Building Trust in Agentic Commerce: a close reading of the six-bank principles paper

On 22 September 2026, six banks on three continents published a short paper called Building Trust in Agentic Commerce: ASB Bank, Bank of America, Capital One, Commonwealth Bank of Australia, ING Group and NatWest Group. The Paypers summarised it as five principles (transparency, safety, privacy and data, choice, interoperability) and a foundation for further discussion rather than “a finished standard.”

A month later, several of the same banks were in the news for restricting outside AI agents. Reading the paper again in that light is useful. It explains what the banks are worried about in their own words, and it contains a few commitments that go further than the headlines.

First, what it is not

The paper is explicit about its status. Its principles “are voluntary and non-binding,” and it “does not prescribe conduct, any commercial position or any particular method or timetable for implementation.” A second paper on how to implement the principles through protocols, standards and policy is promised. So this is a statement of intent from six institutions, not a rulebook.

The autonomy spectrum

The most useful page is a diagram. It lays agentic commerce on a line from traditional e-commerce to fully autonomous purchasing:

1. The agent searches; the human executes the purchase.
2. The human gives an initial prompt, then reviews the final purchase.
3. The human pre-approves a specific purchase for the agent to execute later.
4. The agent executes a purchase on its own after an initial prompt, with no review.
5. The agent identifies a need and purchases on its own.

The first three are labelled “human in the loop”, the last two “autonomous”. The paper notes that agents can “execute purchases when customers are not present,” and that risks “may increase as greater autonomy is given to AI agents.” The categories matter, because nearly every control a bank might apply depends on knowing which side of that line a given transaction sits on.

“Outpacing formal governance”

The paper says agentic commerce “has already shifted from closed trials to live pilots and early scaling,” and that these developments “are outpacing formal governance.” It credits payment networks and technology platforms with most of the protocol work so far, which includes efforts like Mastercard's Agent Pay and Google's Agent Payments Protocol. Then comes a line that reads differently after October: “some transactions are operating outside of formal protocols, increasing risks for consumers and merchants.” An agent signing in with a customer's password is exactly that.

The five principles, and the lines that matter

1. Transparency

Principle 1.1: “All parties involved in agentic commerce should be aware when an AI agent is helping to make or facilitate a transaction, and on whose behalf they are acting.” This is the disclosure principle, and it is in direct tension with an agent that logs in as the customer and is indistinguishable from them.

2. Safety

The safety section is the most concrete. It names unsafe practices, including agents:

• “requesting consumer card details and entering them directly into websites”;
• “prioritizing payment methods with lower protections”;
• and attackers “compromising or impersonating AI agents and merchants.”

It also names a data gap: issuers and acquirers “may not have real-time access to data on AI agent identity, merchant of record, consumer intent and purchase details.” Two of the five safety commitments stand out:

• 2.2: consumers “should have appropriate control over the authority they grant to AI agents, including the ability to view and manage delegations.”
• 2.3: providers “should use secure and auditable methods to enter payment credentials and authorize purchase intents and payments, with any party holding a potential liability being able to require authentication.”

2.3 is the sentence a bank's risk team will underline. It says that whoever carries the loss gets to ask for proof before the money moves. It is the opposite of the passive model where a bank finds out after the fact that software was driving.

3. Privacy and data

Principle 3.2: providers “should maintain auditable records to evidence consumer instructions, authentication, intent, and transaction decisions and outcomes.” The surrounding text adds that such records must support “scam and fraud investigations, recovery activity and dispute resolution.” Principle 3.3 adds data minimisation: providers should only access the data they need.

4. Choice

The choice principle cuts both ways. 4.1 says consumers should be able to choose agentic services “without unreasonable restrictions.” 4.2 says service providers “should retain choice over which agentic commerce services they support based on safety, commercial sustainability and legal / regulatory grounds.” Read together, they are the policy basis for what banks did in October: customers can use agents, and banks can decline to support particular ones on safety grounds.

5. Interoperability

The last principle asks for common approaches on functions core to the other four, while leaving room for competition on everything else. It is the least specific section, and the one the promised second paper will need to fill in.

On liability

The paper does not assign liability, but it describes the problem precisely: there is “unclear and inefficient allocation of liability,” including over “who would be liable if an AI agent exceeds its authority.” Principle 2.5 says liability outcomes should reflect “where risks and errors are introduced.” Compare that with a contract that puts every agent error on the customer, such as Wells Fargo's new terms. The industry has not converged.

Our reading

Strip out the diplomacy and the paper asks for three things at the moment an agent transacts: know that an agent is involved, let the party at risk require authentication, and keep a record that shows what the customer actually instructed and approved. Bank of America's chief executive later put the practical version in one sentence: when money leaves an account, a person must approve it, Digital Today reported. He also told Bloomberg that “when you give the agent your credentials, it is you authorizing the payment,” USA TODAY noted.

All three depend on a question that existing payment and login checks were not designed to answer: at this moment, for this payment, is a person in control or is software acting alone? That question is where HEIP sits. It does not decide whether an agent is trustworthy. It tells the platform whether a person is at the controls of the session that is about to approve the action, and keeps a record of the answer.