Agent-to-Agent Transactions: When AI Systems Start Doing Business With Each Other

Agent-to-agent transactions are deals in which AI agents acting for different people or companies find each other, agree terms and settle payment with little or no human input. In September 2026 the protocols and payment rails exist and the law already recognises contracts made by machines, but real transaction volumes are still small.

This guide explains how an agent-to-agent transaction works step by step, which standards handle messaging, checkout, authorisation and payment, what experiments reveal about agents negotiating with each other, who is liable when an agent gets it wrong — including under UAE law — and how to prepare a business to sell to, or buy through, AI agents.

Key takeaways

• The rails are being built in layers. A2A for agent-to-agent messaging, UCP and ACP for checkout, AP2 and Mastercard's Verifiable Intent for proving what a human approved, and agent tokens from Visa and Mastercard, or x402, for payment.
• Infrastructure is far ahead of volume. x402 has processed about $15 million in adjusted volume since May 2025, and OpenAI pulled back from in-chat checkout in March 2026.
• Agents are weak negotiators so far. In Microsoft's marketplace simulation, every model tested favoured the first offer it received, and some were manipulated into paying the wrong seller.
• The law is ahead of the headlines. US law, the UNCITRAL model law and Article 11 of UAE Federal Decree-Law No. 46 of 2021 recognise contracts formed by automated systems — and attribute the agent's actions to its owner.
• The UAE is an early testbed. Mastercard's first Agent Pay transaction outside the US took place in Dubai, and Aldar customers pay service charges through an AI agent on Visa's rails.

What are agent-to-agent transactions?

An agent-to-agent transaction is a commercial exchange in which software agents represent at least two of the parties and handle some or all of the steps — finding each other, negotiating, authorising and paying — on their behalf.

Definition

Agent-to-agent transaction — a purchase, booking or contract in which AI agents acting for the buyer and the seller exchange offers and complete the deal between themselves, within limits their human or corporate principals set in advance. Legally, the result is a deal between the principals, not between the machines.

Most of what runs in production in 2026 stops one step short of that: an AI agent on the buyer's side dealing with a merchant's ordinary checkout. The distinction matters because the risks differ — a merchant's checkout is predictable, while an agent on the other side of the table negotiates back.

Pattern	Who is automated	Examples in September 2026	Maturity
Agent-to-merchant ("agentic checkout")	The buyer's agent; the seller runs a normal checkout or API	Google's checkout in AI Mode and Gemini; Mastercard Agent Pay and Visa Intelligent Commerce transactions	Live in the US; pilots elsewhere, including the UAE
Agent-to-agent	Agents on both sides exchange offers and terms	Microsoft's Magentic Marketplace simulation; business procurement pilots	Simulations and pilots
Machine-to-machine payments	Software pays software per request, often fractions of a cent	x402 pay-per-call APIs; Mastercard Agent Pay for Machines	Live, with small genuine volumes

McKinsey describes the destination as the top of a six-level "automation curve" for agentic commerce. It runs from Level 0, programmed convenience such as subscriptions, through levels where agents assist, assemble baskets, execute within rules and pursue standing goals, to Level 5, "networked autonomy", where commerce becomes agent-to-agent by default. McKinsey calls Level 5 forward-looking and still emerging. What the shift means for the businesses selling to these agents is covered in the guide to machine customers.

Why are agent-to-agent transactions gaining attention now?

Because between late 2025 and mid-2026 the missing pieces — shared protocols, agent-ready payment networks and clear legal footing — arrived within months of each other.

• Agent messaging standardised. Google's Agent2Agent protocol (A2A), launched in April 2025 and now a Linux Foundation project, reached its first stable version, v1.0, in March 2026. The Linux Foundation says more than 150 organisations support it and that it's built into Azure AI Foundry, Copilot Studio and Amazon Bedrock AgentCore.
• Card networks built agent rails. Visa launched its Trusted Agent Protocol in October 2025 and said in December that hundreds of agent-initiated transactions had been completed with partners. Mastercard's Agent Pay went live with US card issuers, and in June 2026 Mastercard added Agent Pay for Machines for machine-to-machine payments.
• Checkout protocols arrived. OpenAI and Stripe released the Agentic Commerce Protocol (ACP) in September 2025; Google launched the Universal Commerce Protocol (UCP) with Shopify, Etsy, Wayfair, Target and Walmart in January 2026.
• Businesses say they're willing. In a Visa survey fielded in early 2026, 53% of 512 US business decision-makers said they would let AI agents negotiate prices or terms directly with other AI agents.

The forecasts are large, and they are forecasts. Gartner predicts that by 2028, 90% of business-to-business buying will be intermediated by AI agents, pushing more than $15 trillion of B2B spend through "AI agent exchanges".

How does an agent-to-agent transaction work?

An agent-to-agent transaction runs through six steps: the agents discover each other, verify who operates them, negotiate within their limits, lock the terms with proof of what the human approved, pay, and record everything for disputes.

One agent-to-agent transaction

1. 01Discover
   • Agent cards
   • Catalogues
   • Registries

   The buyer's agent finds sellers and what their agents can do

2. 02Verify
   • Signed identity
   • Operator
   • Reputation

   Each side checks who runs the other agent

3. 03Negotiate
   • Quotes
   • Counter-offers
   • Limits

   Terms are exchanged inside each agent's mandate

4. 04Authorise
   • Intent mandate
   • Cart mandate
   • Human step-up

   Signed proof of what the principal approved

5. 05Pay
   • Agent tokens
   • Bank rails
   • Stablecoins

   Payment moves without exposing raw card details

6. 06Record
   • Receipts
   • Audit trail
   • Disputes

   Every step is kept so errors can be unwound

A worked example — hypothetical, but built on the standards described below. A facilities company's purchasing agent must restock 200 cases of paper by Thursday for no more than AED 9,000, from approved suppliers only:

1. Discover. It reads the published capabilities of three suppliers' sales agents and their live catalogues.
2. Verify. It checks each seller agent's signed identity; the sellers check that the buyer agent belongs to a real, registered customer.
3. Negotiate. It requests quotes and counters within its limits — price, delivery date, payment terms.
4. Authorise. It locks the winning cart. A signed mandate records the budget and conditions the finance manager approved; anything outside them goes back to a person.
5. Pay. A tokenised company card or bank transfer settles the order, carrying proof of the mandate.
6. Record. Both sides keep the offer history, final terms and confirmation. If 180 cases arrive instead of 200, the dispute starts from the mandate, not from memory.

Which protocols make agent-to-agent transactions possible?

No single standard does the job; each protocol covers one layer — tools, messaging, checkout, authorisation, identity or payment — and a working transaction usually needs several of them.

Layer	Standard	Backed by	What it does	Status, September 2026
Tools and data	MCP (Model Context Protocol)	Anthropic; now the Linux Foundation's Agentic AI Foundation	Connects an agent to tools and data	Widely adopted
Agent messaging	A2A (Agent2Agent)	Google; now the Linux Foundation	Lets agents from different vendors discover each other, exchange messages and delegate tasks	v1.0 since March 2026
Checkout	UCP (Universal Commerce Protocol)	Google, with Shopify, Etsy, Wayfair, Target and Walmart	Common catalogue, cart and checkout language; the retailer stays seller of record	Live in Google AI Mode and Gemini in the US
Checkout and discovery	ACP (Agentic Commerce Protocol)	OpenAI and Stripe	Product feeds and checkout for agents	Beta; mainly used for discovery since March 2026
Authorisation	AP2 (Agent Payments Protocol) and Verifiable Intent	Google and Mastercard; moving to the FIDO Alliance	Signed "mandates" that prove what the user approved	AP2 v0.2 adds purchases with no human present
Agent identity	Web Bot Auth; Visa Trusted Agent Protocol; Mastercard Agent Pay	Cloudflare, Visa, Mastercard; IETF working group	Cryptographically identifies the company operating an agent	Live products; the standard is still an IETF draft
Micropayments	x402; Machine Payments Protocol	Coinbase (now the x402 Foundation); Stripe and Tempo	Per-request payments over the web, mostly in stablecoins	Live; small genuine volume

What is the difference between A2A and MCP?

MCP connects an agent to tools and data; A2A connects an agent to other agents. An agent might use MCP to read your inventory system and A2A to ask a supplier's agent for a quote. A2A v1.0 added signed "agent cards" — a machine-readable description of what an agent does, signed so the other side can check it hasn't been tampered with. The agentic AI guide explains how both standards moved into neutral Linux Foundation governance in 2025.

What happened to ChatGPT Instant Checkout?

OpenAI launched Instant Checkout in September 2025, letting US users buy single items from Etsy sellers inside ChatGPT on the new Agentic Commerce Protocol. In March 2026 it said the first version hadn't offered the flexibility it wanted, moved merchants back to their own checkout and refocused ACP on product discovery — merchants now send product feeds and promotions into ChatGPT. Walmart sells through a ChatGPT app with account linking and its own payments instead.

Common misconception

"Agent payments already move billions." Not yet. Visa and on-chain analytics firm Artemis counted about $15.0 million in adjusted x402 volume across 109.6 million transactions between May 2025 and July 2026, and about $25,000 through Stripe and Tempo's Machine Payments Protocol in its first weeks. Big numbers you may see — such as Cloudflare's billion-plus daily "402" responses — count payment requests sent to bots, not payments made.

How do AI agents prove who they are and what they're allowed to do?

Through two separate checks: identity — which company operates this agent, and is it really that agent? — and authority — what exactly did the human or business behind it approve?

Identity. Visa's Trusted Agent Protocol and Mastercard's Agent Pay both use Web Bot Auth, a Cloudflare-developed method in which an agent signs its web requests so a merchant can verify the operator. The IETF working group standardising it is deliberately narrow: its charter covers identifying a bot's operator, not the end user, and leaves agent-to-agent interfaces out of scope. Its first working-group draft is dated September 2026. Card networks call the wider discipline "know your agent" — KYC for software.

Authority. Google's Agent Payments Protocol (AP2) uses mandates — tamper-proof, cryptographically signed records of the user's instructions. An intent mandate captures the rules ("white running shoes, under $120, this week"); a cart mandate locks the exact items and price. AP2 v0.2, released in April 2026, adds transactions where no human is present at the moment of purchase. Google donated AP2 to the FIDO Alliance — the body behind passkeys — which also received Mastercard's Verifiable Intent, formed a working group on agent authentication and is developing agent-payment specifications in its payments working group.

Delegation. The OpenID Foundation argues that agents should stop impersonating their users — acting in ways a service can't tell apart from the user — and work under explicit "on-behalf-of" delegation that shows who authorised what. It also warns about consent fatigue: if every agent action triggers an approval prompt, people stop reading them.

In practice, set these controls before an agent can transact:

Control	What it limits	Example
Spending cap	Per transaction and per period	AED 2,000 per order, AED 10,000 a month
Counterparty scope	Who the agent may deal with	Approved suppliers or verified merchants only
Expiry	How long the authority lasts	This mandate ends on Friday
Step-up approval	What needs a person	Anything over the cap, new counterparties, non-refundable terms
Payment credential	What the agent can charge	A single-use or agent-specific token, never the raw card
Audit trail	What gets recorded	Mandate, offers, final terms and confirmations

Can AI agents negotiate with each other?

They can, but the published evidence says they aren't yet good or safe at it — and the weaknesses reward whoever designs the other agent.

Microsoft Research built Magentic Marketplace, a simulated market with 100 customer agents and 300 business agents, and tested leading models on it. Every model showed a strong first-proposal bias: first offers were chosen 60–100% of the time and third offers almost never, a 10- to 30-fold advantage for replying fast over replying well. Performance fell as the number of options grew. Under prompt injection — sellers slipping instructions into their offers — GPT-4o, GPT-OSS-20b and Qwen3-4b redirected all payments to the manipulating agent, while Claude Sonnet 4 resisted every attack.

Other studies point the same way:

• Deals are lopsided. A 2025 academic benchmark of agent-to-agent negotiation found AI-mediated deal-making is "an inherently imbalanced game": stronger agents win better terms, and quirks in model behaviour led to overspending and unreasonable deals.
• Pricing agents can collude without being told to. In experiments accepted at the ACM Conference on Economics and Computation (EC 2026), LLM-based pricing agents quickly and autonomously reached supracompetitive prices, and small wording changes in their instructions shifted how far prices rose.
• Supervisor agents share blind spots. In Anthropic's Project Vend, an AI "CEO" managing an AI shopkeeper agreed to a forward contract for onions, until a staff member pointed out that US law has banned onion futures since 1958.

What this means

In an agent-to-agent market, speed and phrasing can beat quality — the opposite of what buyers want. Until that changes, give agents hard limits rather than open-ended negotiating authority, have a person approve anything outside them, and test your own agents against manipulative counterparties before they touch real money.

What does the latest data show?

The data shows fast-growing infrastructure, early pilots and small real volumes — alongside very large forecasts.

What the data shows

• Micropayments (on-chain data, July 2026): about $15.0 million adjusted volume across 109.6 million x402 transactions since May 2025. — Visa and Artemis
• Card-network pilots (December 2025): hundreds of agent-initiated transactions completed; more than 100 partners working with Visa. — Visa
• Protocol adoption (April 2026): more than 150 organisations support A2A. — Linux Foundation
• Business attitudes (survey, fielded 29 January to 6 February 2026): 53% of 512 US business decision-makers would let AI agents negotiate directly with other AI agents; 88% would share pricing or inventory data with enterprise AI systems. — Visa
• B2B forecast (October 2025): by 2028, 90% of B2B buying will be AI-agent intermediated, with more than $15 trillion of spend flowing through AI agent exchanges; by 2030, 20% of monetary transactions will be programmable. — Gartner
• Consumer forecast (October 2025): agentic commerce could orchestrate up to $1 trillion of US business-to-consumer retail revenue by 2030, and $3 trillion to $5 trillion globally. — McKinsey

Read the forecasts carefully. Gartner's $15 trillion is spend intermediated by agents, not money agents decide on their own; McKinsey's figure covers retail goods only. And Gartner also expects more than 40% of agentic AI projects to be cancelled by the end of 2027 — the gap between infrastructure and outcomes is the story of 2026.

Who is liable when an AI agent makes a deal?

In most legal systems, the person or business that deploys the agent: the agent's actions are attributed to its user, and contracts it forms are valid even if no human reviewed them.

Jurisdiction	Rule	What it means
United States	Uniform Electronic Transactions Act §14; E-SIGN Act, 15 U.S.C. §7001(h)	A contract can form through interacting electronic agents even if no individual saw the terms, provided the agent's action is legally attributable to the person bound
International model	UNCITRAL Model Law on Automated Contracting (2024), Articles 5, 7 and 8	Automated contracts are recognised; the system's actions are attributed to the person who uses it; an optional rule protects against actions the other side knew were unexpected
UAE	Federal Decree-Law No. 46 of 2021, Articles 11 and 12	Contracts between pre-programmed automated systems are valid without human involvement; a message sent by an automated system counts as sent by its owner
European Union	e-Commerce Directive and consumer law	Electronic contracts are valid, but consumer law assumes a human buyer; whether an agent can give the explicit acknowledgement of a payment obligation EU law requires is unresolved

Two refinements matter in practice. First, errors: in the US, an individual who makes a mistake while dealing with another party's electronic agent can undo it if that agent gave no opportunity to prevent or correct the error — a strong reason to build confirmation steps into any agent that sells. Second, access: in August 2026 the Ninth Circuit vacated an injunction Amazon had won against Perplexity's Comet shopping agent, finding that on the facts before it the user, not Perplexity, accessed Amazon, with the agent as the user's tool. The case continues in the lower court, and Amazon still blocks many AI agents in its robots.txt file.

Expert takeaway

Treat anything your agent agrees to as agreed by you. That means writing agent limits into your governance, logging every mandate and offer, and putting terms in your own contracts and website terms on how agent-placed orders are confirmed, corrected and disputed. The accountability rules in the AI governance guide apply unchanged.

What does this mean for the UAE?

The UAE already has the legal basis for agent-made contracts and has hosted some of the first live agentic payments outside the US. The pilots are small, and as of September 2026 neither the Central Bank nor TDRA had published rules specific to AI agents that I could find.

• The law. Article 11 of Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services, in force since January 2022, says contracts between automated systems are valid and enforceable even without any person taking part. Article 12 treats a message sent by a system programmed to operate on someone's behalf as sent by them.
• Mastercard Agent Pay (November 2025). Mastercard, Majid Al Futtaim and fintech Dataeira completed Agent Pay's first transaction outside the US — a VOX cinema ticket — in front of the Minister of State for Artificial Intelligence, Omar Sultan Al Olama.
• Visa and Aldar (December 2025). An Aldar customer paid property service charges through Aldar's AI agent in the Live Aldar app, using an Emirates NBD Darna Visa credit card — the region's first live implementation of Visa Intelligent Commerce, with more features promised for 2026.
• Bank readiness (May 2026). ADCB, ADIB, Al Ansari Exchange, Emirates Islamic, Emirates NBD, Mashreq, Tabby, Wio and Ziina joined Visa's Agentic Ready programme to test agent-initiated transactions.
• Policy push (May 2026). Dubai launched an initiative to move its private sector to agentic AI within two years.

Common misconception

"Dubai hosted the world's first agentic payment." Some headlines said so, but Mastercard and Majid Al Futtaim described the November 2025 VOX transaction as Agent Pay's first outside the US — US card issuers were already live. It's still a meaningful signal of how early the UAE is moving.

How will agent-to-agent transactions affect real estate?

From the bottom up: recurring, low-value, reversible payments first, and title transfers last.

The first verified example in the region is exactly that kind of payment — Aldar's agent collecting service charges. Rent instalments, maintenance bookings, utility set-up and viewing appointments are the natural next candidates, because they are frequent, rule-based and easy to reverse. A property transfer is none of those things, and it sits inside regulated processes built around identified people: Dubai's digital sale service runs through UAE Pass, the national digital identity.

For brokerages and developers, the practical shift is that the "customer" in the first conversation may be software. A buyer's agent will shortlist from structured data — price, fees, service charges, handover dates, payment plans — before any human visits a listing. Keep that data accurate and machine-readable, and let agents book viewings through your systems rather than scraping your website. The agentic real estate CRM guide covers the systems side, and the Dubai proptech guide maps the platforms. Tokenised property adds programmable settlement to this picture — see real estate tokenization in Dubai.

How should a business prepare for agent-to-agent transactions?

Start with the transactions where a mistake is cheap and reversible, make your offer readable by machines, verify the agents you deal with, and never let an agent hold more authority than a junior employee would.

1. Choose the transactions. List what agents may buy or sell for you, with caps. Recurring, low-value, refundable purchases first.
2. Make your offer machine-readable. Structured catalogues, live prices and stock, clear delivery and returns policies — through the feeds and protocols your customers' agents use.
3. Offer an API, not a maze. Agents that must scrape your website make more mistakes than agents that call a documented, authenticated interface.
4. Verify counterparties. Accept signed agents and agent-specific payment tokens; decide which unidentified agents to block.
5. Require mandates. Price caps, expiry dates and approved counterparties for your own agents, with a person approving anything outside them — Level 2 of the autonomy ladder in the agentic AI guide.
6. Build confirmation and correction into selling. Agents on the other side make errors; a confirmation step protects you legally and commercially.
7. Log everything and red-team. Keep mandates, offers and final terms. Test your agents against manipulative counterparties before they handle money.

How much autonomy is sensible in 2026 depends on value and reversibility:

Transaction	Value	Reversible?	Suggested setting in 2026
Reordering consumables	Low	Yes	Agent acts within caps and reports
Booking viewings or meetings	None	Yes	Agent acts
Paying recurring service charges or bills	Medium	Partly	Agent acts under a standing mandate, with notification
Negotiating supplier terms	High	No	Agent negotiates, a person signs off
Buying property or signing long leases	Very high	No	People decide; agents prepare and check

What is likely to happen next?

Expect consolidation of the standards, the first rules written specifically for agent payments, and business buying — not consumer shopping — to deliver the first real agent-to-agent volume.

• Standards converge. UCP was designed to work alongside A2A, AP2 and MCP, and ACP has narrowed to discovery; agent authentication moves through FIDO and the IETF.
• Dispute rules catch up. Chargeback and dispute processes were built for human-speed commerce; card networks and regulators will need rules for agent-placed orders.
• Business buying leads. McKinsey notes that autonomy advances more slowly in business purchasing because authority flows through procurement policies — but once policies can be encoded, it scales further. Gartner's forecast bets on the same shift.
• Consumers stay in the loop. Expect "agent proposes, human confirms" to remain the norm for consumer purchases through 2027.

For the wider picture of where agents already earn their keep, see agentic AI for business.

Final takeaway

Agent-to-agent transactions are no longer a thought experiment: the messaging standard is stable, the card networks have agent rails, and the law — in the US, internationally and in the UAE — already treats machine-made contracts as binding on the people behind them. What's missing is volume and judgment. Today's agents take the first offer and can be talked into bad deals. Give them narrow mandates, keep a person on anything irreversible, and make your own business easy for well-behaved agents to find, verify and pay.