Agentic Standards Map

Who is standardising agentic commerce, where, and what they have committed to next.

W3C, IETF, GS1, UN/CEFACT, the Linux Foundation, AAIF, and the industry protocols (UCP, ACP, AP2, x402, Visa, Mastercard) are all working on how an AI agent finds a seller, trusts a product, proves who it acts for and pays. They do it at the same time, at different speeds and with different rules. This map puts them on one page.

Every statement is dated and points to a public source. The map makes no predictions or recommendations of its own and does not rank approaches. Third-party proposals are recorded with attribution and their stated status.

This map documents public standardisation activity, specifications and declared commitments. It does not measure market adoption, transaction volume, cross-protocol interoperability or the reliability of deployed implementations. Implementation claims are reported only where supported by dated public evidence and are not treated as evidence of interoperability.

Version 1.0.1 (2026-10-14) · site updated 2026-10-15. The map is updated as venues move; each entry carries its own read date.

DOI (all versions): 10.5281/zenodo.23357361

Four things you see only when you look across venues

1. The map identifies at least eight discovery mechanisms or publication paths. /.well-known/ucp, A2A's agent-card.json, schema.org, ARD, AI Catalog, MCP Server Cards, DNS-AID and the /.well-known/poppy.json of the Personal Agent Protocol. Of these eight, only agent-card.json is in the IANA well-known registry (updated 2026-10-07, read 2026-10-14). Two venues have discovery-charter work in progress: the IETF DAWN charter is in external review, with comments to the IESG due by 2026-10-19 and an IESG telechat listed for 2026-10-22, and the W3C Agentic Web WG charter is in refinement. Seam S1

2. Product identity: one ratified route and one route marked at risk. GS1 Digital Link gives a ratified route to product identifiers; the DID route cited for Digital Product Passports rests on a feature that the DID Resolution Candidate Recommendation Draft marks at risk. One workshop position statement (#31, Sven Böckelmann) frames the open question as three checks: "Where. Who signed. Who may." Seam S2

3. Agent identity: several protocols reference HTTP Message Signatures or Web Bot Auth. Visa TAP, Mastercard Agent Pay, UCP and x402 build on RFC 9421 or Web Bot Auth. The IETF agentproto charter names webbotauth among the groups to coordinate with, and the draft W3C Agentic Web charter lists it for coordination too. ACP's texts do not mention it (not found in the ACP repository, 2026-10-03). Seam S3

4. Checkout: what each protocol defines differs between the checkout and the events after it. Native AP2 chains a merchant-signed checkout, the user's mandate and a Checkout Receipt that the merchant must return once it accepts or rejects the mandate (docs/ap2/specification.md at commit e1ea56d, read 2026-10-13). The words refund and cancel are not found in the seven AP2 documents of docs/ap2; the goods-return term occurs only as the field return_policy ("30-day returns") in two example checkouts of checkout_mandate.md, and fulfil(l) only as a generic verb, never for the fulfilment of an order (2026-10-14). UCP signs the delivery of order webhooks (RFC 9421) and ACP signs its webhooks with HMAC: those are signatures on a delivery. Poppy, PACT and Shopify/shop each state in writing what their own record does not prove. A confirmation to the consumer on a durable medium is not found in the Poppy specification and operations pages, the PACT specification page or the Shopify/shop README, SKILL.md and transactions.md (2026-10-13). Seam S4

Entries verified up to 2026-10-15; pages generated on 2026-10-16 from commit 1cb6133.

Graph of the seams | All overlaps | Both graphs on one page | Seams | Calendar | map.json | calendar.ics | map-bundle.md | For agents and tools

Next on the calendar

• 15 Oct Accuracy & Reliability of AI Agents: Virtual Summit, 15:00 to 17:00 GMT, online
• 15 Oct AAIF Taxonomy and Landscape Workstream: Ecosystem Architecture Map v1.0, target in the charter
• approx. 19 Oct Schedule of the Monday to Wednesday TPAC breakouts added to the TPAC calendar
• 19 Oct Comments on the proposed DAWN charter due to the IESG mailing list
• 21 Oct aipref virtual interim meeting, 20:00 to 21:30 UTC, no agenda submitted on 2026-09-30

Full 60-day calendar: Calendar

Where things stand

Payment protocols compared

Start here

How the map is built

• Public sources only. Every statement links to a public URL and the date it was read.
• Committed, not predicted. "Next" means a deliverable or event declared by the responsible body.
• Facts, not proposals. Gaps and overlaps are recorded; what to do about them belongs elsewhere.
• Speaker is explicit. Each source is tagged: normative text, official decision, maintainer or chair statement, participant or third party. A participant's view is never presented as the venue's position.
• Negatives are scoped. "Not found" always says in which texts and on which date.
• AI assistance is declared. How language model assistants were used, and what the author checked, is stated in AI-USE.md.

Inclusion, entry format and source classes are described in full in METHOD.md.

Contributing

Corrections and additions based on public sources are welcome: see CONTRIBUTING.md. Each change is dated.

Licence

Content (entries, notes, MAP.md, map.json, the per-entry JSON files, map-bundle.md): CC BY 4.0. Code (tools/): MIT. Quotations from third-party texts remain under their own terms; CC BY 4.0 applies to the author's text and data.

All entries

W3C

• W3C AI Agent Protocol Community Group core
• W3C Agent Identity Registry Protocol Community Group context
• W3C Agent-Ready Video Community Group context
• W3C Agent-to-Web Framework (A2WF) Community Group context
• W3C Agentic Web Working Group (draft charter) core
• W3C DID Methods Working Group (proposed charter) context
• W3C DID Resolution core
• W3C Decentralized Identifier Working Group (proposed charter) context
• W3C Digital Policy Working Group (ODRL, draft charter) context
• W3C TPAC 2026 breakouts on agents (Dublin, 2026-10-26/30) core
• W3C Web Payment Security Interest Group context
• W3C browser-testing-tools Working Group (charter draft) context
• W3C/GS1 Workshop on E-commerce for Humans and AI Agents (Zurich, 8-9 Sep 2026) core
• WebMCP (Draft Community Group Report, Web Machine Learning CG) context

IETF

• DNS for AI Discovery (DNS-AID, draft-mozleywilliams-dnsop-dnsaid) context
• IETF AI Preferences (aipref WG) core
• IETF AUDIT (BoF preparation) core
• IETF DAWN, Discovery of Agents With Names (proposed WG) core
• IETF WIMSE, AI Identity Management System (draft-ietf-wimse-aims) context
• IETF Web Bot Auth (webbotauth WG) core
• IETF agentproto (Agent Communication Protocols WG) core
• IETF vcon (Virtualized Conversations WG) core
• Individual IETF drafts on the seller side core
• Payment HTTP Authentication Scheme (draft-httpauth-payment, Tempo Labs and Stripe) context

GS1

• GS1 Digital Link Standard, URI Syntax 1.7.0 context
• GS1-Conformant Resolver Standard 1.2.1 core

UN/CEFACT

• UN Global Trust Register, namespace urn:gtr context
• UN Transparency Protocol, Identity Resolver core

Other standards bodies

• CEN/CENELEC JTC 24 Digital Product Passport standards (EN 18216 to EN 18246) core
• IEEE P3931 Agent Description, Discovery, and Registry (ADDR) Interoperability context

AAIF

• AAIF Agentic Commerce Working Group core
• AAIF Identity and Trust group, issue context
• AAIF structure, Technical Committee and working groups context

Linux Foundation

• A2A protocol, agent discovery core
• AI Catalog (Agent Card Working Group) core
• Agent2Agent (A2A) protocol, core specification context
• DIF Trusted AI Agents Working Group context
• MCP Server Cards (ext-server-card, SEP-2127) core
• Model Context Protocol (MCP), core specification context
• TRACE (Trust, Runtime Attestation and Compliance Evidence) context
• x402 core

Independent

• Agentic Resource Discovery (ARD) core
• Browser vendor positions on WebMCP (WebKit, Mozilla, Chrome, Edge) core
• EMILIA Protocol (individual drafts and open-source gate) context
• OpenID Foundation AuthZEN Working Group (agent authorization drafts AARP and COAZ) context
• schema.org open issues relevant to agents, bookings, product and establishment identity core
• schema.org vocabulary for products, offers, sellers and lodging (current release) context

Industry

• Agent Payments Protocol (AP2) core
• Agentic Commerce Protocol (ACP) core
• EMV Agentic Payments Framework for Specifications (draft for public feedback) core
• FIDO Alliance agentic authentication and payments work context
• KYAPay (Skyfire) core
• Mastercard Agent Pay core
• Personal Agent Consent & Trust Protocol (PACT), published by Decagon with Instinct core
• Personal Agent Protocol (PAP, "Poppy"), published by Sierra with Meta core
• Shopify, MCP surfaces for buyer agents, developers and merchants context
• Universal Commerce Protocol (UCP) core
• Verifiable Intent core
• Visa Trusted Agent Protocol (TAP) core