Visa introduced its Trusted Agent Protocol on October 14, setting out a way for online merchants to distinguish authorized shopping agents from untrusted automated traffic. The framework was developed with Cloudflare and published for developers to examine and implement.
According to Visa’s announcement, the protocol lets an agent present cryptographically signed information about its identity and the purpose of a visit. The aim is to help a merchant recognize a legitimate shopping request without treating every automated interaction as a bot to block.
Identification before payment
The proposed messages can carry agent intent, information for recognizing a consumer and, where relevant, payment details. Visa describes support for both guest checkout and visits involving an existing customer account.
These are separate questions. A merchant may need to know which agent is making a request, whether the customer is recognized and what the agent is trying to do before it can decide whether to accept a payment. A signature supplies evidence that can be checked; it is not a guarantee that the purchase is risk-free.
Visa says the design draws on HTTP Message Signatures and the Web Bot Auth approach. Using web-oriented mechanisms could make the identity check fit into infrastructure that merchants already use to manage automated requests.
One part of a larger checkout process
The initial specifications focus on the Visa network. Visa also discusses compatibility with other commerce efforts, including the Agentic Commerce Protocol, and collaboration around Coinbase’s x402 payment work.
That does not make all of these standards interchangeable. Merchant recognition, purchase authorization and payment execution solve different problems, and an implementation may need several pieces.
The announcement is a protocol release, not evidence that every Visa merchant now accepts autonomous purchases. Deployment still depends on agents, merchants and payment providers agreeing how to implement and validate the messages.
For a retailer, the practical test will be whether a recognized agent can reach checkout, carry the customer’s permitted request and complete the purchase under the retailer’s existing controls.
