Agentic Commerce Needs a Merchant Control Layer

For merchants, agentic commerce raises a question beyond whether an assistant can recommend a product: which actions may it take, under whose authority, and how will the business handle the resulting order?

On September 9, 2026, Mastercard announced Agent Connect and expanded Agent Suite for Merchants capabilities. Its announcement describes a shared connection point for participating merchants, agents, platforms and payment providers, alongside merchant controls and consumer-authorized transactions. It presents an evolving offering beginning in the United States; availability and participation should be checked directly.

The announcement raises an operating question that extends beyond any one provider: what must a merchant control before an agent can act reliably? The checklist below is Aeris editorial analysis, not a description of an Aeris integration or partnership with Mastercard.

Define permitted actions

A recommendation, a cart update and a completed purchase are different actions. Give each an explicit permission boundary. An agent that can read product information should not automatically receive authority to place an order or alter a customer account.

Know which agent or platform is requesting an action, what scope has been granted and how that access can be withdrawn. The customer should understand when a suggestion becomes a commitment.

Start with a limited product group and a clearly defined journey. A narrow pilot makes exceptions easier to inspect and creates a practical basis for deciding which capabilities can expand.

Make commercial rules executable

A product description is insufficient when an assistant must act on an offer. The operational record should include the correct variant, current availability, destination eligibility and applicable price and fulfillment terms.

Treat stale information as an exception to resolve. If inventory or total cost changes between recommendation and purchase, the workflow needs a rule for refreshing the offer and, when necessary, returning to the shopper for approval.

Promotions need boundaries too. Record eligibility, expiration and exclusions consistently so a conversational experience does not promise a discount that checkout cannot honor. Commercial accuracy matters even when the shopper never sees a traditional product page.

Preserve customer authorization

A broad shopping preference is different from permission to spend. Define the authorized item or acceptable substitutes, spending limit, destination and other relevant constraints before a purchase proceeds.

Decide what changes require renewed approval. A different size, a more expensive substitute or a materially later delivery date may no longer match the original request. The appropriate response is a controlled escalation rather than an improvised assumption.

Keep an appropriate record of authorization and the action it permitted. Minimize unnecessary personal data and make the record usable by the teams responsible for resolving customer questions.

Build for ordinary failures

Commerce systems encounter timeouts, delayed responses and repeated requests. An agent should not interpret an uncertain response as permission to place the same order again.

Use a stable order reference and check whether an earlier attempt succeeded before retrying. The merchant and customer should be able to trace a request to its current state: awaiting confirmation, accepted, failed, cancelled or refunded.

Test these failures during the pilot. A polished recommendation demo does not reveal what happens when payment succeeds but confirmation arrives late, or when only part of an order can be fulfilled.

Keep support inside the design

The journey continues after checkout. Define where a customer sees order status, requests a cancellation and starts a return. Make clear which party owns each response and how the customer reaches human support when automation cannot resolve the issue.

Support teams need a readable history of the offer, authorization, order and subsequent changes. Without that shared record, an agent-mediated purchase can become difficult to explain even when the underlying payment is valid.

Measure completion quality alongside discovery. Follow failed attempts, duplicate prevention, cancellations and unresolved support cases. Use these observations to decide whether broader access would improve the experience or multiply exceptions.

Choose one controlled pilot

Select one journey, document the permission boundaries and test both the normal path and expected failures. Agree on who owns the exceptions before increasing traffic. Have the commercial, support and technical owners review the same examples so that a successful test means the same thing to each team.

Agentic commerce can create new ways to reach customers. Merchant control makes those interfaces operationally accountable, from the first recommendation to the final resolution of an order.

Source

Mastercard announcement, September 9, 2026. The merchant operating checklist is Aeris editorial analysis.