Everything solves the moment of purchase. Almost nothing solves what comes after.
Thirty-two protocols, rulebooks and rails now compete to intermediate agent-initiated payments. They cluster tightly around one problem — proving a human authorised this transaction — and thin out to nothing on either side of it. Discovery is contested. Disputes, refunds, recurring, reconciliation, attribution and tax are close to unowned, and the specs say so explicitly: across AP2, ACP and UCP, the issues describing operational gaps are filed by outside implementers and receive zero maintainer responses.
Two findings reframe the usual "standards war" story. AP2 and Mastercard Verifiable Intent are near-isomorphic — same credential format, same curve, same delegation binding, same checkout_hash contract — which is why FIDO merged them in April rather than letting them compete. And the stack carrying by far the most real volume, Shopify's, contains no mandate layer at all. This is a working map of what exists, what is binding versus aspirational, and where the load-bearing claims turned out to be wrong.
The stack
Four contested layers over one uncontested substrate. Discovery does not get its own band — UCP treats discovery through post-purchase as a single protocol, which is the industry's own answer to where that boundary sits. Click any protocol to jump to its entry.
The seams matter more than the boxes. As of 17 Jul 2026, AP2's own reference SDK emits delegate-SD-JWT chains that fail UCP's ap2_mandate schema regex (UCP #599) — the authorization layer and the checkout layer do not compose at the byte level, today, in the reference implementations.
Protocol catalog
Every protocol, rulebook and rail in scope. Status separates what ships from what was announced; confidence records how well the claim survived fact-checking. Expand any card for mechanics, known gaps and named adopters.
What you would actually deploy
Six stacks that compose in practice. Note what Stack A — by far the highest real volume — does not contain. And note that Stack F should not be deployed at all.
The seams, named precisely
Double-standardisation does not cost money at the crypto layer — Web Bot Auth and SD-JWT VC have converged. It costs at registries and at the boundaries below.
If you are X, use Y
| If you are | Do this |
|---|
What everyone gets wrong
Each of these is widely repeated in industry coverage and contradicted by the primary source. Several were in this research's own first draft before verification caught them.
Where the whitespace is
Ranked by evidence density and structural defensibility. evidenced means a verbatim complaint from a named practitioner in a spec repo or industry source — not inference. The recurring pattern: these are filed by outside implementers and left unanswered, which is a revealed preference about roadmap, not a backlog.
Who governs what
Standards-body cover is thinner than the press releases suggest. No binding rule requiring agent identity in payments exists in the US, UK, EU, Singapore or India.
| Body | Owns | State | Since | Reality check |
|---|
By jurisdiction
Ordered by how far each regulator has actually gone. The gap between rhetoric and rule is wide everywhere — and the only binding text governing agent payments anywhere in the world is a card scheme's private rulebook.
| Jurisdiction | Posture | What exists | Binding? |
|---|
Regulatory clock
The binding constraints over the next 24 months are not new AI rules — they are old rules with 2026 and 2027 dates. Three comment windows are open right now — two US, one Indian — and all three are places to put a position on the record before the frameworks harden.
The numbers
Measured facts and vendor forecasts, kept visually separate — hatched tiles are forecasts. The traction picture is materially worse than the announcement picture.
How it happened
Fourteen months from the x402 whitepaper to a landscape with five competing checkout and settlement standards, one binding rulebook, and an unresolved federal appeal over whether agents may act inside a logged-in session at all.