If you're building ecommerce systems right now, here's something worth thinking about: what happens when your customers aren't humans anymore?
I don't mean this in a sci-fi dystopia way. I mean practically, architecturally — what changes when an AI agent, not a person clicking through your checkout flow, becomes a first-class user of your system?
Agentic commerce isn't about chatbots that help you find products. It's about delegation at the transaction level. A user says "keep me stocked on coffee beans, optimise for price and delivery" and an agent — with its own credentials, budget, and decision-making logic — handles the rest.
From a dev perspective, this creates some genuinely new problems:
Here's where it gets commercially interesting, and why I think this matters to you even if you're just shipping features today.
When humans shop, trust infrastructure is invisible: HTTPS, payment card networks, browser security models. We built all of that over decades.
With agents, that trust layer doesn't exist yet — and whoever builds it will control a lot. Think about:
This isn't theoretical. If you're building AI automation and software development systems, you're already adjacent to this problem space.
You don't need to rebuild your entire stack, but there are some practical steps worth considering:
If your ecommerce API is designed exclusively for SPAs and mobile apps, it's going to struggle with agents.
// Instead of requiring session cookies:
GET /products?category=coffee&sort=price&delivery_speed=fast
Authorization: Bearer <agent_token>
// Return structured, parseable data
{
"products": [...],
"_meta": {
"agent_hints": {
"reorder_eligible": true,
"subscription_available": true
}
}
}
Your monitoring and analytics probably assume human behaviour: sessions, cart abandonment, browsing patterns.
Start logging and flagging agent-initiated transactions separately. You'll want to understand:
When an agent acts, it's not pretending to be the user. It's acting on behalf of the user. That's a meaningful distinction.
Your data models should capture:
CREATE TABLE orders (
id UUID PRIMARY KEY,
user_id UUID NOT NULL,
placed_by_agent_id UUID, -- null if human
agent_authority_token TEXT, -- verifiable delegation proof
...
);
Liability and regulation are still wide open. If an agent makes an unauthorised purchase, who's responsible? If it violates terms of service, do you ban the agent? The user? Both?
There's no case law. There's barely any industry consensus. But these questions will land on your backlog when your product manager asks you to support agent-driven purchasing.
Agentic commerce isn't a 2030 problem. If you're in ecommerce, marketplace, or API platform engineering, this is a 2025–2026 problem.
You don't need to solve it all today, but you do need to be thinking about:
Because once that trust layer solidifies, migrating will be expensive. Better to have a point of view now.