\n| Internal ops \/ SaaS dashboards<\/td>\n | Backend MCP<\/td>\n | No consumer browser context; server-side access preferred<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Security Architecture: Zero Trust for Agent Interactions<\/b>
\nAgent-initiated transactions introduce a new threat model. Unlike a human user who can be challenged with CAPTCHA or step-up authentication, an AI agent operates programmatically and at scale. Standard session security is necessary but not sufficient.
\nZero Trust Security Model<\/strong><\/em>
\nZero Trust principles should be applied to every agent interaction: always assume untrusted, verify explicitly, enforce least-privilege, log everything.
\nAgent Invokes Tool
\n\u2502
\n\u25bc
\n[1] Token Validation \u2190 Is the agent token valid and unexpired?
\n\u2502
\n\u25bc
\n[2] Scope Enforcement \u2190 Does the token scope permit this tool?
\n\u2502
\n\u25bc
\n[3] RBAC Check \u2190 Is the user’s role permitted for this action?
\n\u2502
\n\u25bc
\n[4] ABAC Policy Evaluation \u2190 Do contextual attributes allow execution?
\n\u2502 (order value, device risk, geo, velocity)
\n\u25bc
\n[5] Rate Limit Check \u2190 Has this agent\/session exceeded thresholds?
\n\u2502
\n\u25bc
\n[6] Input Validation \u2190 Are parameters schema-valid and within bounds?
\n\u2502
\n\u25bc
\n[7] Execute Tool \u2190 Call downstream API with sanitized params
\n\u2502
\n\u25bc
\n[8] Audit Log Entry \u2190 Record invocation, outcome, agent identity<\/p>\nAuthentication Model for Agents<\/b>
\nShort-lived, scoped tokens specifically for agent interactions should be issues, distinct from the customer’s primary session token. Never allow agent tool invocations to inherit full session permissions.
\nOAuth 2.0 scopes by tool category:<\/strong><\/p>\nAuthorization: RBAC and ABAC<\/p>\n RBAC (Role-Based Access Control) for coarse-grained access:
\n– Guest agent: `commerce:read` only
\n– Authenticated user agent: read + cart write
\n– Business account agent: read + cart write + quote request
\n– Admin\/operator: all scopes (never in consumer-facing WebMCP tools)<\/p>\n ABAC (Attribute-Based Access Control) for context-sensitive decisions:
\n– Order value > \u20b950,000: require step-up consent regardless of role
\n– New device or unrecognized location: limit checkout scope to cart-only
\n– Agent velocity > 10 tool calls \/ 60 seconds: trigger fraud signal<\/p>\n Authorization checks execute at the API Gateway, not inside WebMCP tools.<\/p>\n Fraud Prevention for Automated Checkout<\/strong>
\nAI-driven checkout at scale is an attractive fraud target. Required controls:
\n– Velocity limits: Maximum cart creation rate, checkout attempts, and successful orders per identity per time window should be enforced
\n– Device fingerprinting: Session-level device signals correlated with agent identity
\n– Anomaly detection: Statistical models on agent transaction patterns (unusually high order values, bulk quantity, unusual shipping destinations)
\n– Payment tokenization: WebMCP tools never handle raw card data. Use tokenized payment references (Stripe, Visa Token Service, Mastercard MDES). The payment tool call passes a token, not credentials.
\n– 3DS \/ SCA compliance: For high-value transactions, Strong Customer Authentication should be enforced regardless of whether the initiator is human or agent.<\/p>\nConsent and Audit Logging<\/strong>
\nEvery agent-invoked tool call that changes state must produce an immutable audit log entry:
\n
\n{
\n\"timestamp\": \"2026-06-22T10:34:55Z\",
\n\"correlation_id\": \"ag-7f3a2b91-...\",
\n\"tool_name\": \"initiateCheckout\",
\n\"agent_identity\": \"gemini-browser-assistant\",
\n\"user_id\": \"usr_0039124\",
\n\"session_id\": \"sess_abc123\",
\n\"parameters\": { \"cart_id\": \"cart_xyz\", \"shipping_tier\": \"standard\" },
\n\"outcome\": \"success\",
\n\"order_id\": \"ord_8821\",
\n\"duration_ms\": 312
\n}
\n<\/code>
\nPII fields (addresses, payment references) must be tokenized or excluded from logs. Logs are compliance artifacts should be retained per applicable regulations (PCI-DSS, GDPR, DPDPA)<\/p>\nCanonical Data Strategy and Schema Governance<\/strong>
\nWebMCP tools are only as reliable as the data they surface. In enterprise commerce, product data flows through PIM, ERP, catalog services, and search indexes, the inconsistencies between systems produce unreliable agent interactions.<\/p>\nCanonical Product Model<\/strong>
\n<\/em><\/p>\nSingle canonical representation of a product should be defined before exposing. PIM is the system of record for product attributes. OMS is the system of record for inventory. Pricing services are the real-time source for transactional pricing. Tool contracts must pull from these systems of record never from stale search index caches for transactional operations.<\/p>\n Enterprise Schema Registry<\/strong><\/p>\nAll tool contracts must be registered in a central schema registry before exposure to agents. The registry provides:<\/p>\n – Single source of truth for tool names, descriptions, parameter schemas, and output schemas
\n– Version history for every tool contract
\n– Compatibility checks \u2014 automatic validation that new versions do not break existing agent implementations
\n– Ownership metadata \u2014 team, product owner, SLA, and support contact for each tool<\/p>\n Recommended tooling will be Confluent Schema Registry (Kafka-native), Azure API Center, or a dedicated API contract management layer in Kong or Apigee.<\/p>\n Contract Versioning Strategy<\/strong><\/p>\nTool contracts must follow a defined versioning lifecycle: Draft \u2192 Review \u2192 Approved \u2192 Active \u2192 Deprecated \u2192 Retired
\nVersion naming: searchProducts_v1, searchProducts_v2
\nDeprecation notice: minimum 90 days
\nParallel support: old + new versions run simultaneously during transition
\nAgent-side behavior: graceful degradation when tool version is unrecognized<\/p>\n Ensure on the breaking and non-breaking changes<\/p>\n – Non-breaking: adding optional parameters, adding output fields \u2014 no version bump required
\n– Breaking: renaming a required parameter, changing output schema, removing a tool, mandatory major version bump with deprecation notice<\/p>\n Observability and SRE Framework<\/strong><\/p>\nAgent-initiated interactions introduce failure modes invisible to standard page-level monitoring. A tool invocation may succeed at the browser layer while silently failing at the API gateway, a microservice, or a backend system. Without distributed observability, these failures manifest as unexplained checkout drop-off with no attribution. Ensure Distributed Tracing Architecture, where every WebMCP tool invocation generates a correlation ID that propagates through the full call chain:<\/p>\n WebMCP Tool Invocation
\n\u2502 correlation_id: ag-7f3a2b91
\n\u2502
\n\u251c\u2500\u2500 API Gateway (auth, routing) \u2190 span: gateway.auth (12ms)
\n\u2502
\n\u251c\u2500\u2500 Catalog Service (searchProducts) \u2190 span: catalog.search (45ms)
\n\u2502 \u2502
\n\u2502 \u2514\u2500\u2500 PIM Query \u2190 span: pim.query (38ms)
\n\u2502
\n\u251c\u2500\u2500 Inventory Service (checkAvail) \u2190 span: inventory.check (22ms)
\n\u2502 \u2502
\n\u2502 \u2514\u2500\u2500 OMS Stock Query \u2190 span: oms.stock (18ms)
\n\u2502
\n\u2514\u2500\u2500 Cart Service (addToCart) \u2190 span: cart.write (31ms)
\n\u2502
\n\u2514\u2500\u2500 Event Published to Kafka \u2190 span: kafka.publish (8ms)<\/p>\n Total agent flow latency: 118ms<\/p>\n Use OpenTelemetry as the tracing standard. All services emit spans to a central collector (Jaeger, Zipkin, Datadog APM, or Azure Monitor).<\/p>\n Agent tool performance SLOs must be defined separately from page load metrics. A human tolerates a 2-second page load; an agent chaining 5 tool calls at 2 seconds each produces a 10-second workflow which is unacceptable. a Query able log of complete agent sessions should be maintained not just individual tool calls, but the full sequence, declared intent (where available), and final outcome. This log serves three purposes: product improvement (identify where agents drop off), fraud investigation (reconstruct suspicious sessions), and compliance (demonstrate consent and audit trail for regulated transactions).<\/p>\n The Commerce Opportunity by Segment<\/strong>
\nWebMCP is not uniformly valuable across all commerce contexts. Prioritize investment where agentic interactions are most likely and where errors directly impact revenue, conversion, or customer experience. for ex: Agents searching a catalog of 500,000+ SKUs through DOM parsing produce consistently poor results viz. wrong variants, inaccurate availability, broken filters. A `searchProducts` tool with structured filtering parameters (category, price range, attributes, in-stock flag) transforms this into a reliable, high-precision interaction. First-mover advantage compounds quickly as agents learn to prefer structured tools over scraping. In B2B, The RFQ use case justifies enterprise investment. A buyer’s AI agent invoking `requestQuote(productId, quantity, deliveryDate, currency)` across 10 vendor sites simultaneously replaces what today requires hours of manual navigation. Suppliers that expose structured quote tools will disproportionately capture agent-driven procurement. B2B also has the highest tolerance for implementation complexity and the strongest ROI case.<\/p>\n\n\n\n| Segment<\/th>\n | WebMCP Priority<\/th>\n | Primary Use Cases<\/th>\n | Why Now<\/th>\n<\/tr>\n<\/thead>\n | \n\nMass-market retail \/ high-SKU<\/strong><\/td>\n| \ud83d\udd34 Highest<\/td>\n | Product search, variant selection, availability, checkout<\/td>\n | High query volume; agents already shopping; catalog complexity benefits most from structured tools<\/td>\n<\/tr>\n | \nTravel & hospitality<\/strong><\/td>\n| \ud83d\udd34 Highest<\/td>\n | Search, date\/filter, booking, availability<\/td>\n | Google’s UCP integration already in motion<\/td>\n<\/tr>\n | \nB2B \/ industrial commerce<\/strong><\/td>\n| \ud83d\udd34 High<\/td>\n | RFQ automation, bulk pricing, procurement checkout<\/td>\n | Multi-vendor agent workflows deliver outsized efficiency gains<\/td>\n<\/tr>\n | \nMarketplace platforms<\/strong><\/td>\n| \ud83d\udfe1 High<\/td>\n | Seller-side tools, cross-catalog search, offer comparison<\/td>\n | Agent discovery across sellers; structured data critical<\/td>\n<\/tr>\n | \nLuxury \/ low-SKU<\/strong><\/td>\n| \ud83d\udfe1 Medium<\/td>\n | Discovery, waitlist, appointment booking<\/td>\n | Lower volume; brand control concerns; agent curation may dilute brand experience<\/td>\n<\/tr>\n | \nServices \/ SaaS<\/strong><\/td>\n| \ud83d\udfe1 Medium<\/td>\n | Lead form, trial signup, support deflection<\/td>\n | Declarative API on forms; quick win without complex catalog work<\/td>\n<\/tr>\n | \nSubscriptions<\/strong><\/td>\n| \ud83d\udfe0 Medium<\/td>\n | Plan comparison, upgrade\/downgrade flows<\/td>\n | Session-aware tools leverage account context effectively<\/td>\n<\/tr>\n | \nFMCG \/ CPG (D2C)<\/strong><\/td>\n| \ud83d\udfe0 Lower<\/td>\n | Reorder, subscription management<\/td>\n | Repeat purchase use case is strong; lower discovery complexity<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n KPI Framework and Business Value Map<\/strong>
\nTraditional commerce KPIs i.e. sessions, bounce rate, CPC, pages per session, do not capture agentic funnel performance. A new measurement model is required.<\/p>\nAgent Discovery Metrics<\/strong><\/p>\n\n\n\n| KPI<\/th>\n | Definition<\/th>\n | Target (Year 1)<\/th>\n<\/tr>\n<\/thead>\n | \n\nAgent Found Rate<\/strong><\/td>\n| % of relevant high-intent queries where your products appear in AI results<\/td>\n | Establish baseline; target 20%+ improvement<\/td>\n<\/tr>\n | \nTool Discovery Rate<\/strong><\/td>\n| % of agent sessions where tool contract is successfully discovered<\/td>\n | > 95% for WebMCP-enabled pages<\/td>\n<\/tr>\n | \nAI Crawler Accessibility<\/strong><\/td>\n| % of product catalog pages accessible to AI crawlers<\/td>\n | 100%<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Agent Engagement Metrics<\/strong><\/p>\n\n\n\n| KPI<\/th>\n | Definition<\/th>\n | Target<\/th>\n<\/tr>\n<\/thead>\n | \n\nTool Invocation Rate<\/strong><\/td>\n| Agent sessions that invoke at least one tool<\/td>\n | Baseline + track trend<\/td>\n<\/tr>\n | \nTool Success Rate<\/strong><\/td>\n| Tool invocations that return a successful result<\/td>\n | > 99%<\/td>\n<\/tr>\n | \nTool Latency (p95)<\/strong><\/td>\n| 95th percentile tool response time<\/td>\n | Per SLOs in Section 6.4<\/td>\n<\/tr>\n | \nMulti-Tool Session Rate<\/strong><\/td>\n| Sessions invoking 3+ tools (signal of deep engagement)<\/td>\n | Baseline + grow<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Agent Conversion Metrics<\/strong><\/p>\n\n\n\n| KPI<\/th>\n | Definition<\/th>\n | Target<\/th>\n<\/tr>\n<\/thead>\n | \n\nAgent Add-to-Cart Rate<\/strong><\/td>\n| Agent sessions resulting in cart addition<\/td>\n | Benchmark against human rate<\/td>\n<\/tr>\n | \nAgent Checkout Initiation Rate<\/strong><\/td>\n| Agent sessions reaching checkout initiation<\/td>\n | Track weekly<\/td>\n<\/tr>\n | \nAgent Checkout Completion Rate<\/strong><\/td>\n| Initiated checkouts that complete<\/td>\n | > 80% (post-WebMCP)<\/td>\n<\/tr>\n | \nAgent-Attributed GMV<\/strong><\/td>\n| Revenue from transactions where agent was the initiating interaction<\/td>\n | Track as % of total GMV<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Reliability Metrics<\/strong><\/p>\n\n\n\n| KPI<\/th>\n | Definition<\/th>\n | Target<\/th>\n<\/tr>\n<\/thead>\n | \n\nTool Error Rate<\/strong><\/td>\n| Tool invocations resulting in error<\/td>\n | < 0.5%<\/td>\n<\/tr>\n | \nTool Availability<\/strong><\/td>\n| Uptime of each tool per SLO<\/td>\n | Per Section 6.4<\/td>\n<\/tr>\n | \nAgent Session Abandonment Rate<\/strong><\/td>\n| Agent sessions that terminate without tool invocation<\/td>\n | < 15%<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Analytics Implementation Requirements<\/strong>
\nAgent-originated traffic must be tagged distinctly from human-originated traffic at the session level. Every KPI in the agentic funnel connects directly to a financial or operational outcome. Below should be implemented:
\n– Agent identity headers: Log agent identity from WebMCP session context
\n– Correlation ID propagation: Link tool invocations to downstream order and revenue events
\n– Separate funnel reporting: Agent funnel (discovery \u2192 tool use \u2192 checkout \u2192 order) reported independently of the human funnel
\n– Attribution model: Define how agent-initiated, human-completed orders are counted (last-touch agent vs. shared attribution)<\/p>\nVendor and Ecosystem Strategy<\/strong><\/p>\nThe agentic commerce protocol landscape is fragmented, fast-moving, and commercially contested. Enterprise teams that make single-vendor or single-protocol bets risk significant stranded investment. This section defines a vendor strategy that preserves optionality while enabling decisive early action.<\/p>\n The Current Protocol Landscape<\/strong><\/p>\n\n\n\n| Protocol<\/th>\n | Sponsor<\/th>\n | Layer<\/th>\n | Status (June 2026)<\/th>\n | Commercial Model<\/th>\n<\/tr>\n<\/thead>\n | \n\nWebMCP<\/strong><\/td>\n| Google + Microsoft (W3C)<\/td>\n | Browser \/ on-site interaction<\/td>\n | Early preview (Chrome 146)<\/td>\n | Open standard; no licensing<\/td>\n<\/tr>\n | \nUCP<\/strong><\/td>\n| Google + 20+ retail partners<\/td>\n | Cross-platform commerce<\/td>\n | In development<\/td>\n | Open standard; merchant integration required<\/td>\n<\/tr>\n | \nACP<\/strong><\/td>\n| OpenAI + Stripe<\/td>\n | Agent-to-merchant checkout<\/td>\n | Live (Sept 2025)<\/td>\n | 4% transaction fee per ACP checkout<\/td>\n<\/tr>\n | \nMCP (server-side)<\/strong><\/td>\n| Anthropic<\/td>\n | Backend agent-to-tool<\/td>\n | Stable v1.0 (Apr 2026)<\/td>\n | Open standard<\/td>\n<\/tr>\n | \nNLWeb<\/strong><\/td>\n| Microsoft<\/td>\n | Natural language web interface<\/td>\n | Early preview<\/td>\n | Open-source<\/td>\n<\/tr>\n | \nA2A<\/strong><\/td>\n| Google<\/td>\n | Agent-to-agent orchestration<\/td>\n | Experimental<\/td>\n | Open standard<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Vendor Lock-in Risks<\/strong>
\nACP transaction fee dependency: OpenAI\/Stripe\u2019s ACP charges merchants a 4% fee (as per Shopify documentation) per completed Instant Checkout transaction, on top of standard payment processing. For a brand generating $12M in ACP-driven GMV, this equates to ~$480K annually in platform fees\u2014costs that scale linearly as agent commerce grows. Brands relying solely on ACP may become dependent on OpenAI\u2019s pricing model for agent-driven transactions.<\/p>\nGoogle ecosystem concentration: WebMCP and UCP are both Google-led standards. Chrome’s dominant browser position gives Google significant influence over how WebMCP evolves. Brands building on WebMCP-specific patterns must monitor the W3C spec evolution closely and architect for modular replacement of the tool layer if the API surface changes materially.<\/p>\n Agent platform exclusivity: Agent platforms are rapidly competing to own the transaction layer, including hosting checkout directly within their surfaces and defining how payments and customer relationships are handled. While explicit exclusivity incentives are not yet standardized, the structure of platform-native checkout creates potential dependency effects that should be evaluated through long-term cost modeling before committing at scale.<\/p>\n Platform Neutrality Strategy<\/strong><\/p>\nInvest in protocol-agnostic foundations: Clean structured data, well-documented commerce APIs, a stable canonical product model, and schema governance are assets that serve WebMCP, UCP, ACP, NLWeb, and protocols not yet announced. Prioritize these over protocol-specific optimizations.<\/p>\n Separate the interaction layer from the commerce layer: WebMCP tools are thin wrappers that call existing commerce APIs. If the WebMCP API changes, only the tool layer needs rework and not the backend commerce logic. Design for this separation explicitly from day one.<\/p>\n Evaluate protocols by cost structure, not features: Features converge across protocols; cost structures diverge. A per-transaction protocol (ACP) has fundamentally different long-term economics than an open standard (WebMCP).<\/p>\n Multiple AI agents will simultaneously interact with the commerce site. Gemini, ChatGPT, Claude, Perplexity, and enterprise AI clients have different behaviors and tool discovery patterns. The WebMCP implementation must be agent-agnostic.<\/p>\n – Consistent tool behavior regardless of agent identity. Write tool descriptions for clarity and precision. All modern models handle well-specified JSON Schema reliably. Do not optimize for one model’s natural language quirks.
\n– Rate limits per session, not per agent type. Apply limits equally. Per-agent preferential limits are operationally complex and commercially risky.
\n– Session state belongs to the user. A user who starts a session with one agent and continues with another should find a consistent cart and account state.
\n– Log agent-identity distribution in telemetry. Disproportionate failure rates for a specific agent may indicate a compatibility issue with that agent’s tool invocation pattern i.e. a signal to investigate, not ignore.<\/p>\n Conclusion <\/strong>
\nWebMCP represents the most significant structural shift in digital commerce infrastructure since mobile-responsive design. But it is also more complex than mobile was it touches architecture, security, data, operations, and organizational design simultaneously. The fundamental inversion is worth stating plainly: in traditional commerce, brands compete for consumer attention through design, advertising, and search ranking. In agentic commerce, brands compete for AI agent selection through data quality, protocol compliance, and catalog completeness.Content marketing, beautiful UX, and emotional brand-building do not disappear. But they no longer determine whether an AI agent can execute a transaction on the site. That is determined by structured data, clean APIs, well-governed tool contracts, and a security model that makes agent interactions trustworthy.<\/p>\n","protected":false},"excerpt":{"rendered":"The web was built for humans. But a new class of user is emerging […]<\/p>\n","protected":false},"author":967,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[324,4,771,772],"tags":[],"coauthors":[751],"class_list":["post-8564","post","type-post","status-publish","format-standard","hentry","category-digital-commerce","category-emerging-technologies","category-mcp","category-web-mcp"],"acf":[],"_links":{"self":[{"href":"https:\/\/blogs.infosys.com\/digital-experience\/wp-json\/wp\/v2\/posts\/8564","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.infosys.com\/digital-experience\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.infosys.com\/digital-experience\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.infosys.com\/digital-experience\/wp-json\/wp\/v2\/users\/967"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.infosys.com\/digital-experience\/wp-json\/wp\/v2\/comments?post=8564"}],"version-history":[{"count":10,"href":"https:\/\/blogs.infosys.com\/digital-experience\/wp-json\/wp\/v2\/posts\/8564\/revisions"}],"predecessor-version":[{"id":8584,"href":"https:\/\/blogs.infosys.com\/digital-experience\/wp-json\/wp\/v2\/posts\/8564\/revisions\/8584"}],"wp:attachment":[{"href":"https:\/\/blogs.infosys.com\/digital-experience\/wp-json\/wp\/v2\/media?parent=8564"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.infosys.com\/digital-experience\/wp-json\/wp\/v2\/categories?post=8564"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.infosys.com\/digital-experience\/wp-json\/wp\/v2\/tags?post=8564"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.infosys.com\/digital-experience\/wp-json\/wp\/v2\/coauthors?post=8564"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
![\"Web](\"https:\/\/blogs.infosys.com\/digital-experience\/wp-content\/uploads\/2026\/06\/Web_MCP.jpg\")
<\/p>\n![\"Web](\"https:\/\/blogs.infosys.com\/digital-experience\/wp-content\/uploads\/2026\/06\/WebMCP_arch.jpg\")
<\/p>\n