On 8 September 2026, Meta launched Muse. On 29 September 2026, OpenAI launched dots. In September, Instinct, the personal agent you text like a friend, gave every user its own email address so the agent could open accounts on their behalf.
All three do something your website has never had to deal with: they shop for the customer without the customer turning up.
For the last couple of years, AI has been researching, comparing and recommending. That was the easy bit. What’s new is that agents now fill in the forms, create the accounts and pay. Muse checks out using a one-time card from Stripe’s Link. Instinct can create and run its own accounts and has plugged into Shopify’s merchant network and Shop Pay. And Muse went straight to the top of Apple’s US App Store, ahead of ChatGPT.
This is agentic commerce. It is no longer a slide in somebody’s keynote.
So here is the uncomfortable question for every brand and retailer. If an agent does the research, builds the shortlist and completes the purchase, what is your website for? And what happens when the only thing that ever “visits” it is a bot reading your product data?
The brands that have thought about this are quietly rebuilding their foundations. The rest are still optimising for a shopper who isn’t coming.
Six stages of AI-mediated buying
Here is the framework I use to think about it:
- Research
- Evaluate
- Shortlist
- Recommend
- Purchase
- Advocate
Since ChatGPT arrived, AI has been doing steps one to four. ChatGPT, Google AI Overviews and AI Mode, Gemini, Claude and Perplexity research the market, weigh the options, build a shortlist and recommend alternatives for the shopper to buy. Brands have spent the past two years worrying about that, quite rightly.
Step five is what changed this autumn. Muse, Dots and Instinct don’t stop at the recommendation. They complete the purchase.
Step six is the one almost nobody is talking about, and I think it changes the economics. Advocate. When you tell your agent the product was brilliant, or the delivery was a disaster, it doesn’t just file that away. It sets your preferred retailers and brands. It can even leave reviews on your behalf. And all of that feeds straight back into the next round of research, evaluation, shortlisting, recommendation and purchase.
The agent learns from you: what you like and dislike, where you’ve had a good or bad experience, which products turned out to be reliable. It can also learn from every other consumer on the same platform buying similar things. An AI agent may write the review, but it’s grounded in a real purchase by someone who paid for the product, so I expect this network effect to strengthen over time, not weaken.
So the loop closes. In the old model a brand won or lost a shopper at a moment in time. In the agent model, a brand wins or loses a place in the agent’s memory.
One shopper, several agents, no common language
Consumers won’t have one agent. They’ll have one for work and another for home. Perhaps a family agent that runs the family schedule and the weekly shop, while each family member may have their own as well. Those agents may or may not talk to each other. You will want all of them to talk to your brand or store.
Which raises a dull but critical question: how does an agent introduce itself to a business, and what is it allowed to do when it gets there?
Right now the answer is that it signs in as the customer and clicks through pages built for humans. The business either blocks it or lets it do anything the customer could. The protocol’s own website calls this “all or nothing”. Amazon chose to block Muse 12 days after launch, saying the agent hadn’t identified itself while browsing and appeared to capture and store customer credentials.
Enter the Personal Agent Protocol (PAP). Sierra and Meta announced it on 6 October, working with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart. It is an open standard built on OAuth. A business publishes a small file telling agents how to connect, and decides whether they come in through its website, its APIs or an agent of its own. It also gives the business a way to see what agents are actually doing. Sierra published a draft of Personal Agent Protocol on 9 October 2026. The protocol is now at draft version 0.3. Payments, push notifications and finer permissions were identified as future extensions in the announcement.
Three things worth knowing:
- It’s very early. A draft spec and a list of launch partners. It could move quickly, as MCP did, or it could stall.
- It isn’t the only game in town. OpenAI’s Agentic Commerce Protocol, Google’s Universal Commerce Protocol and Visa’s Trusted Agent Protocol are all live, and Shopify and Stripe have a foot in several camps.
- Amazon isn’t on the published partner list. Nor are Anthropic, Microsoft or Salesforce.
Having used some of these first-generation personal agents, I would start asking your engineers to look at how you can support PAP. I’ve encountered numerous issues attempting to get Instinct to complete transactions on my behalf – eCommerce stores and anti-block measures are a major hurdle to the effectiveness of these agents. But for the consumer, it doesn’t matter too much, as the agent will just recommend buying from another store. Your inability to accept purchases from AI agents may not be costing you a lot of money right now, but it will in the future if you don’t address it.
More urgently, right now, put your own website through an agentic harness to find the roadblocks, dead ends and things that will trip agents up. We’ve tested UX and usability on humans for years. This is the same discipline, for agents. And it’s more than an agentic reading test. It means live agents looking for a product on your site: searching, browsing, adding to cart, creating an account, checking out as a guest, checking availability, using click and collect. Every journey, for every agent.
If setting up an agentic test team is of interest, get in touch with your Rezolve account manager.
As for picking a winner: don’t.
Whoever wins, the practical message is the same. Every one of these protocols assumes your product data is accurate, structured and machine-readable. Which brings us to the bit brands can actually control.
What actually changes when AI sits between you and the shopper
AI-mediated commerce is what happens when a third-party AI platform or agent (ChatGPT, Gemini, Perplexity, Muse, Instinct and friends) enters the journey before the shopper has decided where to buy. It compares products across brands, makes the recommendation and, increasingly, completes the purchase.
That is different from conversational AI on your own site, where you control the experience, the product data and the flow. Here the intermediary is somebody else’s system, working from whatever product data it can find. Your influence is indirect, and it runs entirely through the quality and structure of your catalogue.
That relocates the control point. Brands are used to owning the conversation once a shopper arrives. In AI-mediated discovery that conversation happens somewhere else, and you either show up accurately or you don’t.
| Journey stage | Traditional journey | AI-mediated journey |
| Research | Shopper searches Google or visits a brand site | Shopper asks an AI assistant, often in a long, conversational prompt |
| Evaluate | Shopper browses several brand sites and reads reviews | AI compares options across the web using whatever product data it can read |
| Shortlist | Shopper builds their own shortlist | AI narrows the field to a handful of brands. In our own volatility research at Rezolve the average number of brands listed is 2.9 |
| Recommend | Shopper decides from product pages, reviews and a friend’s opinion | AI recommends one or two options and explains why |
| Purchase | Shopper navigates to checkout on your site | Agent fills in the forms, creates the account and pays, sometimes without ever visiting your site |
| Advocate | Shopper might leave a review, tell a friend, or not | Agent remembers the experience, updates preferences and may post the review itself |
In a traditional journey you get plenty of touchpoints to shape the outcome, correct a misimpression and nudge a shopper towards the basket. In an AI-mediated journey those touchpoints collapse into one: the moment the machine reads your product data.
Bad data doesn’t just mislead. It gets you skipped.
If your data is out of date, misattributed or difficult to parse, erroneous information is likely to be regurgitated back to the consumer, or ignored by the AI assistant entirely.
A shopper is told a product is out of stock when you have plenty. A size range is described wrongly. A competitor is surfaced instead of you because the AI found a cleaner match elsewhere.
The nasty part is that all of this happens upstream of your website. There is no bounce, no abandoned basket and no angry email. Just a customer you never met, choosing someone else, and an analytics dashboard that shows nothing wrong.
Four risks worth taking seriously
Most brands worry about discoverability, and fair enough. But it’s only one of four things that can go wrong.
| Risk | What happens |
| Invisibility | Your products don’t appear in AI-generated results. Discovery flows to brands whose data is better structured and easier for AI systems to read. |
| Substitution | Incorrect, missing or misaligned product data causes the AI engine to swap your product listings or images for an alternative from a competitor. |
| Misrepresentation | Your products appear with inaccurate attributes, outdated pricing or incomplete variants. The shopper’s first impression is set before they’ve met your brand. |
| Disintermediation | Even when you’re visible and accurate, the customer relationship belongs to the AI platform. Check out in Muse or Instinct and you may be the merchant of record, but you never met the customer. First-party data, direct communication and loyalty all follow the relationship. |
We’ve seen these happen in our own testing. We built Agent Probe, a realistic online store whose only job is to record how AI assistants read it. On 19 October 2026, we sent five assistants to the same product page and logged every request.
- Substitution. When ChatGPT didn’t load our cover image, it showed a rival publisher’s cover beside our product, in two separate runs. Perplexity, unable to read the page, offered a competing book from another publisher, linked to Amazon, with its ISBN.
- Misrepresentation. Gemini named the printer as the publisher, because it appeared in the image alt text, and named our store as the seller, because the real seller was loaded by JavaScript.
- Invisibility, blamed on you. Copilot and Perplexity’s free tier never requested the page at all, then told the user the site was blocking them or had returned nothing readable. Logged-in ChatGPT told the user a page it had read “could not be fetched again”, on a re-check that never reached our server.
None of it shows up in a merchant’s own analytics. These are first-pass results, with one run per agent (four for ChatGPT, two for Claude), and our product title resembles real books, which probably made substitution easier. Treat them as strong signals, not settled behaviour.
The compounding effect across all four is why the infrastructure question belongs in this quarter’s plan, not next year’s.
And you can already see it in the numbers. In late 2024 Bain estimated that zero-click behaviour was cutting organic traffic by 15 to 25 per cent. That was a forecast. Nearly two years on, LEAP and SISTRIX found the median SEO visibility of top German e-commerce shops fell 16.7 per cent in a single year, after three years of growth. Different measures and different markets, but the direction of travel is the same.
The infrastructure question brands should be asking
Most of the debate is about the AI. Which models are recommending? What can they do? How do they rank things? That is the wrong starting point for a brand, because you can’t change how ChatGPT ranks. You can change what it reads.
The better question is: what does an AI system need in order to represent my products accurately?
Shoppers are telling AI far more than they ever told a search box
Google says the average AI Mode query is three times as long as a traditional search. Our own research points the same way: 85% of Grok conversations and 75% of ChatGPT conversations run longer than 10 words.
People are describing the occasion, the budget, who it’s for and what went wrong last time. “Warm waterproof jacket” has become “a jacket for my dad’s 70th, in bright fluorescent colours, because he walks really early in the morning when it’s dark, or late at night”.
If your feed can only answer “yellow jacket”, you lose to the one that can answer, “fluorescent jacket providing better visibility for walks in wintertime”. Which is exactly what you want on a country lane at this time of year, now the clocks have gone back!
Hygiene factors are table stakes
Titles, descriptions, correctly sized images and attributes are necessary. They are no longer sufficient.
AI systems also want use cases, applications and real-life scenarios, plus conversational attributes such as highlights and Q&As. Google has added optional conversational attributes to Merchant Center, including product highlights, product details, related products and variant options. Its question_and_answer attribute can cover factual questions about a product’s intended occasions and activities. OpenAI’s current product-feed specification has a different scope: it requires a factual product description, but raw question-and-answer lists are not part of that discovery contract. We expect Microsoft and others to use the same information.
One truth, in three places
The product data a human sees on the page has to match, exactly, what a bot sees in your JSON-LD, the schema markup behind the page, and your product feeds. Any mismatch and the agent may stop trusting you. In our research (see the ‘Agent Probe’ test above) that can mean you get missed and potentially substituted by a competitor.
If it isn’t in the HTML, it isn’t there
You can’t rely on JavaScript to surface key product information. It needs to be fully server-side rendered, so that an agent visiting your page gets the whole product. Vercel and MERJ analysed more than half a billion AI crawler requests and found that GPTBot, ClaudeBot and PerplexityBot don’t execute JavaScript (Gemini borrows Google’s rendering).
Agents with their own cloud browser can run scripts. The crawlers that build the indexes and feeds mostly can’t. What you hide behind JavaScript may never reach the index at all.
Our Agent Probe test shows how big the gap is. The three plain fetchers (ChatGPT, Claude and Gemini) read only the server-rendered HTML. Price, stock, reviews and the contents tab were invisible to all of them. Only the two modes that drive a real Chrome, Claude in Chrome and ChatGPT’s Work mode, recovered them.
| Where the fact lives on the page | Plain fetchers (ChatGPT, Claude, Gemini) | Agents driving the user’s own Chrome |
| Visible text in server-rendered HTML | Seen | Seen |
| Image alt text | Seen | Seen |
| JSON-LD only (ISBN, publisher) | Not seen in this test | Not seen in this test |
| Price and seller loaded by JavaScript | Not seen in this test | Seen |
| Stock notice loaded after 3 seconds | Not seen in this test | Seen |
| Reviews loaded on scroll | Not seen in this test | Seen |
| Contents loaded on click | Not seen in this test | Seen |
The one that surprised us: JSON-LD reached no agent that read the page live, not even Claude in Chrome with full access to the page. Our ISBN and publisher data, held only in schema markup, were reported as missing every time. Keep your schema, because search crawlers parse it and assistants that answer from a search index should still use it. But repeat every fact that matters in visible text.
One more detail: in our test, ChatGPT’s fetcher signalled a 15-second request timeout, so a slow page may not be read at all.
The agent may check the price
Ask about price and the agent might check your live website to corroborate the feed or its crawl data. It can’t rely on its training data, which will be well out of date.
So your product detail pages have to be fully machine-readable, not just your feed.
Training data won’t save you. Current price and stock need up-to-date sources. Here are the model knowledge or training cutoffs supplied as at the end of October 2026:
| Provider | Model | Knowledge or training cutoff | Source |
| OpenAI | GPT-6 Astra | 30 April 2026 | OpenAI model page |
| OpenAI | GPT-6.1 Sol | 30 April 2026 | OpenAI model page |
| OpenAI | GPT-6 Luna | 18 May 2026 | OpenAI model page |
| Anthropic | Claude Fable 5.1, Opus 5.5 and Sonnet 5.5 | June 2026 | Anthropic support article |
| Anthropic | Claude Opus 5 | May 2026 | Anthropic support article |
| Anthropic | Claude Sonnet 5 and Fable 5 | January 2026 | Anthropic support article |
| Gemini 3.8 Flash | March 2026 (some domains only to January 2025) | Google DeepMind model card | |
| Gemini 3.6 Flash | March 2026 | Google DeepMind model card | |
| xAI | Grok 4.7 | May 2026 | xAI developer guide; third-party model-lineage tracker |
| Meta | Muse Spark | January 2026 (not officially confirmed) | Not officially confirmed. |
Cutoffs change with every release, so check each provider’s page before quoting them. E.g. Grok states that models are released every six weeks.
Catalogue enrichment, taxonomy normalisation and schema generation can be automated at scale. For example, Rezolve’s Agentic Commerce Engine can optimise a dozen pieces of content for each of your first thousand products in less than an hour.
Where brand control actually lives
The shift to AI-mediated commerce doesn’t eliminate brand control. It relocates it. The question is where to.
Everybody has a number. None of them agree.
Ask where AI gets its answers from and you’ll get a very different reply depending on who ran the study:
- Yext found that 47.6% of retail citations came from brand-owned websites.
- Aleyda Solís analysed Semrush Enterprise data for 15 leading brands and found that 69.6% of the top cited sources for ecommerce brands sat outside the brand’s own domains, and 79.4% in finance.
- Shero Commerce found that only 2.8% of the sources cited in its sample were brand-owned pages.
Same question, and the answers run from under 3% to nearly half. That isn’t a contradiction, it’s the point. The answer changes by vertical, by stage of the journey, by whether you sell B2C or B2B, and by the questions you ask.
So don’t take anyone’s word for it, ours included. Run structured prompt research for your own category, your own journey stages and your own market. That is exactly what Rezolve’s AEO platform is built to do.
Here is what we found when we ran it
| Study | Sample | What stood out |
| US AI Visibility Study 2026 | 2,047 US companies, four AI assistants, 122,820 answers | 24.3% never named by any assistant. Companies’ websites were just 1.5% of the sources AI used |
| US finance study | 2,219 finance companies | 1,077, about half, never named. Own website 1.4% of sources. |
| AI Check Germany 2026 | 215 sites: the DAX 40, top online shops and widest-reach media | 212 of 215 stop at web basics. 34 turn away automated visitors |
Four things jump out.
- Your own website is a small slice of what AI reads. It rises to 6.0% of sources when the AI is already naming you, and falls to 0.8% when it isn’t. Reddit is a source for 83% of the US companies we studied. What other people say about you reaches the answer more often than what you say about yourself.
- Technical readiness is the groundwork. In the US, the least technologically prepared sites were never used as a source 35% of the time, against 23% for the rest. Content written for the questions people ask AI builds on top of that foundation, not instead of it.
- AI is generous early and stingy late. It names a company in 31.8% of “what’s out there?” answers but only 6.2% of “ready to buy” answers. The shortlist is built early.
- Agents have almost nowhere to buy. 97 of the 100 largest US retailers publish no way for an agent to check out. Yet millions of small stores on Shopify and BigCommerce are technically agentic-ready, with UCP integration out of the box – even if their catalogues aren’t contextually enriched enough to properly take advantage of this opportunity yet.
Brand mentions are only half the game
Everything above is about being mentioned. It overlooks how ChatGPT, Google AI Mode and Google Search use product feeds to decide which products to show: the carousels, the product recommendations, the trusted-merchant badges.
Merchants can send a product feed directly to OpenAI for use in ChatGPT. At the time of writing, this is believed to be available in the US only, with the EU and rest of the world still using Google or other third-party data.
So, there are two games. Being mentioned, and being listed. They run on different data and different pipelines, and most brands are only playing the first.
The agent-ready pyramid: build from the bottom
Leading retailers are building this in layers. Each layer only works if the one beneath it does. A conversational shopping assistant sitting on thin data is just a faster way to disappoint people.
Layer 1: Data foundations
The hygiene factors, plus the technical basics that make them readable.
- Are your titles, descriptions, images, attributes and taxonomy complete and consistent across every product line and region?
- Are price and inventory signals accurate and fresh?
- Is JSON-LD schema markup in place, and does it match what the shopper sees on the page and what’s in your feeds?
- Is your product content fully rendered HTML, with nothing important hidden behind JavaScript?
Layer 2: Contextual enrichment
This is where you go beyond hygiene.
- Have you added use cases, applications and real-life scenarios to your product data?
- Have you covered events and timing? Valentine’s Day and Mother’s Day don’t arrive by surprise, but most catalogues treat them as if they do.
- Do you have conversational attributes: highlights, Q&As and the answers shoppers actually ask for?
Have you considered the why behind every single SKU on your website? Why would someone buy this product? Why would they buy it from you? Why not someone else? Why would an agent recommend it? Give humans and agents compelling reasons to buy. That is the layer most catalogues skip, and it’s the one that decides who makes the shortlist.
Layer 3: Protocol-ready feeds
- Do your product feeds match the specs from Google (UCP) and OpenAI (ACP)?
- Can you refresh those feeds as often as every 15 minutes, so price and stock are never stale?
- Can you integrate what I call advanced ‘agentic decision making’ fields into your feed to get a slight edge on the competition, e.g. Product Popularity and Return Rate%. Platforms will obviously favour popular products with a low return rate.
- Could you publish a Personal Agent Protocol file when the spec settles? Or better-still build an agent capable of ‘negotiating’ with another agent directly?
- Have you created specific instructions for agents or attempted to make their life easier (e.g., WebMCP, Markdown files, API catalog, etc)?
Layer 4: Bot management
In the Cloudflare Radar snapshot below, 66.0% of HTTP requests for HTML pages were generated by bots. The crawl-purpose breakdown shown was 42.1% for training, 37.9% for training and search combined, 12.7% for search, 5.4% for user actions and 1.9% undeclared. I expect the share of real-time user actions to grow quickly. Most brands have no strategy for telling the good ones from the bad. In our US study, only 284 of 1,722 readable robots.txt files named any AI crawler at all.
Source: Cloudflare Radar, AI and Bots; author-supplied snapshot, undated.
Have you decided whether to allow your content to be used for:
- AI model training
- Search bots
- User Interaction requests
(They are three different decisions)
- If you allow AI agents (unlike Amazon) then which parts of your site can they visit? Can they checkout as a guest, create an account on a user’s behalf, check stock, click and collect, redeem loyalty points and voucher codes?
- Do you know which bots and user agents belong to which AI platform? Do you have a strategy for each?
We only ever used to care about Googlebot. Now most AI platforms run separate bots for training, for search, and for fetching a page when a user asks, and those are three different decisions. (OpenAI documents its own crawlers here.)
| Provider | Training / AI grounding | Search | User interaction |
| Google-Extended | Googlebot | Google relies on its index | |
| OpenAI | GPTBot | OAI-SearchBot | ChatGPT-User |
| Anthropic | ClaudeBot | Claude-SearchBot | Claude-User |
| Perplexity | N/A | PerplexityBot | Perplexity-User |
| Amazon | Amazonbot | Amzn-SearchBot | Amzn-User |
| Meta | Meta-ExternalAgent | Meta-WebIndexer | Meta-ExternalFetcher |
| Microsoft | Bingbot | Bingbot | BingPreview |
Agentic browsers are a different story. Many don’t announce themselves with a bot name at all, so a robots.txt rule has nothing to name.
| Agent | How it identifies itself | What it means for you |
| ChatGPT agent (OpenAI) | No fixed user agent. It signs requests with Web Bot Auth, with Signature-Agent set to https://chatgpt.com. | Verify the signature. Don’t trust a user-agent string. |
| dots (OpenAI) | Runs in its own cloud computer and browser. | Test it, don’t assume it behaves the same way as GPTBot or OAI-SearchBot or ChatGPT-User. |
| Muse (Meta) | Meta publishes no Muse user agent. It drives a real Chromium browser from a cloud VM, so it looks like a human. It is none of Meta’s three named bots. | Robots.txt can’t refuse it. Amazon says it could tell Muse sessions apart and blocked it anyway. |
| Instinct | No published user agent found. It identifies itself as Chrome 155 on Windows or on Linux (the operating system changes between sessions) when it is using browser actions on a user’s behalf:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36When it is reading pages, it uses Exa.ai with its own user agent: Mozilla/5.0 (compatible; ExaUser/1.0; +https://crawler.exa.ai/exauser) | Assume it looks like a customer until proven otherwise. |
Your analytics can’t see most of this. ChatGPT, Claude and Gemini fetch pages as plain HTTP clients, so a JavaScript tag never fires for them. Only server or CDN logs see them. Agents running inside a shopper’s own Chrome do run your scripts, but they act through automation rather than a hand on a mouse. In our calibration sessions the agents made 1 to 2 mouse movements in a whole visit (the person made 96 to 237), clicked different elements 31 to 133 milliseconds apart (the person took 3 to 5 seconds) and landed within 1% of dead centre on the target (the person was 7 to 26% off). Claude in Chrome and ChatGPT’s Work mode also each leave a visible overlay element on the page. That’s one to three sessions per agent type, so it’s a strong signal, not an accuracy figure.
And get indexed. In our test, Copilot and Perplexity’s free tier never visited the page. They answered from their search indexes, then told the user the site was broken. Submit your site to Bing (IndexNow) and Google, and check your robots.txt isn’t blocking OAI-SearchBot, Claude-User, PerplexityBot or Bingbot.
Layer 5: Agent access, and real agentic readiness
Can an agent actually do what a customer does? This is where most brands find out they aren’t ready.
- Can it reach your cart, check stock availability and create an account?
- Can it check out, including as a guest? Can it check availability for click and collect?
- Can it redeem voucher codes or loyalty points?
- Agents like Instinct can now create accounts and complete checkouts for consumers, in some cases through partner rails such as Shop Pay rather than your own storefront.
- Where will agentic commerce fail because of today’s constraints? Cloudflare rules, CAPTCHAs, login walls and rate limits are the usual suspects. Cloudflare reports that 94% of login attempts across its network now come from bots, so the defences you built to stop them may be stopping the helpful ones too.
These pitfalls must be tested, not assumed.
Give agents a better door than your web pages. PAP lets a business choose the route it believes will give the customer the best experience: its website, its APIs, or an agent of its own. Most retailers have only built the first.
- Your website. Agents navigate your regular pages, the way a customer would. That is what the checks above and the harness below test.
- Your APIs. Expose your product data, pricing, stock and checkout through open standards such as MCP and OpenAPI, so an agent can ask a machine-readable question and get a machine-readable answer instead of reading a page built for humans.
- Your own agent. For tasks that need a conversation, such as a warranty claim, a sizing question or a return, let a personal agent talk to an agent of yours.
Very few have started. In our US study, none of the websites published an MCP server card (0.0%) and only 0.2% published an API catalogue. If an agent can only reach your product data by scraping your pages, you’re relying on the weakest of the three routes.
The readiness checks we run. In ACE we track five groups of signals. In our US study, the typical website passed just 3 of the 14 technical checks we ran.
| Group | What we check | Why it matters |
| Discoverability | Link headers, DNS for AI discovery, robots.txt, sitemaps | Can an agent find your site, and your products, in the first place? |
| Content accessibility | Markdown negotiation, llms.txt | Can an agent read your content cheaply? llms.txt arguably makes little difference and I’m not advocating it, but it is an easy hygiene factor to implement |
| Bot access control | Content signals, AI bot rules | Have you decided what each kind of bot may do, or are rules written years ago for search engines deciding for you? |
| API, auth and MCP | API catalog, auth discovery, auth-protected resource, auth.md, MCP server card, A2A agent card, agent skills, WebMCP, ARD manifest | Can an agent talk to you as a machine, and sign in on a customer’s behalf, instead of guessing at buttons? |
| Agentic commerce | x402, MPP, UCP, ACP, AP2 | Can an agent actually check out? |
The last row is a lot of acronyms, so here is what each protocol is and how I’d prioritise it. The priority column is a first pass.
| Protocol | What it is | Why it matters | Priority |
| UCP | Google’s open standard for discovery, checkout and orders | Native checkout in Google’s AI Mode and Gemini | Now |
| ACP | OpenAI and Stripe’s standard for checkout and product feeds in ChatGPT | Gets your products listed and purchasable in ChatGPT | Now |
| PAP | Identity and permissions for personal agents such as Muse and Instinct | Lets you recognise agents and decide what they can do. Draft stage | Next |
| AP2 | Google’s payments protocol, giving cryptographic proof that the shopper authorised the purchase. It plugs into UCP | Mostly your payment provider’s job, but it is the trust layer under agent payments | Next |
| MPP | Stripe and Tempo’s Machine Payments Protocol: payments over HTTP in stablecoins and cards | Relevant if you’re on Stripe and want agents to pay in one request | Next |
| x402 | Coinbase’s stablecoin pay-per-request protocol over HTTP | Built for machine-to-machine micropayments, such as APIs and data, rather than typical retail baskets | Later |
And remember, this is only agentic readiness. Passing every check above tells you an agent can find you, read you and, in theory, pay you. It tells you nothing about what happens when one actually tries. You need to run test harnesses with live agents across the whole buyer journey on your site, exactly as you would for a human. Can they search and browse? Can they reach the cart? Can they check out as a guest? Can they create an account? Can they check availability and use click and collect? And does it all work for every agent, not just the one you tried? That is the test that finds the dead ends.
Layer 6: Conversational search on your own site
ChatGPT and Google AI Mode have raised the bar. Consumers like the shortlist. They like asking in natural language and adding context as they go.
- Can your site search and conversational agents use your enriched data to give shoppers products that really suit them? That is where conversion and satisfaction move.
- Does the enrichment feed your site search, product discovery and merchandising rules?
- Can you spot agentic customers? If a shopper checks out through Instinct or Google while you remain the merchant of record, you didn’t get to observe them the way you would on your own site. Segment them and market to them differently.
Accurate data solves one half of the problem. The other half is what your own AI is permitted to do with it. Even a system reading perfect product data can improvise a discount, misstate a return policy or make a claim your brand never approved. Prompt engineering won’t fix that. Policy compliance has to be a system constraint, built into how the AI reasons and acts, not an instruction layered on afterwards. A model that can be prompted into non-compliance is a liability. It needs to be a governed system.
This is moving faster than anyone planned for
Muse launched on 8 September. dots followed on 29 September. The Personal Agent Protocol arrived on 6 October.
For years we have focused on whether humans can check out, and on what that experience feels like. For years we have worried about whether search engine bots can crawl our content and whether it’s indexable. Both still matter.
Now there is a third customer to design for: the agent. That needs a different kind of testing, a harness that walks the journey the way an agent would and finds the dead ends and pitfalls it runs into, before a shopper’s agent does it for you.
My Takeaway
The shopper may never visit your website. But your business still has to earn the sale.
Your website remains a source of product information, a place to transact and a foundation for the customer relationship. Increasingly, it also has to serve an agent acting on someone else’s behalf. That makes the quality of your data, the accessibility of your systems and the reliability of your buying journey commercial priorities.
The opportunity extends beyond appearing in an AI answer. It is to give agents clear reasons to recommend your products, reliable ways to buy them and a customer experience that earns another recommendation.
Visibility gets you considered.
Accurate information helps you make the shortlist.
A working buying journey turns that consideration into revenue.
Start by finding out where you appear, how accurately you are represented and what happens when an agent actually tries to buy from you.
The next sale may be decided before a shopper reaches your website. Build a business the shopper’s agent can confidently recommend and buy from.
Next Steps: How to get ready now for Agentic Commerce
Why not book a meeting with your Rezolve account manager and they can take you through these three steps to get you started with agentic commerce.
1. AEO Visibility Audit
An initial check across major answer engines to understand the six dimensions of AI visibility.
2. Agentic Readiness Audit
This comprehensive check analyses your site for all current and emerging agentic protocols and technical foundations to support bots and agents.
3. Agentic Journey Analysis
For years, we’ve been testing the usability of our websites for humans. This new AI agent buyer journey audit now tests the usability of your website, APIs, and your company agents for AI agents and personal agents. Can they read your catalogue? Can they check out? What problems do they encounter?
Frequently asked questions
What is AI-mediated commerce?
It is what happens when a third-party AI platform or agent enters the customer journey before the shopper has decided where to buy. It compares products across brands, makes a recommendation and, increasingly, completes the purchase. Your influence is indirect and runs through the quality of your product data.
What is agentic commerce?
Shopping carried out by AI agents on a consumer’s behalf: researching, shortlisting, filling in forms, creating accounts and paying. Meta’s Muse, OpenAI’s dots and Instinct are early examples.
How do AI assistants decide which products to recommend?
They work from whatever product data they can read: feeds, schema markup, product pages and third-party sources. Complete, structured data that matches across your page, your schema and your feeds gives them something to work with. Incomplete or mismatched data can leave you missed, or substituted by a competitor.
Can AI crawlers read JavaScript?
Mostly not. Vercel and MERJ found that GPTBot, ClaudeBot and PerplexityBot don’t execute it, while Gemini uses Google’s rendering. Key product information should be fully server-side rendered.
What is the Personal Agent Protocol?
The Personal Agent Protocol (PAP) or “Poppy” for short is an open standard announced by Sierra and Meta on 6 October 2026 for how personal AI agents identify themselves to businesses, authenticate and receive permissions. It allows people to decide what their agent can do for them and allows companies to decide what agents can do through their APIs or via their own company agents rather than navigating their websites. The spec is at draft version 0.3, with a v1.0 spec expected next.
What is agentic readiness?
Whether an agent can actually find, evaluate and buy from you. That means machine-readable data, server-rendered pages, protocol-ready feeds, sensible bot rules and a checkout path that works without a human. It has to be tested, not assumed.