The Know Your Agent framework announced by Ant International, Visa, and Mastercard on September 10, 2026, addressed the identity layer of autonomous commerce. It did not address the trust layer. For the three payment networks and every merchant hoping to participate in the projected $3-5 trillion agentic commerce market, the distinction matters more than the announcement itself.
KYA solves a real problem: cross-network operator traceability, shared certification requirements, and continuous transaction monitoring. But consumers are not primarily concerned with whether an agent can be identified. They are concerned with whether they should allow an agent to act at all. The data is unambiguous. According to Klaviyo’s 2026 AI Consumer Trends report, 64% of consumers worry about AI platforms handling their data, while only 13% completely trust them. Visa’s own 2026 Trust Index found that 61% of consumers trust Visa with their data, but only 23% trust generative AI. The gap between institutional identity verification and consumer willingness to authorize autonomous payments is the binding constraint on the entire market.
The permission gap is not a branding problem. According to Accenture’s 2026 Consumer Pulse, 75% of consumers report being uncomfortable with AI making autonomous payment decisions without human approval. The Usercentrics State of Digital Trust 2026 found that only 9% of consumers would allow AI to make purchases above $25 without explicit verification. These are not edge cases; they represent the median consumer’s posture toward autonomous commerce.
Visa’s $2.4 billion acquisition of BioCatch in August 2026 signals that the market is already pivoting from static identity to behavioral verification. BioCatch’s technology monitors how users interact with devices – typing patterns, mouse movements, navigation behavior – to build continuous behavioral profiles. This approach moves beyond the KYA question of “who is this agent?” toward the consumer’s real question: “is this agent behaving within my authorization?” The acquisition suggests Visa understands that identity alone does not close the trust gap.
The trust challenge is also brand-dependent. Consumers do not treat all AI platforms equally. The Klaviyo data shows that trust correlates strongly with the perceived reliability of the brand behind the agent. A Visa-branded agent authorized to make purchases on a consumer’s behalf faces a fundamentally different trust calculus than an unknown platform’s agent making the same request. This means KYA’s cross-network interoperability, while necessary for merchant adoption, does not simplify the consumer’s decision-making process. If anything, it complicates it by abstracting the brand signal behind a technical verification layer.
For builders and operators in the agentic commerce space, the practical implication is clear: identity infrastructure is a prerequisite, not a solution. The KYA framework provides the technical foundation for agents to participate in commerce, but converting experimental traffic into high-value financial transactions requires solving the psychological barrier of consumer authorization. Until agents can demonstrate consistent, verifiable behavior that earns consumer trust over time, the permission gap will remain the primary bottleneck to scaling autonomous commerce beyond controlled pilots.