xxx
The emerging control layer and protocol standards
As basic authorization and transaction clearing become increasingly commoditized, five product capabilities capture emerging infrastructure value:
agent credentials—cryptographic identities that bind software agents to human or corporate principals, defining clear authority boundaries and enabling instant revocation
mandate and consent engines—standardized protocols that specify what an agent is permitted to execute, including spending caps, approved counterparties, and active expiration windows
runtime policy guardrails—granular spending rules enforced at runtime, such as velocity throttles and category restrictions
agent wallets—programmatic liquidity containers that enable autonomous agents to hold operating balances and execute micropayments within defined parameters.
transaction dispute frameworks—recourse mechanisms and clear liability allocations when an agent executes a transaction that technically complies with its mandate yet conflicts with user intent
These infrastructure components generate recurring per-mandate fees, API call pricing, and risk underwriting premiums rather than transaction volume basis points.
Market participants are establishing complementary protocols in different layers of the transaction stack. Card network initiatives such as Visa’s Trusted Agent Protocol and Mastercard Agent Pay focus on machine identity and network dispute rules. At the same time, application standards such as Google’s Agent Payment Protocol and the Stripe and OpenAI Agentic Commerce Protocol govern runtime checkout interactions.
From: The 2026 Global Payments Report | McKinsey.
xxx
xxx
Banks: Own trust & identity
Remember back in section 2, page 14 when McKinsey recommended banks own the Identity layer? Section 3, page 25 is the only other time they mention it:
“Issue verifiable machine credentials, manage delegated authorization and consent mechanisms, and actively shape industry standards before protocols become fixed.”
That may work in countries where the top 3-5 banks have ~90% share. They can coordinate to offer a shared credential based on their internal KYC. But in the US, the top 10 banks have <60% share with a long tail of thousands of banks. The big banks tried to create an identity bureau at EWS in 2015-2019, but never launched. I never knew why, but liability may have been a contributing factor.
For the US, this recommendation seems gratuitous. No bank has enough consumer DDA share to do this on their own and doing it as an industry already failed. Bringing in the long tail might take forever (e.g., Fednow, Zelle). The biggest eCommerce acquirers and the card networks might get there sooner. So might Apple, at least for iPhone users.
From: Assessing the McKinsey Global Payments Report.
xxx
