Mastercard tests AI-agent detection score in Agent Pay Trust Framework

Mastercard's new layer shifts the question from authentication to detection. Most current infrastructure, including Visa TAP, Stripe ACP, and Google AP2, is built on the premise of authentication, asking who the agent is and attempting to verify its identity. Mastercard's approach asks whether this is an agent at all. That distinction matters because knowing who an agent is matters little if you cannot reliably detect its presence in the first place.

The framework is built on five pillars: identity, intent, controls, trusted execution, and intelligence. It incorporates agent identity via Skyfire's Know Your Agent (KYA) technology, alongside intent, behavioral signals, and fraud signals. Partners like Cloudflare provide privacy-preserving environments to combine web visibility into AI-agent activity with payment intelligence. Stephanie Cohen, Chief Strategy Officer at Cloudflare, stated that trust is the foundation that will determine how far agentic commerce goes.

This pivot to detection is a direct response to friction stalling merchant adoption. According to a vendor-reported claim from PYMNTS, 93% of merchants believe the AI provider should bear the loss for failed transactions, yet only 28% are currently willing to expose their full inventory to agents. That gap between the desire for automation and the fear of liability is the primary hurdle for the industry. Mastercard plans to enrich the score with additional data points, including merchant risk, transaction patterns, and consumer propensity, but the core issue of liability remains unresolved. Mastercard's move is network-native, distinguishing it from protocol-agnostic issuer registries like Cequence Agent Trust, which launched in early October. Neither approach addresses the economic reality of who pays when an agent makes an erroneous purchase.