You signed the budget at the door, the basket filled itself inside. The card was charged without a glance; the fine print had nowhere to hide.
When an autonomous agent buys something on your behalf, who made the purchase?
Commercial law spent centuries refining the concept of mutual assent. A buyer evaluates an offer, considers the terms, and performs an intentional act of commitment: signing a draft or clicking a button marked complete order. The moment of commitment concentrated consent into a discrete, observable human event.
In August 2026, agentic commerce infrastructure crossed from laboratory prototypes into live payments rails. Protocols for delegated authorization now issue scoped tokens that allow an autonomous agent to select items, negotiate prices with merchant APIs, and complete payment settlement without a human returning to the screen. The form of delegation looks familiar (you authorized the transaction by setting the budget). The physics of execution is entirely novel: the chosen vendor and the specific contract terms were generated dynamically by software at the instant of checkout.
The preference-stack substitution
Delegated commerce operates by substituting a broad declaration of intent for granular decisions.
A consumer provides a high-level instruction: book a flight to Frankfurt under eight hundred dollars that arrives before noon, or replenish office supplies within a monthly spending envelope. In traditional e-commerce, the user still reviewed the final checkout screen, verifying the airline's cancellation policy or the supplier's delivery terms. The human eye caught the exorbitant baggage fee or the non-refundable deposit.
Under delegated checkout, the agent resolves the entire preference stack independently. It selects the merchant, agrees to the terms of service, selects fulfillment partners, and applies payment credentials via API. The principal delegated intent, yet the execution generated legal and financial commitments the principal never reviewed.
This creates an immediate doctrinal rupture. If the airline cancels the flight with no refund under terms the agent accepted, did the buyer assent to those terms? Contract law typically binds a principal to agreements made by an authorized human agent because the human agent possessed fiduciary duties and professional judgment. An algorithmic agent possesses statistical weights and a prompt context. When an authorized-in-kind instruction yields a harmful-in-particular outcome, existing dispute mechanisms break down because they presuppose a purchaser who comprehended what they bought.
The disanalogy of scale
The problem expands rapidly when autonomy moves from individual consumer tasks to high-frequency purchasing.
Voice After Abundance demonstrated that when the cost of generating text drops to zero, the entire burden of scrutiny shifts to the reader. In agentic commerce, when the friction of initiating transactions drops to zero, the burden of scrutiny shifts to whoever manages the bank account.
An autonomous system optimizing cloud resources or inventory positions can execute thousands of micro-transactions per hour, negotiating dynamic pricing with automated vendor endpoints. No human principal could price or evaluate these transactions individually. The human merely sets the boundaries and reviews the aggregate statement at the end of the billing cycle.
Here the logic of The Refusal Went One Way reappears in financial architecture. The machine possesses unlimited capacity to initiate spending commitments, while the human possesses strictly bounded attention to audit them. The authorization was granted once, but the execution multiplied into a torrent of irreversible financial commitments.
Friction as security
The counter-arguments from payment networks are already taking shape. Engineering teams point to cryptographic spending caps and merchant allowlists designed into modern agent payment protocols.
These controls are real, and they provide meaningful guardrails. Yet every safeguard represents a deliberate reintroduction of friction. A strict spending cap limits the utility of an autonomous agent; an allowlist prevents the agent from discovering cheaper alternatives in the open market; a mandatory confirmation prompt turns the autonomous agent back into a glorified search engine.
The marketplace is dividing along this fault line. Payment rails that enforce rigorous moment-of-action verification protect buyers by preserving friction, whereas rails that optimize for frictionless autonomy strip out verification to maximize transaction velocity.
The fundamental test is whether delegated constraints survive contact with execution. If an agent can interpret its instructions loosely enough to bypass the spirit of a spending envelope while obeying its mathematical bounds, authorization has become a legal fiction. The cardholder authorized a category of outcome; the machine bought a specific liability.
Companions
- The mechanics of asymmetric volume: Voice After Abundance.
- The asymmetry of refusal in systems: The Refusal Went One Way.
- The opening question of signatures: Someone Had to Sign.
- The operational standard: the Interim Protocol, whose third rule holds that material judgments may be informed by a machine and never concluded by one. A purchase commitment is a material judgment wearing commercial clothes.
These notes come out of Sociable Systems, a practice that reads AI-shaped documents the way a hostile reviewer will, before a lender or a court finds the gap. The argument has an operational form: the Interim Protocol sets out four rules for AI use in environmental and social deliverables, covering disclosure at touch-point grain, evidence custody, the phrases no automated screening may settle, and a hostile read before anything ships. Free, and written to be cited or retired once institutional guidance arrives.