What is agentic commerce? A practical guide for businesses

The short answer

Agentic commerce is commerce carried out by AI agents acting for people. Instead of a customer opening your website, finding the right page and filling in a form, they ask their assistant: "Move my dentist appointment to Thursday", "Return the blue jacket", "Upgrade my plan if it's under $20 a month". The assistant then deals with your business on their behalf.

It is the next step after chat. Assistants already answer questions; now they are starting to take actions: booking, buying, returning, cancelling, changing an order or an account.

Why it is happening now

Three things came together:

• Assistants got good at multi-step tasks. Modern AI models can plan, compare options and follow a process from start to finish.
• People already trust assistants with their day. Calendars, email and shopping lists are moving into AI assistants, and actions are the natural next request.
• Open standards are appearing. Protocols such as the Personal Agent Protocol (Poppy) describe how an agent finds a business, proves who it is, signs a customer in and asks for a change, so businesses don't have to build one integration per assistant.

How it works, step by step

1. Discovery. The agent finds out that your business accepts agents, usually from a small public document on your domain.
2. Identity. The agent proves which agent it is, with a cryptographic key rather than a name anyone could type.
3. Customer sign-in. The customer connects the assistant to their account with you, on your page, so the assistant never sees their password.
4. A proposal. The agent asks for something specific: return order 1042 for a $49 refund.
5. Your rules decide. Allowed automatically, needs the customer's approval, needs your team's review, or refused.
6. Approval of exact terms. The customer approves exactly what will happen: this order, this amount, this method.
7. Execution, once. Your system does it, and every step is recorded.

What changes for a business

A new channel that doesn't sleep

Requests arrive at any hour, from customers who would not have bothered with a form. Rescheduling, renewals and returns that used to need a call become a sentence to an assistant.

Less support load

The routine requests that fill support queues (where is my order, move my booking, cancel my subscription) are exactly what agents handle well.

New risks

Letting software act on customers' accounts raises real questions:

• Which agent is this, really?
• Did the customer actually agree, and to what exactly?
• What stops an agent from refunding $5,000, or splitting it into fifty $100 refunds?
• What happens if the connection drops in the middle of a refund: did it happen or not?
• How do you prove afterwards what happened?

These are the questions that decide whether agentic commerce is an opportunity or a liability.

What "ready" looks like

A business that is ready for AI agents has:

• A front door for agents: a published, standard way for agents to find it and connect.
• Verified agent identity: every agent proves who it is with its own key.
• Customer sign-in it controls: customers connect assistants on the business's own page.
• Rules per action: what's allowed, what needs the customer, what needs the team, what's refused, with limits on amounts and over time.
• Approval of exact terms: the customer approves the precise change, and any change to the terms needs a new approval.
• At-most-once execution: retries can never refund twice.
• A record that shows later changes: a signed log of every step, which the business can keep.
• An emergency stop: one switch that halts every agent.

You can check how far your site is today with the free Allowfy Check.

Build it or use a gateway?

Building all of this means OAuth with signed client assertions, proof-of-possession tokens, a device sign-in flow, a rules engine, an approval flow, idempotent execution and a tamper-evident ledger. It is weeks of specialised security work, and then it has to be maintained as the standards evolve.

A gateway such as Allowfy does the agent-facing part: identity, customer sign-in, your rules, approvals, the ledger and the emergency stop. Your system answers four simple questions through a signed webhook: is this customer who they say they are, what can they see, what exactly would this change do, and do it.

Where to start

1. Pick one or two actions customers already ask for: reschedule, return, cancel.
2. Decide the rules: what's safe to allow, what needs approval, what needs your team.
3. Try it in test mode, where everything runs end to end but nothing real changes.
4. Go live when the readiness checks pass.

Agentic commerce won't replace your website or your support team. It adds a channel where the customer's own assistant does the work, and it rewards the businesses that let it in safely.