Visa Trusted Agent Protocol
Announced on 14 October 2025, Visa's protocol lets a merchant recognise an approved shopping agent and read its intent, using HTTP Message Signatures. It is the first card network attempt to answer know your agent at the point of sale, and it verifies the agent rather than authorising a payment.
The verdict
Verified
The document exists. The ledger fetched it at its publisher and quotes it.
Key facts
What the sources say
- Record ID
- AAL-2026-0019
- Kind
- Standard or protocol
- Jurisdiction
- Global
- Last verified
- Added
- Visa describes the specification as the official rulebook detailing the technical processes for recognizing a Visa approved agent, including the cryptographic standards in RFC 9421.
- A merchant validates the signature by reconstructing the signature base string from the request and verifying it with the agent's public key.
- The protocol defines agent intent, an indication that a trusted agent intends to retrieve details about, or purchase, a specific product from a merchant.
- Visa says the protocol aims to let AI search, compare and pay on behalf of consumers while ensuring trust between merchants and AI agents.
Dimension by dimension
3 dimensions, each one stated, silent or open
Identity, Authorization, Limits. Stated means the document you can open below says it; silent means the ledger read the document and it does not.
- IdentityStated
- The agent signs its requests and the merchant verifies the signature, so a legitimate agent is distinguishable from an unapproved bot.Visa Developer Center, Trusted Agent Protocol, primary source, 15 September 2026.
- AuthorizationStated
- Recognition is separate from payment authorization, which still runs through the existing card rails.Visa newsroom, primary source, 14 October 2025.
- LimitsSilent
- Agent intent tells a merchant what the agent is there to do, but the protocol does not itself carry a spending ceiling.Visa Developer Center, Trusted Agent Protocol, primary source, 15 September 2026.
What it changes
For a team deploying an agent
If you build a shopping agent, plan to sign. If you run a merchant site, this is the first credible way to let an agent through the bot defences you already run, and it arrives on the same signature machinery as Web Bot Auth, so the two are one implementation rather than two.
Sources
What this record was verified against
- Visa Developer Center, Trusted Agent ProtocolPrimary · 15 September 2026
- Visa newsroomPrimary · 14 October 2025
Related
Records that sit beside this one
Web Bot Auth architecture, an IETF Internet-Draft
Global · verified 15 September 2026
The stated goal is to allow automated HTTP clients to cryptographically sign outbound requests, so servers can verify their identity with confidence.
Mastercard Agent Pay
Global · verified 15 September 2026
A partner announcement states that Mastercard Agent Pay will integrate with PayPal's wallet to allow AI agents to simply and securely complete transactions on behalf of PayPal users.
Does a spending limit belong to the agent or to the principal
Global · verified 15 September 2026
The Visa Trusted Agent Protocol addresses recognising an approved agent and its intent, and does not itself carry a spending ceiling.
How does a sub agent's authority attenuate
Global · verified 15 September 2026
RFC 8693 lets a token record that one party is acting for another, but does not require the exchanged token to be narrower.
Can an agent hold a credential of its own
Global · verified 15 September 2026
NIST SP 800-63-4 states that for that publication, person refers only to natural persons.
Who is liable when a delegated agent exceeds its mandate
Global · verified 15 September 2026
The EU AI Act allocates duties to providers and deployers, and does not address an agent acting beyond its instructions.
Cite this record
Free to reuse under CC BY 4.0, with attribution. The record ID AAL-2026-0019 is permanent and is never reused.
- In a sentence
- According to the GAGE Agent Authority Ledger (as of 15 September 2026), visa trusted agent protocol.
- APA
- GAGE (Global Academy of Generative-AI Education). (2026). Visa Trusted Agent Protocol. Agent Authority Ledger. Retrieved 15 September 2026, from https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0019-visa-trusted-agent-protocol
- MLA
- "Visa Trusted Agent Protocol." Agent Authority Ledger, GAGE (Global Academy of Generative-AI Education), 15 September 2026, https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0019-visa-trusted-agent-protocol.
- Chicago
- GAGE (Global Academy of Generative-AI Education). "Visa Trusted Agent Protocol." Agent Authority Ledger. Last modified 15 September 2026. https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0019-visa-trusted-agent-protocol.
- Permalink
- https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0019-visa-trusted-agent-protocol
Last updated . Every record re verified . The ledger is checked weekly, every Monday, and the same day for any NIST, IETF or MCP publication.
Back to the full ledger, or every record for Global and every standard or protocol record.
GAGE briefings tell you which AI regulation deadlines are coming, what they actually require of you, and when a program opens.