On June 10, 2026, Visa and OpenAI announced a partnership to put Visa’s network, credentialing, and fraud infrastructure behind AI agents that buy things on your behalf. It landed in a year that already had Mastercard Agent Pay and a wave of “Buy it in ChatGPT”-style experiments. The rails for letting a bot reach into your wallet are arriving fast.
Read the press releases closely and you’ll notice what they all describe in detail: spending limits, merchant-category controls, tokenized card credentials, real-time authorization, required approvals. And you’ll notice what none of them mention even once: age. Every one of these systems is a careful answer to “is this agent allowed to spend this money at this merchant?” Not one of them answers “is the human behind this agent old enough to buy what’s in the cart?”
That gap is about to become someone’s legal problem — and that someone is the merchant. This post is about why agentic checkout breaks the age check that the entire regulated-retail internet was built on, and what the architecture that survives it actually looks like.
The Rails Solve Payment, Not Eligibility
It’s worth being precise about what the new agent-payment frameworks actually bind together, because they’re genuinely good engineering for the problem they chose to solve.
Mastercard Agent Pay, announced in 2025, issues what it calls Agentic Tokens — a tokenized card credential bound to a specific agent, a specific merchant scope, and a specific consent policy. Visa’s Intelligent Commerce work, now reinforced by the OpenAI deal, does something structurally similar: tokenized Visa credentials operating within user-defined permissions and controls — spending caps, merchant categories, approval thresholds — with real-time authorization and fraud monitoring riding on top. The design intent is delegation with guardrails: your agent can spend, but only here, only this much, only under rules you set.
Now look at what that token carries and what it doesn’t. It can encode “no more than $200,” “groceries and electronics only,” “decline gambling.” Those are spend and category constraints. What it cannot encode is the one fact a liquor store, a vape shop, a licensed cannabis retailer, a fireworks seller, or a sportsbook is legally required to establish before it completes a sale: that the beneficial human meets an age threshold. A merchant-category rule can block a category outright. It cannot say “allow this alcohol purchase, because the person on whose behalf this agent is acting is verifiably 21.” A spending limit is not an age proof, and a fraud score is not an eligibility check. The rails moved the money safely. They left age behind.
The Third Actor Problem Meets the Oldest Rule in Retail
McKinsey has a name for the structural novelty here — the “third actor problem.” For a century, commerce assumed two parties to a transaction: a buyer and a seller. Agentic commerce inserts a non-human third actor that initiates the purchase, and essentially every consumer-protection statute on the books was drafted without it in mind. As of mid-2026, no jurisdiction has enacted regulation that specifically addresses agentic commerce. In the EU, the AI Act, PSD3, GDPR, and the Consumer Rights Directive overlap across the question without any of them cleanly answering it: when an agent makes a harmful or unauthorized purchase, who is liable — the consumer who delegated, the AI provider who built the agent, the platform that facilitated it, or the merchant who accepted it?
That ambiguity is real for unauthorized purchases. But for age-restricted ones, there’s a much older rule that the novelty doesn’t touch, and builders keep missing it: the seller is liable for an age-restricted sale, full stop. The FDA holds tobacco and vape retailers responsible. The ATF and state regulators hold alcohol sellers responsible. State cannabis and gaming authorities hold their licensees responsible. The penalty for selling to a minor runs from fines to license revocation to criminal exposure — and it attaches to the entity that made the sale, not the channel the order arrived through.
“An AI agent placed the order” is going to be exactly as effective a defense as “the website had an I am over 18 checkbox” — which is to say, none at all. We’ve already watched regulators from Ofcom to the FTC declare self-attestation to be no assurance whatsoever. An agent’s unverified claim that its principal is of age is self-attestation with extra steps: the same legally worthless assertion, now laundered through a piece of software. The agent is the buyer’s channel. The liability stays precisely where it has always been. What’s changed is that the merchant’s usual way of discharging that duty just walked out of the room.
Why the Checkout-Time Check Breaks
Almost every age check on the internet today is built on one assumption: a human is present in the session at the moment of purchase. The dominant pattern is a per-transaction check — at checkout, the buyer is prompted for a liveness selfie, a document scan, a facial age estimate, or a card-plus-ID step. It works because there’s a face to capture and a person to prompt.
Agentic checkout deletes that assumption. At the moment the order is placed, there is no human in the loop — that’s the entire point of delegation. The agent cannot pass a liveness check, and you emphatically do not want it to: a bot that can satisfy your liveness detection is a description of your worst failure mode, not your verification working. (We’ve written before about how circumvention through binding gaps quietly turns a “passing” check into no check at all — agentic commerce is that problem industrialized.)
So merchants facing agent traffic get pushed toward two dead ends. The first is to trust the agent’s assertion — let the agent declare “my principal is 21” and complete the sale. That is unverifiable hearsay, the checkbox reincarnated, and it will not survive a compliance audit or a sting purchase. The second is to yank the human back into the loop — bounce every age-restricted cart to a manual verification step. That works, technically, and it also vaporizes the reason anyone delegated to an agent in the first place. If your buyer has to stop and take a selfie every time their assistant tries to reorder their usual, you don’t have agentic commerce; you have a slower website. Neither hearsay nor friction is an answer. The answer is to stop verifying at the moment of purchase at all.
Decouple Verification From the Moment of Purchase
The architectural move that survives agentic checkout is to separate when you verify the human from when the purchase happens. Verify once; prove many times. Concretely, it has two halves.
A reusable, bound age credential. The human completes a real verification once — document plus liveness, or facial age estimation with a buffer-zone fallback to stronger evidence near the threshold — and the result is not a one-shot boolean that evaporates when the session ends. It’s a durable, privacy-preserving age assertion bound to that human, the same primitive we’ve described in reusable age credentials: verify once, prove everywhere. The human, not the agent, is the one who got verified — which is exactly the property you need, because the human is the one the law cares about.
A delegated, scoped proof. The agent then carries a delegation token that — per the verifiable-credentials and delegated-authority work maturing through 2026 — is digitally signed by the human, scoped to a purpose, time-boxed with an expiry, and revocable through a published endpoint. Critically, that credential can present proof of an age threshold through selective disclosure: it proves “≥ 21” without revealing date of birth, name, or any document. This isn’t speculative cryptography. The EU’s age-verification “mini-wallet,” feature-ready as of April 2026 and built on zero-knowledge proofs, does exactly this on the consumer side — it proves someone is over 18 while disclosing nothing else, and it’s designed to interoperate with the EU Digital Identity Wallets rolling out across member states. Pair a consumer-held age proof of that shape with an agent-held delegation token and you’ve described the missing layer.
Put the two halves together and the merchant, at machine speed, receives a cryptographically verifiable answer to three questions at once: a real human was verified to meet the threshold; that human delegated this purchase to this agent; and the proof can be checked and logged without anyone re-entering the loop. That’s not the checkbox with better marketing. It’s an actual, auditable establishment of age eligibility for a sale no human attended.
What the Merchant Has to Demand
If you’re building or buying the checkout that will receive agent traffic, the requirements fall out of the liability, not the technology. Five things, and they should sound familiar if you’ve thought about defensible age assurance at all:
Proof, not assertion. Reject “the agent said so.” Require a verifiable age credential or proof that traces back to a verification of the human principal. An agent’s self-declaration is self-attestation; treat it as such.
Binding and delegation. The proof must bind to the human who was verified and be scoped to the agent for this transaction. Honor expiry and revocation — a delegation good forever is a credential for sale on a forum by next week.
Threshold disclosure, not identity dump. Accept “≥ 21,” not a full DOB-and-document payload. Minimizing what you collect shrinks the honeypot you’d otherwise have to defend, and it’s increasingly what the law expects rather than merely tolerates.
Auditable decision, discarded inputs. Log the proof presented, the method, the threshold, the timestamp, and the delegation reference — the evidence you’d hand a regulator. Do not warehouse the underlying documents or biometrics. Defensibility is about being able to prove the decision after the fact, not about hoarding the raw material that created it.
Step-up or refuse — never silently complete. When an agent shows up at an age-restricted checkout without a valid age proof, the transaction steps up to the human or it’s declined. The one outcome you cannot afford is a quiet, completed sale with no establishment of age, because that is the exact fact pattern an enforcement action is built around.
This Is Closer Than It Looks
It’s tempting to file this under “future problem.” It isn’t. The payment rails are shipping now (Visa, Mastercard). The agent-identity scaffolding is forming now — decentralized identifiers and verifiable credentials for agents, delegation tokens, OAuth-style scoped access layered onto agent protocols, early proposals for verifiable delegation across the protocols agents use to talk to each other. The consumer-side age wallets are arriving now — the EU mini-wallet, mobile driver’s licenses, reusable credentials. Every piece of the stack is converging on 2026 except one: the age layer that emits a reusable, delegatable, privacy-preserving proof an agent can actually carry into a checkout.
The formal standards are still 12 to 24 months from being finalized. The purchases are not waiting for them. Agents are already completing flows that trigger age and identity requirements, and the merchant on the other end already owns the liability. The teams that win this are the ones building the connective tissue now — an age check whose output is the thing an agent can present — instead of bolting verification onto a checkout that assumes a human will always show up.
How Xident Fits
Xident was built around the distinction this whole problem turns on: verification should produce a durable, bound, privacy-preserving result, not a one-shot pass that dies with the session. Our API returns an age assertion you can attach to a returning-user token — the exact primitive an agent needs to carry a scoped, revocable proof of age into a checkout the human isn’t present for. We do threshold classification (+12, +15, +18, +21, +25), run verification through layered methods with on-device processing and a buffer-zone fallback near the boundary, and retain the decision rather than the documents — no identity files or biometrics warehoused on your infrastructure, with an exportable record of what was verified, when, and how.
Agentic commerce doesn’t change who is liable for an age-restricted sale. It changes whether a human will be standing at the checkout when that sale happens — and the answer, increasingly, is no. Build the age layer that doesn’t need one.
If you’re designing checkout that has to prove age when the buyer is a bot, start here.
