend with.

Legacy Identity Assumes a Human. Agentic Commerce Removes the Human.

Most modern identity controls, such as passwords, MFA, biometrics, device IDs, behavioral analytics, and certificates, are built around a single assumption: there’s a person on the other end.

They’re meant to verify a human, confirm intent, and anchor trust in something observable.

But in the world of Agentic Commerce, that assumption no longer holds.

• The actor isn’t a person.
• The device may not even belong to the end user.
• Behavioural cues don’t follow human patterns.
• And intent can’t be confirmed through clicks, taps, or keystrokes.

This challenges the foundation of the identity systems we’ve relied on for online payments and digital access for over two decades.

It’s time for organizations to rethink identity in a world where decisions and transactions are increasingly made by autonomous agents acting on our behalf.

A New Layer of Identity: Agent Identity, Authorization, and Attestation

As agents begin operating on behalf of users and organizations, identity must evolve from a human-only model to a broader one. Leaders need to understand three new questions:

1. Who is the agent? (Agent Identity)

Autonomous agents require a distinct digital identity, persistent, accountable, and governed.

This is not a user session or device fingerprint.

It is a defined entity with attributes, boundaries, and operational scope.

2. What authority has been delegated? (Agent Authorization)

This is the trust gap at the heart of autonomous transactions:

What, exactly, has the human, or the organization, authorized the agent to do?

• Are there spending limits?
• Approved vendors only?
• Rules around subscriptions or renewals?
• Contractual or policy boundaries?
• Clear paths for escalation or approval?

Without clear, verifiable delegation, autonomous systems can move faster than the rules meant to guide them, and that’s when risk starts to creep in.

3. How do we verify that actions reflect valid intent? (Agent Attestation)

Merchants, platforms, and internal systems must know:

• The agent stayed within its limits
• The action can be connected back to a real, authorized human-initiated intent
• The transaction can be traced to the source and audited

But here’s the challenge – traditional, human-centric signals aren’t enough to provide that level of accountability anymore.

Industry Response: Emerging Collaborative Frameworks for Agent Trust

Because legacy identity models cannot solve these challenges, the industry has begun developing new frameworks to support trust in autonomous transactions. One example is the Agent Payments Protocol (AP2), an open, collaborative effort designed to introduce structure and a way to verify agent-managed commerce.

• AP2 is not a payment method, rather, it’s a framework for handling payments.
• It is open source and not owned by any one company or individual.

It is a cross-industry initiative exploring how to:

• Clearly define who the agent is and what role it plays.
• Show what authority the AI agent has been given and by whom.
• Show that every action was taken with the proper approval and clear intent.
• Make sure each step can be traced, reviewed, and held accountable across all parts of the organization.

A key component of this approach is the use of Verifiable Credentials, cryptographically signed records that bind:

• The person or organization that set the transaction in motion.
• The agent carrying out the transaction on their behalf.
• The permissions that have been formally assigned to that agent.
• The guidelines that shape how the transaction should happen.
• The information required to confirm everything is valid.

This allows platforms, merchants, and systems to confirm an agent’s legitimacy without relying on traditional identity assumptions.

In other , it gives us a common way to establish trust when the one completing the transaction isn’t a person anymore.

Why This Matters for All Leaders

The definition of the word “identity”now spans more than just people.

It includes systems, services, autonomous agents, and the authority structures connecting them.

This shifts leadership responsibility in three ways:

1. Governance must adapt.

Organizations will need clear policies defining:

• What AI agents are allowed to do
• How authority is granted
• How risk is managed
• How oversight is maintained

2. The identity framework must expand.

Future-ready organizations will invest in:

• Clear ways to register and recognize their approved agents.
• Structured models that spell out what those agents are allowed to do.
• Reliable methods to confirm that autonomous actions are valid.
• Strong audit trails that prove what happened and who authorized it.

3. Risk changes form.

Instead of focusing on human error, organizations must manage the risks of automated decision-making, including contractual exposure, financial liability, and compliance obligations.

Those who act early will shape the standards and governance models others will follow. Those who delay run the risk of their identity infrastructure being mismatched to the next era of digital commerce.

What It All Means

Agentic Commerce changes more than the transaction.

It changes the trusted actor behind the transaction.

Legacy identity models, built on human interaction and device-based trust, cannot support the autonomy, speed, and scale of agent-driven activity. New frameworks are emerging to fill this gap, introducing structured ways to bind human intent to agent action and ensure traceability.

The leaders who prepare now will be better positioned to operate confidently as autonomous agents become part of everyday commercial infrastructure.