What the six scenarios have in common
The configurations differ; the protocol constraint does not. Three points recur across every scenario, and they
are written into the specification rather than inferred from the market.
The Merchant of Record never changes. Whatever the agent, whatever the surface, the merchant is
the one selling. UCP's Checkout capability states this, and adds that it introduces no PCI DSS compliance
obligation for card payments. The disintermediation debate is therefore about visibility and customer
relationship, not about losing seller status.
An agent's degree of autonomy is decided in exactly one place. An order must be finalized
manually by the user through a trusted UI, unless the AP2 Mandates extension is supported. Automatic
replenishment or recurring purchase therefore presupposes mandates. Assisted discovery does not.
Business friction has a dedicated state. A checkout session moves through
incomplete, requires_escalation, ready_for_complete,
complete_in_progress, completed or canceled. Age verification, signature
thresholds, supporting documents, pricing exceptions: all of it lives in requires_escalation
instead of breaking the journey. That is what makes regulated and B2B scenarios workable.
Source: UCP specification, Checkout capability,
version 2026-04-08. For the B2B breakdown, see B2B agentic commerce.