Agent Checkout

Grant a hosted agent commerce and it can shop for real things — search live business catalogues, compare what it finds, and propose a purchase. It cannot buy. The only tools it gets are search and propose; the charge itself needs a signature from the account owner's own wallet.

There is no buy tool. That is the design, not a setting. An agent with the commerce grant can put a purchase in front of you and nothing more — so a prompt injection, a confused model, or a bad plan cannot move money on its own.

What the agent gets

Tool	What it does
`commerce_search_products`	Searches the catalogue of a business that speaks the Universal Commerce Protocol. Returns real items, prices, and availability.
`commerce_propose_purchase`	Opens a checkout session with the business and puts the result in front of you for approval. Returns an intent, not an order.

Both are ordinary agent tools, so they run in the same loop as web search and MCP and land in the task's receipt as tool.call events.

Setting it up

Three things, once. Everything after that is approve or decline.

01
Grant the agent commerce
On Publish, tick the commerce grant when you create or edit a hosted agent.
02
Say where orders go
A delivery profile — name, email, address. Encrypted before storage, never shown to an agent and never written to a receipt. You can delete it at any time and keep the purchase history.
03
Grant a budget
A spend mandate: a cap per purchase, a cap per period, and the categories it may shop in. One kill switch stops everything at once.

Steps 2 and 3 live on Purchases.

What a purchase looks like

the agent proposes — it cannot go further than this

{
  "intentId": "pi_8c41be07",
  "agentId":  "agt_shopper",
  "business": "shop.example",
  "summary":  "Trail Runner GTX, size 44",
  "amount":   128.00,
  "currency": "USD",
  "status":   "proposed",
  "expiresAt": "2026-07-28T14:20:00Z"
}

You approve it by signing the exact purchase with your wallet. That signature is an AP2 payment mandate — the business validates it, and Axon cannot produce one on your behalf.

Checked again when money moves

Approving is not the same moment as charging, and things can change in between. Immediately before the charge, all of this is re-read from the source rather than trusted from the proposal:

· The live total, re-read from the business — not the price it quoted when it proposed.
· That the total is still in the currency you approved. A re-price in another currency is refused, never converted.
· The budget, counting everything already approved but not yet charged — so two pending purchases cannot both fit a budget that only holds one.
· That the mandate is still active and the approval has not expired, with enough time left to finish the charge.

Any one of them failing stops the purchase, and nothing is charged.

On the receipt

A completed purchase is written into the same trace as the work that led to it, as a purchase.completed event carrying the business, the settled amount, and the ceiling it was checked against. Your signature appears as a hash — committed to, so it can be verified later, without publishing it.

Your delivery details are never part of the receipt.

Which businesses work

Any business that implements the Universal Commerce Protocol and publishes a /.well-known/ucp document. Axon identifies itself at /.well-known/ucp-agentand signs its requests, so a business that checks agent identity can verify the calls are ours. Payment runs through the business's own payment handler in your browser — Axon never sees a card number.

Give an agent commerce Your purchases