Who's Real Online? How Web3 Identity Protects Humans and Empowers AI Agents in Digital Commerce

 In a nutshell (TL;DR)...

• The Internet's Identity Crisis: AI advances make distinguishing humans from automated bots increasingly difficult, enabling Sybil attacks and credential abuse in digital commerce.

• Proof of Personhood: Web3 uses privacy-preserving biometrics and Zero-Knowledge Proofs (ZKPs) to verify unique human identity without revealing personal data.

• Digital Passports for AI: Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) grant AI agents auditable, cryptographic permissions instead of vulnerable shared API keys.

• Mutual Trust in Action: Autonomous agents conduct secure transactions through mutual authentication, machine-readable trust lists, and scoped one-time mandates.

The Internet's "Identity Crisis" in the Age of AI

OK I know, but better late than never eh? Last week I looked into how we can trust agentic software to take a more independent role and the technologies put into place to ensure that. But, as artificial intelligence rapidly advances, distinguishing between a real human user and an autonomous software bot is becoming increasingly difficult. This poses a major threat to digital commerce and online communities:

• The Sybil Attack Problem: Named after a psychological study on multiple personalities, a "Sybil attack" occurs when a single bad actor creates thousands of fake online accounts to exploit systems designed for real individuals. In Web3, malicious bot farms routinely drain free token distributions, manipulate community voting, and hoard limited-edition event tickets before genuine users can connect.

• The "Shared Secret" Vulnerability: Historically, software programs have authenticated themselves across corporate systems using static API keys or shared passwords. If multiple AI agents share the same API key, security logs cannot tell which specific agent performed an action. If that key is stolen or intercepted, attackers can impersonate legitimate AI agents at machine speed.

To build a safe agentic economy, where AI agents buy products, book travel, and manage services on our behalf, we need a modern digital identity layer that protects human rights while giving software agents verifiable digital passports.

Proof of Personhood: Proving You're Human Without Sacrificing Privacy

When an online service or merchant wants to grant special rewards, discount codes, or voting rights to real people, it needs a way to confirm that each participant is a unique human being rather than an automated bot farm.

This design goal is known as Proof of Personhood, a cryptographic guarantee that a digital credential belongs to exactly one living human.

• How Biometrics Meet Privacy: Systems like Worldcoin (using iris scans) and Humanity Protocol (using infrared palm-vein scanning) verify physical uniqueness. Because palm vein patterns and iris textures are statistically unique, they prevent a single user from signing up thousands of times.

• Zero-Knowledge Proofs (ZKPs): To prevent these systems from turning into invasive surveillance databases, they use Zero-Knowledge Proofs. A ZKP is a mathematical tool that allows a user's digital wallet to prove the statement "I am a verified, unique human" to an online merchant without revealing their name, home address, or underlying biometric scan.

Digital Passports for Software: Verifiable Credentials for AI Agents

While humans need to prove their uniqueness, AI agents need a way to prove who built them, who owns them, and what specific authority they hold.

Instead of relying on easily stolen API keys, Web3 identity frameworks issue Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) directly to software agents:

• What is a Verifiable Credential? Think of a VC as a cryptographically signed, tamper-evident digital certificate. It is signed by an issuing authority (like a bank, a government agency, or a corporation). Anyone who inspects the credential can instantly verify who issued it and confirm that the data inside has not been altered or forged.

• Identity Binding: Giving an AI agent its own distinct cryptographic keypair binds its actions directly to its owner's digital signature. This creates an auditable chain of command so businesses always know which agent initiated a purchase or database query.

Mutual Trust in Action: How Buyer and Seller Agents Do Business

Imagine asking your personal AI assistant to book a multi-city vacation for under $1,500. Your AI agent must interact with airline agents, hotel bots, and payment processors across companies it has never interacted with before. Web3 identity standards allow these autonomous systems to negotiate safely through a three-step handshake:

Step A: Mutual Authentication ("Show Me Your ID")

Before any sensitive personal details or credit card information are shared, the buyer agent and seller agent verify each other's credentials. The buyer agent verifies that the airline bot actually holds a private key signed by an accredited airline brand. As security researchers note: "You can spoof a website or an agent's text output, but you cannot fake an organization's private cryptographic key".

Step B: Machine-Readable Trust Lists

How does your AI agent know if a new merchant is legitimate? Web3 identity relies on machine-readable trust lists—published, cached files listing approved merchants, banks, and identity issuers. Your AI agent automatically checks this list on first contact to confirm the merchant has been vetted, eliminating the need for manual, hand-built integrations.

Step C: One-Time Delegated Mandates

To execute the actual purchase, you don't give your AI agent unrestricted access to your entire bank account. Instead, your device generates a scoped, one-time payment mandate (a feature standardized in payment frameworks like Google's AP2 and W3C standards).

This digital mandate explicitly states: "Authorized to spend up to $1,500 with Flight Vendor X for Transaction Y". If a malicious actor intercepts this message, the mandate cannot be replayed or redirected to buy a different product or pay a different merchant. Furthermore, using protocols like DIDComm, the cryptographic authority to sign these mandates can stay safely stored inside a digital wallet on your personal smartphone rather than sitting exposed on a cloud server.

Summary: A Transparent, High-Trust Internet

Web3 identity technology solves the fundamental trust gap in digital commerce. By combining Proof of Personhood to shield human systems from bot fraud with Verifiable Credentials to give AI agents cryptographically bounded spending authority, Web3 creates an open, secure environment where software can safely pay software on behalf of real people.

Next week I’ll take a look at on how AI agents can improve DAO governance and community decision-making…..

What is Agentic Commerce?

What Agentic Commerce Means for the Regular Consumer

My day job involves working for a software company that develops a PIM (Product Information Management) solution. Maybe I will reveal what company that is in future posts, but I'd like to keep this fairly generic and sales free, and that way I may learn a thing or two about any other competitive systems too. The point is that this blog will possibly start off with a bit of a skew toward product content, selling products online and how AI is helping in that process. But I’m just going to meander and see what I uncover and hopefully it might be interesting to someone…

The first big topic that everyone is talking about (in my world) is Agentic Commerce and for the average shopper this represents a shift from "Do It Yourself" to "Do It For Me."

In the current world of e-commerce, the burden of work falls on you. You have to think of keywords, type them into a search engine, open ten different tabs to compare prices, read through reviews to check for quality, manually filter for your size, and finally click through a checkout process.

Agentic Commerce changes this dynamic by introducing AI Agents. Unlike standard chatbots that just answer questions, these Agents have "agency"—the ability to reason, plan, and execute tasks to achieve a goal you set for them.

Here is what this looks like in practice for a consumer:

1. The "Personal Shopper" Experience Imagine you need a gift. Instead of browsing endless categories, you simply tell your AI Agent: "Find a birthday gift for my brother, under $50, something tech-related".

• Reasoning: The Agent understands the constraints (budget, interest, occasion). You may already have told it your shoe size and waist measurement to streamline the next step.
• Planning: It scans catalogs, checks reviews for reliability, and compares prices across different sellers instantly.
• Action: It presents you with the best options—or, if you trust it enough, simply buys the best one for you.

2. Complex Tasks Handled Instantly Agents shine when the request is complicated. If you say, "Book me a flight to Barcelona for Friday morning," the Agent doesn't just show you a list of links. It autonomously compares airlines, finds the best deal that includes baggage, books the ticket, and emails you the confirmation. It acts like a knowledgeable consultant rather than a search bar. It may even handle the rest of the experience by organizing your boarding pass, alerting you to any delays and later managing any insurance claims should they unfortunately arise.

3. Running Errands on Autopilot For repeat purchases, Agentic Commerce offers "set it and forget it" convenience. An Agent can notice when you usually buy cleaning supplies or cosmetics and automatically reorder them so you never run out, handling the transaction in the background.

4. The End of "Tab Fatigue" The most immediate benefit for a consumer is the removal of friction. Because the Agent can read product specifications, check inventory, and understand shipping policies instantly, you no longer need to hunt for this information. The Agent digests it all and provides a direct solution, making the actual act of shopping nearly invisible but highly effective.

It's happening now!

Well, kind of. While we are not yet seeing this agentic concept fully realised, I can assure you it is starting to emerge, at least in the US, where the waves are lapping at the shore.

As far as infrastructure is concerned, OpenAI and Google have produced specifications to enabled sellers to upload their product information. Stripe, Klarna and Mastercard are at the forefront of supporting the transactional side of things to allow machine-to-machine payments, effectively making the shopping cart part of the agentic experience.

Several retail giants (customer-facing agents) have integrated capabilities directly into their apps to move beyond basic search:

• Amazon (Rufus & "Buy For Me") : As of 2026, Rufus has evolved to include a "Buy For Me" feature. It can monitor prices and autonomously execute a purchase when a specific price threshold is met. It can also digitize a handwritten grocery list and populate a cart instantly.
• Walmart : Using the OpenAI protocol, Walmart allows users to build complex carts (multi-item transactions) through conversational agents that understand "standing intents" which are pre-defined, persistent user goals or purposes that an AI system is trained to recognize and respond to, for example "Always keep my pantry stocked with organic milk")
• Shopify (Sidekick & Agentic Storefronts) : In early 2026, Shopify launched "The Renaissance" update. Sidekick is now a proactive agent that manages merchant operations (inventory and promo generation) and distributes product data to third-party agents like ChatGPT or Perplexity for "headless" agentic checkout.

Specialized AI platforms or "agent-first" companies are where many consumers are now starting their shopping journeys:

• Perplexity (Buy with Pro) : Launched in late 2024 and expanded in 2025/2026, this tool allows Pro users to research a product and click a single button to have Perplexity's agent handle the checkout process on a merchant's site.
• Microsoft (Copilot Checkout) : Integrated into the Microsoft 365 and Edge ecosystem, this allows agents to "negotiate" with brand agents and secure delivery slots that fit the user's Outlook calendar as well as complete the shopping cart within the customer conversation.

And finally, many software vendors are implementing solutions to help B2B/B2C enterprises manage their own agentic selling experiences and deliver product information to it:

• Salesforce (Agentforce) : Actively used by B2B and B2C enterprises to automate order management, returns and exchanges. Salesforce agents can now autonomously process refunds and update ERP systems based on a customer's conversation.
• UiPath ("Autopilot" and "Maestro") : These platforms allow enterprises to build custom agents that handle procurement, invoice matching and automated restocking without human intervention.
• Agility PIM : Using its built-in AI Content Generation to upscale creation of answer-optimized product information that is now required to tackle new content strategies such as GEO and AEO.

What does this mean for online sellers?

So this leads to a final point about what it means for you to sell products online, you can no longer just rely on attracting customers to your websites, or even other affiliated or distributor sites. Traditionally this process was done by optimising your content through SEO (Search Engine Optimisation) that sought to rank your product pages as high up the Google search results as possible. But in an Agentic Commerce world your customers may never even set eyes on your product’s pages. So you must seek to be part of the AI conversation rather than a link to your product.

So my journey into this world will cover a bunch of topics that will try to unravel big topics that sellers will need to be aware of as they make this shift (I nearly said "paradigm shift" but I really need to avoid such cliches, they are not funny).

• Generative Engine Optimization (GEO & AEO) : Sellers can no longer just optimize for Google keywords (SEO). They must learn AEO (Answer Engine Optimization) and GEO, strategies focused on becoming the "source material" or "cited answer" for AI models like ChatGPT and Perplexity,. This involves structuring content so an AI can easily read, summarize, and recommend it.
• The New "Product Feed" Standard: To sell to an AI Agent, your data must be flawless. OpenAI and Google have released their own specific product feed specifications that require high-frequency updates and new data fields like "Mood" or specific use cases, ensuring the AI understands context, not just specs.
• Agentic AI PIM (Product Information Management): Preparing data manually for AI Agents is impossible at scale. Sellers should explore Agentic AI PIM, where AI tools autonomously clean, enrich, and structure product data to ensure it is trusted by shopping bots.
• Trust and Transparency Signals: In an era where a machine buys on behalf of a human, trust is currency. Sellers will need to explore how to present "Seller Policies" and transparency data (like return rates and privacy policies) directly to AI Agents to ensure they are selected as a "safe" purchase option.