The Agentic Commerce Protocols: UCP, ACP, and AP2

Salesforce data from Cyber Week 2025 showed AI agents influenced $67 billion in global orders — 20% of all transactions. That number will look modest within two years. Every major commerce platform is quietly rebuilding its infrastructure for a world where AI agents, not humans, initiate the majority of product discovery. The protocols governing this shift already exist. Most businesses have not heard of them yet.

What Is the Agentic Commerce Shift That Most Businesses Are Missing?

Gartner projects 90% of B2B purchases will flow through AI agents by 2028. Three protocols -- UCP, ACP, and AP2 -- define how agents discover merchants, execute checkouts, and authorize payments. Businesses without these protocols are invisible to agent-driven commerce.

For twenty-five years, commerce infrastructure has been built around a single assumption: a human being sits at a screen, clicks through pages, and makes purchasing decisions. Every storefront, every checkout flow, every product page exists to serve that human. The assumption is now wrong.

Gartner projects that 90% of B2B purchases will flow through AI agents by 2028 — a $15 trillion market shift that Digital Commerce 360 has documented extensively. Capgemini found 82% of enterprises plan to integrate AI agents within one to three years. These are not projections about a distant future. The infrastructure is being deployed right now, and three protocols define how it works.

UCP governs discovery. ACP governs checkout. AP2 governs payment authorization. Together, they form the complete protocol stack for agentic commerce. If your business does not implement them, AI agents will not know you exist. Not because of a ranking algorithm. Because there is literally no protocol-level mechanism for them to find you.

What Is the Universal Commerce Protocol (UCP) and How Does It Work?

UCP is Google\'s open standard that enables AI agents to discover what a business sells through structured manifest files. A UCP manifest declares capabilities, catalog data, and transport bindings at a well-known URL. Without it, AI shopping agents find nothing actionable on your domain.

UCP is the foundation layer. Published by Google, it defines how AI agents discover what a business sells, what it costs, how it ships, and what constraints apply. Think of UCP as the language your website speaks to AI shopping agents.

Traditional commerce relies on product pages designed for human eyes — images, descriptions, reviews, call-to-action buttons. AI agents do not process any of that. They need structured, machine-readable data served through standardized endpoints. UCP provides exactly this: a manifest file that declares your capabilities, your catalog, and your terms in a format any agent can parse in milliseconds.

The Google Developers Blog describes UCP as an open standard built on schema.org vocabulary. A UCP manifest lives at a well-known URL on your domain, declaring what products and services you offer, how agents can query your catalog, and which transport protocols you support — REST, MCP, or A2A. Without this manifest, an AI shopping agent visiting your domain finds nothing actionable. It moves on to a competitor that has one.

This is not a ranking penalty. It is an existence problem. In the agentic era, discoverability is binary. You either have a UCP manifest or you do not exist to agent-driven commerce.

What UCP Declares

Example UCP Manifest for an AI-Native Business

{
  "@context": "https://schema.org",
  "@type": "Organization",
  "name": "Your Business",
  "url": "https://yourdomain.com",
  "ucpVersion": "2026-04-08",
  "capabilities": {
    "catalog": "/api/ucp/catalog",
    "search": "/api/ucp/search",
    "availability": "/api/ucp/availability"
  },
  "transportBindings": ["REST", "MCP", "A2A"],
  "fulfillment": {
    "shipping": ["standard", "express", "next-day"],
    "regions": ["US", "CA", "EU"],
    "returns": "30-day"
  },
  "checkout": {
    "protocol": "ACP",
    "endpoint": "/api/acp/checkout"
  },
  "payments": {
    "protocol": "AP2",
    "mandateTypes": ["checkout", "payment"],
    "processors": ["stripe", "adyen"]
  }
}

What Is the Agentic Commerce Protocol (ACP) and Why Does Checkout Depend on It?

ACP is OpenAI\'s protocol governing how AI agents negotiate and complete purchases. Unlike human form-based checkout, ACP enables agents to compare prices, apply preferences, and confirm payment in a single automated conversation that takes seconds.

If UCP is how agents find you, ACP is how they buy from you. Published by OpenAI, the Agentic Commerce Protocol governs the conversational checkout flow — the sequence of interactions between an AI agent and a merchant's systems that turn product discovery into a completed transaction.

Here is why ACP matters: traditional checkout was designed for humans filling out forms. Name, address, payment, confirm. AI agents do not fill out forms. They negotiate. An agent operating under ACP can compare prices across merchants, apply user preferences for delivery speed versus cost, handle promotions and discounts, and confirm payment terms — all within a single automated conversation that takes seconds.

OpenAI's Commerce documentation describes ACP as a stateful protocol. The agent maintains context throughout the checkout conversation, remembering what the user has authorized, what the merchant has offered, and where the negotiation stands. This is fundamentally different from a stateless HTTP request hitting a checkout endpoint. It is a conversation between two systems, governed by rules that both sides understand.

The businesses that implement ACP will see conversion rates from AI-driven traffic that make their human checkout flows look primitive by comparison. The businesses that do not implement ACP will watch AI agents bounce — not because the product was wrong, but because the checkout infrastructure could not speak the agent's language.

What Is the Agent Payments Protocol (AP2) and How Does It Secure Transactions?

AP2 uses cryptographic mandates -- signed, verifiable authorizations -- to define exactly what an AI agent can spend. Payment Mandates set boundaries while Checkout Mandates finalize purchases. Without AP2, there is no trusted mechanism for agents to complete financial transactions.

Discovery is solved by UCP. Checkout is solved by ACP. But neither matters without trust. How does a merchant know that an AI agent is authorized to spend money on behalf of a user? How does a user know that their agent will not exceed their budget? How does the payment processor verify that the transaction is legitimate?

AP2 answers all three questions through cryptographic mandates — signed, verifiable authorizations that define exactly what an agent is permitted to do financially. The W3C Web Payments Working Group defines AP2 as a trust layer built on public-key cryptography, where every transaction carries a digital signature proving it was authorized by the legitimate account holder within specific constraints.

Two types of mandates govern AP2 transactions:

• Payment Mandates — pre-authorizations that set boundaries. "Browse and negotiate, but spend no more than $500 on electronics, only from merchants with a 4-star rating or higher." The agent operates within these constraints autonomously.
• Checkout Mandates — finalized commitments to specific purchases. "Buy this specific item at this specific price from this specific merchant." The agent has negotiated the terms and the user (or the Payment Mandate) has approved the final transaction.

Stripe's Payment Token documentation describes how AP2 integrates with existing payment infrastructure. The mandate is not a new payment method — it is an authorization layer that sits on top of existing card networks, ACH, and digital wallets. Merchants do not need to rebuild their payment processing. They need to accept and verify AP2 mandates, which their payment processor handles.

The critical insight is this: without AP2, there is no agentic commerce. Discovery and checkout are useful only when the agent can actually complete a transaction with cryptographic certainty. AP2 is what makes the entire stack trustworthy.

How Do UCP, ACP, and AP2 Work Together as a Complete Stack?

UCP handles discovery, ACP manages checkout, and AP2 authorizes payment. An agent queries UCP manifests, negotiates via ACP with multiple merchants simultaneously, then authorizes payment through an AP2 Checkout Mandate. Total transaction time is seconds with zero human intervention.

Now, here is where it gets interesting. UCP, ACP, and AP2 are independent protocols. Each solves a distinct problem. But their power comes from how they interoperate.

Consider a real transaction flow: A user tells their AI agent to find the best price on a specific product with two-day shipping. The agent uses UCP to query merchants that have the product in stock and can fulfill the shipping requirement. It narrows the list in milliseconds. The agent then uses ACP to initiate checkout conversations with the top three merchants simultaneously, comparing final prices including tax and shipping. The agent selects the best offer. Finally, the agent uses AP2 to authorize payment through a Checkout Mandate, which the user's bank verifies cryptographically.

Total time: seconds. Total human intervention: zero. Total protocol dependencies: three.

Google's UCP specification explicitly describes this layered architecture — each protocol operates independently but interoperates through shared schema.org data structures. A merchant that implements only UCP can be discovered but not transacted with. A merchant that implements only ACP can check out but not be found. A merchant that implements all three is fully agentic-ready.

What Is the Revenue Cost of Delaying Protocol Implementation?

Organic search traffic will decline 50% by 2028 according to Gartner. Perplexity processes 1.2 billion monthly queries and ChatGPT has 800 million weekly users. Every one of these systems uses protocol-based discovery. Businesses without UCP, ACP, and AP2 are excluded from this channel permanently.

I want to be direct about the math. According to Gartner, organic search traffic to websites will decline 50% by 2028. SparkToro and Datos found that 69% of Google searches already end without a click. AI Overviews are expanding to cover 83% of informational queries with zero-click responses. The channel that businesses have relied on for two decades is contracting.

Meanwhile, the agentic channel is expanding. Perplexity processes over 1.2 billion monthly queries. ChatGPT has 800 million weekly active users. Google AI Mode is rolling out agent-driven shopping across its entire ecosystem. Every one of these systems uses protocol-based discovery, not traditional web crawling, to find merchants.

The businesses that implement UCP, ACP, and AP2 now will be discoverable by these systems as they scale. The businesses that wait will not. There is no retroactive discoverability in agentic commerce. You are either in the agent's index or you are not. And rebuilding from zero while competitors compound their agent-driven revenue is a position no business wants to occupy.

How Long Does Protocol Implementation Take and What Does It Require?

Implementation takes weeks, not months. UCP requires a manifest file and structured product data. ACP requires an API layer alongside existing checkout. AP2 requires mandate verification through your payment processor. A full UCP deployment with all three transport bindings ships in two weeks.

The good news is that these protocols are designed for pragmatic implementation. You do not need to rebuild your entire commerce infrastructure. UCP requires a manifest file and structured product data — your existing catalog provides the raw material. ACP requires an API layer that handles agent checkout conversations — this sits alongside your existing checkout, not instead of it. AP2 requires mandate verification through your payment processor, which Stripe and other major processors are already building support for.

The timeline is weeks, not months. Our UCP Implementation deploys the full manifest with all three transport bindings in two weeks. From there, ACP and AP2 layers build on the same foundation.

Our 9-pillar ACRA Assessment specifically audits your UCP discovery readiness, ACP checkout security, and AP2 trust mandates — identifying which protocols are implemented, which are missing, and what the revenue cost of each gap is.

The infrastructure for agentic commerce is being built right now. The protocols are defined. The standards are published. The only variable is which businesses adopt them first — and which ones spend the next three years wondering why their traffic disappeared.