Workshop:
E-commerce for
Humans and AI Agents

4.1 One Web, many protocols

The workshop opened with the two most visible agentic commerce protocols and two different philosophies.

Universal Commerce Protocol. Amit Handa (Google) (slides, video to be added) presented UCP as a common language for commerce, motivated by the shift from show me to help me to do it for me. UCP is modular: services (commercial domains such as shopping, and now food ordering and lodging), capabilities (catalogue, cart, checkout), extensions, transports (REST, MCP and A2A rather than a new transport), profiles for discovery, and payment handlers. It is open source, with around thirty organisations in its councils by September 2026. Our goal is not to replace any standard, he said, and we don't want one standard to rule the world. Questions from the floor highlighted that the product data schema is still immature, that brands which are not the merchant of record have no defined role, and that schemas need to be easier to find and contribute to.

Progressive enhancement. Riley Strong (OpenAI) (slides, video to be added) shared lessons from Instant Checkout and the Agentic Commerce Protocol (ACP): requiring a full end-to-end integration set too high a bar, and commerce isn't just one journey. OpenAI's answer is to apply the Web's oldest design principle. Agents should work wherever the web works. The open Web is the baseline; sites add agent-native enhancements step by step for four primitives: actions (for example WebMCP tools), identity (delegated access through OAuth, WebAuthn and passkeys), authority (explicit limits such as spend caps, ideally cryptographically signed) and payments (for example the Payment Request API or x402). Rapidly improving computer-use models make the baseline steadily more capable.

It’s a crowded field. Other presentations added more pieces: Huawei's Trusted Agentic Service Protocol framework and A4P authorisation protocol (Yukuan Jia), Google's AP2 and Mastercard's Verifiable Intent are now being harmonised in the FIDO Alliance (Jean-Luc Di Manno), and KYA proposals at the IETF and the Decentralized Identity Foundation (Skyfire, Vouched). Andrea Volpini (WordLift) listed more than ten agent runtimes and argued that the graph stays, the runtimes come and go. Yukuan Jia asked W3C to lead a protocol-neutral interoperability framework: a minimal common layer of shared semantics, protocol mappings and verifiable evidence, rather than forcing everything into one protocol. Paola Di Maio (W3C AI Knowledge Representation Community Group) (slides, video to be added) showed that the protocols partly reuse and partly fork established vocabularies, and that divergence concentrates exactly where trust and agency begin.

The direction that emerged was not to choose between protocols but to strengthen what they share: the Web platform, open vocabularies and identifiers, and common trust primitives. One breakout participant summed up why data deserves separate attention from protocols: data ages like wine and software ages like fish.

4.2 Making the Web legible to agents

WebMCP in production. Yoav Weiss (Shopify) (slides, video to be added) described three ways buyer agents reach merchants: back-end UCP over MCP, embedded MCP Apps, and in-browser agents. Only the last is, in his words, truly the agentic web, and we need the in-browser experience to be the better experience. In-browser agents today rely on screenshots and DOM actuation, which is slow, expensive and fragile. Shopify ships WebMCP on its storefronts, so that pages register tools with explicit schemas that run in the user's session. Lessons learned: mirroring back-end APIs as tools left the screen out of sync, so Shopify routes agent actions through the same events as human actions (a single execution path for both human flows and agentic flows); every navigation tears down registered tools; and sites have no signal of whether an agent session succeeded. Sites also cannot reliably tell which agents are visiting, or distinguish agent-driven sessions from unwanted bots; in discussion, he noted that clear agent identity, ideally with cryptographic backing, would help. Shopify asked for a way to declare that a tool follows a UCP shape, a WebMCP equivalent of skills, a user-in-the-loop (elicitation) primitive for checkout, tools that survive navigation, and real user measurements for agentic UX.

Accessibility as common ground. Léonie Watson (TetraLogical) (slides, video to be added) showed what online shopping is like for a blind shopper: basic flows work, but product information lives in images without useful text alternatives, so for every six items I will buy on an online store, I will send back at least five. Generative image description built into her screen reader is transformative but laborious, image by image. Agents and screen readers use the same browser model: the DOM, the accessibility tree and HTML semantics. We've all got a lot of common ground in what we need from the web. WebMCP will not help screen readers directly, because they are reactive by design, but it helps agents acting on behalf of disabled users, such as an agent now being trialled alongside a popular screen reader. She also asked that agent models represent disabled people accurately.

Entity pages and Terms of Action. Andrea Volpini (WordLift) (slides, video to be added) asked: what is the equivalent of schema.org for LLMs? In WordLift's experiment across four domains and 349 questions, publishing enhanced entity pages improved answer quality by about 30% relative to plain HTML, much more than embedding JSON-LD alone. With good information, a simple retrieval pipeline performed as well as an agentic one: if I increase the quality of the information, I can get a dumber model and save a lot of tokens. He proposed Terms of Action, a business-declared binding between entities and the actions an agent may take (owned, handed off to a partner, informational only), discoverable and exposed through WebMCP, UCP or MCP.

Publish once. Francesco Marinoni Moretto (slides, video to be added) argued that agents guess when guessing is cheaper than knowing, and that blocking doesn't reduce bad behavior, it just selects for it. A worked example on a regional tourism portal showed pages with no machine-readable content, every URL answering 200 with identical bytes, documented APIs that did not match production, and terms of use that an automated client could not see. His ask: a merchant should only have to publish once, not one surface per ecosystem, at one agreed well-known entry point, able to declare absence (say no), with terms co-located with resources. His LAR (Layered Agentic Retrieval) draft is offered for adoption by any existing effort.

Who speaks for the brand? Gianmaria Monteleone (Veliu) (slides, video to be added) warned that chat interfaces flatten every brand into the same generic product card. Generative interfaces can compose a page for each buyer, but only from pre-approved, brand-owned components and sources, so that every block should have a single source of truth and nothing is invented. He suggested that protocols like UCP, which already let merchants declare capabilities, could carry brand-approved knowledge and design intent, and that the ecosystem needs ways to measure whether agents preserve that fidelity.

Do websites need to change? This was debated in two breakouts and in the closing session without a settled answer. One view held that we will succeed if we don't make the merchants do anything, as models learn to use pages built for humans. Another held that lightweight layers such as WebMCP are cheap and pay for themselves in latency and tokens: WebMCP done right is effectively web performance for agents. All agreed that the long tail of small merchants will not change soon, that merchants cannot invest without being able to measure agent traffic, and that one Web serving humans and agents is preferable to a separate agent infrastructure. A participant in the closing discussion suggested a useful framing: accessibility helps less capable models, WebMCP with data helps mid-tier models, and frontier models need neither, so investment in accessibility serves all.

4.3 Product identity and authoritative product data

For brands and retailers, the most immediate concern was not protocols but product truth. In the opening session Phil Archer described a GS1 community that is terrified: in the old model a brand's data flowed through a controlled pipeline to a retailer that knew its customers; in the agentic model product data must be public, and a retailer may never know it lost a sale.

Similarity is not identity. Paula Rivero (Digital Link) (slides, video to be added) described an agent asked to reorder my usual curly-hair shampoo that searched, compared and paid flawlessly, and delivered a different product from the same brand. The agent got every verb right, but it got the noun wrong. As retail moves from linear barcodes to 2D codes, GS1 Digital Link gives every product a Web identity that resolves, through a standard linkset, to brand-controlled information at the level of the product type, the batch or the individual item. Agents should infer intent from the conversation, but resolve identity from the brand's authoritative source: the intelligence of the agent remains, but the guess disappears. Product identities, she argued, must not belong to one platform.

The GTIN is not always the primary key. John Howe (Mars) and Alfonso Bravi (K10X) (slides, video to be added) showed that online content matches the physical pack only about half the time, and that AI is often confidently wrong about critical facts such as allergens. Many real changes, such as cross-contamination from a new line, reformulation or promotional artwork, do not change the GTIN. Their pilot, part of the SmartFacts programme with GS1 Australia, serves one brand-hosted record to humans and machines through content negotiation, resolves at the level of the Consumer Pack Variant, and refuses to answer rather than guess when a variant is unknown. Absence of a claim is not a claim of absence. They asked whether the full resolvable URI, rather than the bare GTIN, should travel with product records, and how a brand's catalogue could become discoverable sideways on the open Web.

Who may speak for a product? Sven Böckelmann (benelog) (slides, video to be added) pointed out that Digital Link resolution says where data is and a signature says who signed it, but neither says whether the signer may speak about that GTIN, or make that kind of statement: a retailer selling: normal. A retailer announcing a recall: not. Anyone can host a valid Digital Link for any GTIN. He proposed building an entitlement check from the GS1 licence registry, licence-chain verifiable credentials (on the model of GLEIF's vLEI) and published roles. Wajih Rehman (Fabacus) (slides, video to be added) made a parallel case for licensed products, where nothing links a licensee's GTIN to the licensor's rights and approvals: in agentic commerce, trust is no longer inferred. It is computed, and real trust has to come with receipts. Branimir Rakić (OriginTrail) (slides, video to be added) showed how the OriginTrail Decentralized Knowledge Graph lets agents combine product data from many parties as verifiable, signed knowledge assets built on RDF, verifiable credentials and EPCIS, carrying provenance and integrity. His proposal pairs this verifiable product knowledge with portable, verifiable agent identity and reputation, while noting that product authority requires its own evidence.

Packaging as the first handshake. Jenny Stanley (Appetite Creative) (slides, video to be added) presented connected packaging as the bridge between the shelf and the agent, with survey data showing that more than 80% of brands surveyed plan connected packaging. With GS1 Sunrise 2027 driving the move to 2D barcodes, she urged brands to use open GS1 Digital Link rather than proprietary QR platforms, which leave product data invisible to agentic commerce.

Vocabularies. A mature, open vocabulary stack already exists: schema.org, the GS1 Web Vocabulary, GS1 Digital Link link types and UN/CEFACT. Paola Di Maio asked whether agent-facing product data should be required to reference an open vocabulary, who maintains crosswalks to protocol schemas, and how a resolution path should be declared. Breakouts proposed mapping overlapping retailer and platform feed attributes to schema.org and the GS1 Web Vocabulary before they diverge further, and defining a minimum set of attributes that agents need.

The discovery gap. A GS1 Netherlands proof of concept showed that Digital Link with the GS1 Web Vocabulary works well for agents that are pointed at it, but that public LLMs do not find it. A Google Shopping participant noted that there is currently no Digital Link attribute in Google's shopping feed, so the pieces are simply not connected. Resolvers were described as routing tables that are mostly empty. Participants proposed resolver sitemaps, a feed attribute for Digital Link, and agreements between GS1 and platforms, and saw EU Digital Product Passport requirements as a lever for publishing structured, identity-linked data at persistent URLs.

4.4 Agent identity, delegation and authority

Day 2 opened with the chairs' framing: today we're going to talk about how we can trust them a little bit more and really know who they are.

Know Your Agent. Several presentations converged on agent identity bound to a responsible human or organisation. Ankit Agarwal and Mike Jones (Skyfire) (slides, video to be added) presented KYAPay, a signed JWT carrying claims about the human principal, the agent platform and the agent instance, verified at the edge by existing bot-management, CDN and fraud systems with no merchant integration. Legitimate agents get blocked because nobody knows who the human behind them is, and I'm not going to argue with a machine. Six Internet-Drafts have been submitted to the IETF OAuth Working Group; none had been adopted at the time of the workshop. Dylan Hobbs (Vouched) (slides, video to be added) presented KYA-OS, an open specification hosted with the Decentralized Identity Foundation, in which DIDs identify, verifiable credentials delegate and signatures bind each exchange: whether it has permission to spend my money shouldn't depend on its judgment. His demonstration showed a passkey-approved, revocable grant enforcing spend caps and product scope, with a tamper-evident audit trail.

Signed, bounded authorisation. Yukuan Jia (Huawei) (slides, video to be added) proposed five levels of payment autonomy, from P0 (manual) to P4 (full autonomy), and identified the step from P1 (the user confirms each payment) to P2 (the agent pays within pre-set bounds) as the critical trust transition. He shared implementation experience from Huawei's Celia agent, HarmonyOS atomic services and Huawei Pay, where the assisted level (P1), with biometric confirmation of each payment, is already in production, and described cross-device journeys in which, for example, an order requested on a watch is confirmed on a phone. Because agents can hallucinate or be attacked, we should not rely on natural language instruction alone: Huawei's A4P protocol uses structured, hardware-backed signed intents, runtime enforcement and verifiable evidence. He asked W3C to help with a common autonomy taxonomy, with extending commerce vocabularies to describe agents, authorisations and constraints, and with protocol-neutral interoperability.

Payments credentials and mandates. Jean-Luc Di Manno (slides, video to be added) described the FIDO Alliance Payments Technical Working Group's harmonisation of Google's AP2, Mastercard's Verifiable Intent and Digital Payment Credentials. Two roles are central: a credential provider, so that the agent never holds the payment instrument, and a deterministic trusted surface for consent. Mandates expressed as verifiable credentials travel across the ecosystem as evidence. The demonstration used the W3C Digital Credentials API to show a confirmation the agent cannot control. EMVCo is working in parallel on intent services and agent identity.

Beyond identity: runtime trust. Speaking for Fime, Jean-Luc Di Manno (slides, video to be added) observed that every protocol starts after the agent has interpreted the user's request: the intent we are talking about is always the intent interpreted by the agent. If a user mentions a friend's egg allergy and the agent keeps only food for four, vegetarian, under $50, a perfectly authorised purchase is still wrong. Fime's ATLAS draft proposes accredited assessor agents that check the agent's reasoning against a rule book and issue privacy-preserving evidence. Participants questioned whether accreditation models built for deterministic systems can apply to non-deterministic ones.

Agents that do not use any protocol. A Day 2 breakout asked what prevents an agent from simply driving a headless browser with the user's card details. The answer was: very little. Bot detection is a cat-and-mouse game; fraud models were trained on yesterday's agents; and payment participants pointed out that giving card details to an agent is like giving them to a family member, leaving the user liable. Ideas included trusted-agent registries with revocation, industry norms for agents to sign their requests (for example with HTTP Message Signatures as in Web Bot Auth), regulation, and browsers acting as a point where agents identify themselves, although participants noted that W3C may not want to be a body of guardianship. In the closing session, a participant cautioned that there are legitimate reasons not to identify, and that easy market entry without registration is what we call the open web, and we all have a responsibility to make sure that we don't break it. Privacy-preserving approaches such as FedCM and the Digital Credentials API were suggested to avoid over-collection of personal data.

4.5 The human in the loop: intent, confirmation and the last reversible moment

Four presentations independently described the same failure mode, in which an agent acts within its explicit limits but commits the user to something they did not intend:

• a cabin suitcase bought under budget, together with a €49 a year loyalty plan accepted in the merchant's terms (Claudia Caluori);
• a one-time toner order that becomes a monthly subscription at the same price (Scott Lee);
• a meal order that drops a guest's allergy and the user's medication constraints (Jean-Luc Di Manno);
• an agent using stale instructions or exceeding its mandate (Steve Cole).

Philippe Le Hégaret summarised the concern for merchants: no retailer wants returns because an agent bought something the customer did not really mean to buy. The credential can be genuine. The final action can still be wrong, said Scott Lee (Meridian Verity Group) (slides, video to be added), who proposed Action Acceptance at the last reversible moment: before an effect becomes real, the system that would make it real asks whether this exact effect may happen now, given current authority, exact terms, fresh evidence, revocation state and replay status. Its answer can be accept, hold or refuse; not yet is neither yes nor never, and authority and evidence may travel. Final acceptance is not inherited.

Participants consistently wanted a confirmation step that the agent cannot alter. FIDO's trusted surface rests on the observation that everyone here trusts the browser when the browser says this is the basket, this is the amount; you cannot trust the agent doing that. A Day 2 breakout on the trusted surface concluded that, because the merchant must legally present a summary before the user commits, an agent that re-presents that summary takes on responsibility, and must be able to prove it passed the details on verbatim, for example by hashing what the user saw. For now, everybody does like the confirm button; insurers are not yet ready to cover fully autonomous outcomes, and prepaid or limited cards are a stop-gap.

The remaining questions are concrete: who renders the trusted surface (the browser, the operating system, the bank, the merchant or the wallet); how deviations are handled (FIDO's answer is a new mandate; legal speakers suggested separate records for each distinct contract); and how step-up authentication works when the human is not present, at 3:00 a.m.. Philippe Le Hégaret added a further question: what does human in the loop mean when the human interacts through a screen reader or other assistive technology that is itself increasingly AI-based?

Co-browsing, in which a human and an agent use the same page at the same time, was identified as a key interaction model, and as a potential area of collaboration between W3C and GS1 on serving content to humans and agents in a complementary way.

4.6 Merchants, payments, liability and law

The merchant view. Steve Cole (Merchant Advisory Group, representing around 200 large merchants) (slides, video to be added) explained that fully autonomous transactions are just not a new user interface from a payments perspective but a structural change. Card-not-present rules assume a human pressed the button, and there is no authorized by agent scenario. Merchants will be reluctant to participate until six areas are addressed:

1. liability that follows control of the failed function, rather than defaulting to the merchant;
2. routing neutrality and token portability, to avoid lock-in to one wallet or processor;
3. a mandatory, standard evidence package for disputes: agent identity, user verification, the consumer's mandate, and the payment credential and authorisation record;
4. data sovereignty, including explicit, revocable consent before merchant data is used for model training;
5. an open Know-Your-Agent standard with cryptographic verification, real-time revocation and no single controlling party;
6. transparent fees.

He noted that agentic commerce could produce better dispute evidence than today's e-commerce, if the evidence is standardised: everybody has a plan until you get punched in the face. And we just haven't got punched in the face yet.

The legal view. Claudia Caluori (Studio Polimeni) (slides, video to be added) explained that one agent purchase legally contains several distinct acts, each needing its own authority: the authority to buy, the authority to accept the merchant's terms, and the payment authorisation. EU law protects the moment of commitment with pre-contractual information and explicit acknowledgement of the payment obligation; common-law systems tend to resolve disputes later, through scope of authority, causation and damages. Both need reliable evidence of identity, authorisation and provenance. Current case law tends to place responsibility on whoever deploys an automated system. These standards do not decide liability, but they preserve the facts the law needs and shape where consumers place their legitimate expectations. She called for a gap analysis of where law assumes a human intermediary, for early liaison between the technical and legal communities, and for legal legibility of agent transactions. In the closing session she noted that most judges and lawyers do not yet understand what is happening. She also raised a question few others had: whether an agent that accepts terms and conditions, which humans rarely read but an agent can, binds the user.

Payments infrastructure. Card networks are issuing transaction-scoped agentic tokens, and Skyfire's demonstration showed agents paying with single-use credentials. Open issues included recurring payments, which short-lived credentials do not support; strong customer authentication without a present human; and standardised dispute claims, which merchants and networks are discussing with EMVCo. Philippe Le Hégaret suggested that the W3C Web Payments Working Group may need to consider whether Web applications need support for the agent identity and payment protocols being developed at the IETF and elsewhere, as W3C has done with WebRTC and Web Authentication.

4.7 Beyond the screen: accessibility, the physical world and society

The physical world. Jari Arkko and Mirja Kühlewind (Ericsson) (slides, video to be added) argued that agents are largely blind to the real world. Networks can provide real-time information such as location, crowd density and network sensing, enabling use cases from connectivity on demand to emergency response. This raises requirements for discovery of location-specific capabilities, common vocabularies for real-world information, reactive agents, auditability across multi-step workflows, and consent and human oversight. A blind participant pointed to indoor navigation, from a hotel reception to a room, as a compelling use case.

Spatial commerce. Muadh Al Kalbani (Samsung) (slides, video to be added) examined immersive and augmented-reality shopping on the Web. Which layers of information does an agent actually need: product semantics, 3D representation, interaction state, or sensor data? Users who consented to a camera for a virtual try-on did not consent to a general-purpose agent consuming what it sees, so agent participation may need its own permission. The proposed WebXR marker-tracking work would let pages detect QR codes without exposing camera frames, building on ISO and GS1 symbologies. Any agent-related specification, he said, must demonstrate compliance with W3C's ethical, privacy, sustainability and architecture principles.

Human alignment. Bob Vuppal (GS1 Canada) (slides, video to be added) reminded participants that people shop to save time and solve problems, but also to be noticed, to connect and to feel well. Current protocols serve the first two. He called for alignment layers grounded in authoritative product data, such as age-appropriateness ratings for products, and noted the large and underserved B2B opportunity.

Inclusion and choice. Several speakers stressed that not everyone can afford, or wants to use, an AI agent. Léonie Watson does not expect accessibility lawsuits to decline because access to generative AI is unequal. Participants at TPAC added that websites will not go away: some people will choose not to use an agent, and the Web must continue to serve them for shopping, banking and everyday tasks. Philippe Le Hégaret noted that privacy and sustainability are raised in every AI discussion, and that W3C should also consider AI and society from the user's perspective.