Agent commerce is no longer a single-product race. Value, risk, and durable margin concentrate across seven stacked layers: Model, Data, Protocol, Identity and Hosting, Evaluation, Security and Compliance, and Ecosystem.
Visa’s October 2025 Trusted Agent Protocol release cites a 4,700% surge in AI-driven traffic to U.S. retail sites. Google ships Universal Commerce Protocol (UCP) for AI Mode and Gemini checkout. OpenAI and Stripe maintain Agentic Commerce Protocol (ACP) for agent checkout.
In September 2026 Amazon blocked Meta’s Muse agent from shopping Amazon.com without authorization. Builders who only optimize the model layer lose when portals cut access, protocols fork, or evaluation and security gates fail before the first paid order.
Today we cover:
The seven-layer map— where capability, commercial access, and accountability sit, and why security cuts across every layer.Layer 01 Model case studies— cheaper tokens, commerce-tuned open weights, and routers (OpenAI, Anthropic, Google, Meta Llama, Groq, Fireworks, OpenRouter, Portkey).Layer 02 Data case studies— clean catalogs, consented profiles, licensed portal data (Salsify, Akeneo, Inriver, Segment, LiveRamp, Snowflake clean rooms).Layer 03 Protocol case studies— payment rails, multi-standard bridges, MCP skills (Visa TAP, Mastercard Agent Pay, Stripe ACP, Google UCP/AP2/A2A, Anthropic MCP).Layer 04 Identity and Hosting case studies— verify, score, isolate (Visa TAP + Cloudflare, Skyfire, E2B, Daytona, Modal).Layer 05 Evaluation case studies— commerce regression and certification (Braintrust, LangSmith, Promptfoo/OpenAI, AIUC-1).Layer 06 Security case studies— guards, proofs, scored liability (Lakera/Check Point, Prompt Security, OWASP AIVSS and CSA).Layer 07 Ecosystem case studies— access deals, liability, standards seats (Amazon vs Meta Muse; OWASP, Linux Foundation, W3C).
