Eric Kuvykin’s view is optimistic: AI can make small businesses more productive and make shopping easier. That opportunity is strongest when an owner can explain what the system is allowed to do and see what it actually did. A persuasive demonstration is a starting point for that discussion, not a complete operating plan.
Why agent identity matters
In an August 27, 2026 article, NIST’s Bill Fisher and Ryan Galluzzo described identity and authorization problems in agentic AI. They warned about shared credentials, long-lived access and permissions broader than the task requires. Their discussion points toward recognizable agent identities and more narrowly delegated authority, rather than treating the agent as an invisible extension of a user’s account.
For a merchant evaluating a service, translate that into a direct question: when an action appears in our records, can we identify the software that performed it and the permission behind it? Ask the vendor to demonstrate the answer with a sample transaction.
Recognition and payment are separate questions
Visa’s Trusted Agent Protocol describes signed messages that help merchants recognize approved agents and validate information about their interactions. Its developer guidance explains that merchants verify a signature using the relevant public key and request attributes. This is a technical recognition mechanism, not a reason for a shop owner to accept every automated request.
Ask your commerce provider what it supports today, which payment methods and regions are covered, and what your store must configure. A network announcement does not establish that a particular shopping cart, fraud service or acquiring relationship is ready for the same workflow.
Be precise about the word token
Visa Token Service describes replacing sensitive account information with a payment token. That payment concept should not be confused with every other token used in software. An access credential used to call an application is not automatically a payment credential, and neither term explains the customer’s entire purchasing instruction.
Have the vendor draw the sequence in plain language: the customer gives an instruction, the agent prepares a basket, the system checks permission, the payment is processed and the merchant receives an order. At each step, ask what is recorded and which party handles an exception.
Use a realistic small-store example
Consider a hypothetical office-supply retailer. A customer asks an assistant to reorder printer paper within a spending limit. The system finds that the usual carton is unavailable. Should it choose another brand, split the order or stop? What if shipping brings the total above the limit?
These are useful acceptance-test cases because they expose the difference between completing a checkout and completing the customer’s request. Include an out-of-stock product, a changed price, a duplicate request and a cancellation. Use a test environment or the provider’s supported test workflow before involving real orders.
Keep the service desk in the design
A customer with a wrong delivery will still contact the merchant. Staff need a readable order record and a clear route to the relevant platform. Ask which records are available when an agent misunderstood an instruction or a customer disputes a purchase. Discuss refund and dispute handling with your provider; do not assume agent recognition eliminates either responsibility.
Test the stop control too. The person responsible for the shop should know how to disable the integration, who to contact and what happens to orders already in progress. That is an operating requirement, not a prediction that every automation will fail.
Judge the pilot by useful outcomes
Measure completed orders, incorrect substitutions, duplicate orders, support contacts and staff time. Review examples behind the numbers. Faster checkout is valuable when it also produces an order the customer meant to place.
The AMS position is to pursue the benefit with clear permissions and a narrow initial scope. A well-run pilot gives a small merchant evidence for expanding AI use. It also makes a vendor’s promises easier to evaluate before committing the business to a larger deployment.
Continue with AMS coverage of AI for small businesses, payment processing and Eric Kuvykin’s business and technology commentary.
Primary sources
- NIST: why agentic AI needs a strong identity foundation
- Visa: Trusted Agent Protocol developer guidance
- Visa Token Service overview
About the Author: Eric Kuvykin is an entrepreneur, business consultant, and technology strategist with experience spanning financial technology, merchant services, automation systems, operational consulting, and business development.
Eric Kuvykin
Publisher and editorial director covering payments, fintech, merchant services, banking, AI, technology and operating strategy for small and medium-sized businesses.
