This is the first issue of a weekly note on agentic commerce, written from the boring side of the buy button: order ingestion, inventory sync, fulfillment, returns, and making the payment processor agree with the ERP at month end. Most coverage of this space is about discovery and checkout UX. I care about what happens after the order exists. Each story gets a short summary with primary sources, then my take on what it means for the back office. Where I am guessing, I say so.

This week covers roughly October 2 to October 9, 2026, with one late September item that is too relevant to skip.

1. Sierra and Meta propose a Personal Agent Protocol

What happened. On October 6, Sierra announced the Personal Agent Protocol, an open standard it is developing with Meta and partners Genesys, Instinct, Rocket, Shopify, Stripe and Walmart. It defines how a personal agent discovers what a business offers, starts a session (as a guest or signed in), and gets either read-only or write access that the customer chooses. The session is built on OAuth and is meant to carry across channels, so a question asked before sign-in and an order change made afterward belong to the same visit. Businesses decide whether agents work through the website, through APIs built on standards like MCP and OpenAPI, or through the company’s own agent. Sierra says a v0.1 spec, design workshops and a reference implementation are planned for later this month. Future ideas it lists include finer-grained permissions, push notifications (for example when an order ships) and payment extensions. PYMNTS quotes Meta saying the work will address how agents “securely convey user identity” and how businesses can steer them toward efficient website use or optimized APIs.

Context matters here. Two weeks earlier, Amazon cut off Meta’s Muse agent from shopping on Amazon.com, saying it did not identify itself, was not authorized by Amazon, and appeared to store customer credentials. Meta said credentials go into secure storage that Muse uses without seeing them.

Why it matters. Most agentic protocols so far are about a checkout session. This one is about an account session, which is where a lot of back-office traffic lives: “where is my order”, “change the address”, “start a return”. Today those requests arrive as a human on the phone or an unidentified browser. A scoped OAuth grant with read versus write is a far better primitive than credential replay, and it maps onto things we already run, like customer account APIs and returns portals.

The part I want to see in the spec is what a write actually means. Changing an address after an order has been released to a 3PL is not a simple PATCH. It may need a cancel-and-recreate at the WMS, a carrier label void, and a hold on the ERP sales order. If PAP lets an agent request an order change, the business still needs a state machine that says “too late, it already shipped” and a way to return that answer in a structured form. I have not seen any proposal for that yet, and I suspect it stays business-specific.

Two caveats. There is no spec to read yet, only an announcement. And the partner list does not include the companies behind the most-used general assistants. A sign-in standard only helps if the agents your customers use speak it, so plan for two paths: protocol-speaking agents with scoped grants, and everything else at the bot-management layer.

2. TikTok launches Buy Direct and a Shopping Assistant, built on UCP

What happened. On October 5, at Advertising Week New York, TikTok announced Buy Direct, an in-app checkout that lets users buy from a brand without leaving TikTok, including one-click purchases from the For You feed, and Shopping Assistant, a conversational agent for product details, shipping, sizing and availability. It says it is building these with Salesforce, Shopify, Shoplazza, Stripe and others. TikTok’s business blog post adds the details that matter to integrators: brands remain the merchant of record, Buy Direct includes in-app order tracking, and it “requires an integration with Universal Commerce Protocol (UCP)”. The features are available through eligibility-based testing. TechCrunch notes this sits separately from TikTok Shop, the existing marketplace.

Why it matters. This is the most concrete signal so far that UCP is becoming the default contract for “platform takes the order, merchant fulfills it”. For a back office that is mostly good news. The UCP 2026-08-25 release already added things integrators care about, such as an attribution field for referral context and a policies[] snapshot on cart, checkout and order to carry return, refund and warranty terms. If TikTok, Google and Shopify all ride the same order shape, one mapping into the OMS can cover several surfaces.

The catch is that one company now produces two very different order streams. TikTok Shop orders are marketplace orders with marketplace settlement. Buy Direct orders are your own merchant-of-record orders that originate inside TikTok. If both land in the ERP under one “TikTok” channel, finance cannot explain the payouts and returns route to the wrong policy. Give Buy Direct its own channel code from day one.

“In-app order tracking” is the other thing to read carefully. That status has to come from your fulfillment events, so your shipment confirmations, partial shipments, and cancellations need to flow back reliably. If your current tracking sync is a nightly batch, an agent-facing surface will expose that quickly.

3. Shopify lets browser agents complete checkout via WebMCP (Sept 28)

What happened. On September 28, Shopify added WebMCP tools to checkout: get_checkout, update_checkout, complete_checkout and navigate_to_storefront. They run inside the checkout page, use the same state as the UI, and need no merchant configuration. The docs say the implementation follows the UCP checkout capability, agents should sign requests with Web Bot Auth, the buyer must confirm the order and total before complete_checkout, and server-side agents should use Checkout MCP instead.

Why it matters. Two lines in the docs stand out for anyone who has debugged duplicate orders. First: “Checkout WebMCP doesn’t use id, meta, or an idempotency key.” Duplicate protection comes from the checkout itself returning complete_in_progress or completed. Second: on completion_failed, “Don’t resubmit while the outcome is unknown.” That is reasonable for a single browser tab, but it puts the burden of not double-submitting on the agent. Downstream, I would keep the usual duplicate detection on order ingestion (same customer, lines and total within a short window), because a confused agent can always start a second checkout.

The bigger back-office issue is that these orders look like ordinary web orders. The docs say update_checkout in WebMCP ignores attribution. Unless the agent’s Web Bot Auth identity is surfaced somewhere you can read later, you probably cannot tell in the ERP which orders were placed by a browser agent. That matters for dispute rates and fraud tuning (see the next story). This is speculation on my part, but I expect “agent-placed” to become an order attribute merchants ask for within a year, and today there is no standard field for it.

4. Visa and Amex on the payments side: it is “just another sales channel”, with sharp edges

What happened. In an October 6 PYMNTS interview, Pavan HS, senior director of product for agentic commerce at Visa, said merchants see agentic commerce as “just another sales channel” and that “no merchant is going to rip up their payment stack”. He described a merchant selling through Gemini where the agent used Google Pay, the site did not accept Google Pay, and stores ran on a different processor, so an in-store return of an agent purchase was hard to match to the original credential; Visa’s token service linked them. He also described Gemini traffic originating in Singapore for a US consumer and US merchant, which existing fraud rules began declining. His summary on identity: “We haven’t really figured out what an agent identity is.” His advice after launch is to monitor authorization rates, chargebacks and disputes.

The same day, American Express released a merchant playbook with survey data: 83% of 502 surveyed US businesses see agentic commerce as an opportunity, 41% are experimenting or implementing, and 86% expect to need at least moderate support from payment partners. On the consumer side, 52% are comfortable letting an agent buy everyday low-cost items, versus 15% for high-value items. Amex also reiterated its plan to protect eligible card members and merchants from charges caused by errors from registered agents.

Why it matters. The Visa examples are the most useful thing I read all week, because they are reconciliation bugs, not strategy. A refund that cannot be matched to its original capture is exactly the kind of break that sits in an unapplied-cash report for months. If you accept orders from agent surfaces, check three things now. Can your refund flow handle a tender type your own site never offers? Does your settlement import carry enough reference data to tie a wallet or network token back to the order? Can you segment authorization rate and dispute rate by originating channel, which means having the channel tag on the order, the payment and the dispute record?

The geo example is a warning for hard-coded fraud rules: agents run wherever their provider’s compute runs, so IP-to-billing mismatch rules will misfire. Scope exceptions to verified agents rather than disabling rules, which brings us back to identity.

The Amex numbers line up with Shopify’s holiday post, which says only one-third of shoppers trust an agent to buy on their behalf. My guess: agent orders will skew toward replenishment and low-ticket baskets for the next year, which favors reorder flows that are already the most automated part of most back offices.

Also worth noting

• OpenAI launched Dots on September 29, always-on agents rolling out to Pro and Business Premium users, with an Enterprise beta (OpenAI). Another general agent that will reach your checkout through a browser.
• Crossmint launched an Agent Commerce Toolkit on October 8, a single API that combines card vaulting, Visa Intelligent Commerce and Mastercard Agent Pay credentials, and checkout that picks between Shop Pay, UCP, or browser automation per purchase (PR Newswire). Note the browser automation fallback: merchants may receive these orders without having opted into anything.
• Constructor launched Agentic Checkout with Stripe on October 5, letting shoppers pay inside Constructor’s onsite shopping agents (PR Newswire). Same orders, new entry point, another channel tag to define.
• On the legal side of the Muse block, GeekWire notes Amazon lost its Perplexity injunction at the Ninth Circuit on August 4 and was denied rehearing on September 10, leaving contract and terms-of-service claims open (GeekWire).

What I’m watching next

• PAP v0.1. Specifically whether “write access” comes with any vocabulary for order changes, cancellations and returns, or stays at the level of OAuth scopes.
• TikTok Buy Direct’s UCP profile. Which UCP version and capabilities it requires, how order status is expected to flow back, and how payouts are reported.
• An “agent-placed” order flag. Whether Shopify, UCP or the card networks expose a durable identifier on the order or transaction that survives into the ERP and the dispute record. Without it, the per-channel monitoring everyone recommends is guesswork.
• Holiday returns. If agent orders become meaningful volume this season, January is when we learn whether return flows, refunds to unfamiliar tenders and dispute evidence actually hold up.