In one of the recent reports, McKinsey said that what they label “credentialling and identity” is the first of their key control points in the agentic economy becaue agents need secure, user-granted permission before they can initiate transactions across multiple institutions. Therefore, as they point out, organisations that already manage high-trust credentials start with a clear advantage. They go on to highlight some success factors: zero-trust architectures that never assume persistent access, dynamic consent via standardized protocols (for example, OAuth2/OpenID Connect) and continuous audit trails.
I agree with their emphasis, of course. In facr, I have just co-authored a paper on Know-Your-Agent (KYA) with Jelena Hoffart of Mastercard. The paper is called “Know your agent: Enabling autonomous financial services” and it is published in the Journal of Digital Banking, Volume 10, Number 2, pages 123-134 (Autumn/Fall 2025), and it explores the identification, authentication and authorisation of non-human customers. This is a topic that is both central to the evolution of the online economy and intellectually fascinating, which is why I spend so much time looking at strategies in the field.
If I want to grant my agent Dave1A permission to go and book flghts on British Airways and book hotels on Hilton, then British Airways and Hilton need Dave1A to present a credential that says that the agent is allowed to book on my behalf together with my loyalty identifiers and maybe some other attributes.
Persona, the verified identify platform used by a host of fintechs (including Robinhood, Brex and OpenAI) has raised $200 million at a $2 billion valuation. The company says that rise of AI agents, increasingly sophisticated AI-driven fraud, regulatory fragmentation, and growing privacy expectations have created a far more complex — and constantly evolving — identity landscape. As Rick Song, CEO of Persona, puts it “Identity in an AI-driven world isn’t about ticking a box, and the question is no longer ‘is this a bot or not?’ but rather ‘who is the bot acting on behalf of, and what is their intent?
OK, I think that is straightforward and it is already clear that agentic commerce will be enabled by standard verifiable credentials (VCs) of one form of another, we do not need to speculate about that. But it is of course interesting to speculate on who will define what such credentials might look like and the framework in which they will work. Mastercard and Visa are obvious players in that space, but it is early days.
This was one of the topics discussed at Checkout.com’s recent conference in Venice, where they announced a pilot with a major UK retailer to place orders via Microsoft Co-Pilot but as Geoffrey Barraclough highlighted in his report on the event, the big question isn’t how this technology will actually work but who will pay who and how the rewards and liabilities will be shared between merchants and agents, platform and payments processor.