The prediction: by 31 March 2027, at least one merchant-facing agentic commerce protocol (OpenAI and Stripe’s Agentic Commerce Protocol, Google and Shopify’s Universal Commerce Protocol, or Google Cloud and PayPal’s Agent Payments Protocol) is likely to be handed to a neutral standards body rather than remaining vendor-maintained. The most probable destination is the Agentic AI Foundation, the Linux Foundation body that already hosts the Model Context Protocol and, since 17 August 2026, Agent2Agent. Three signals observed in the last four weeks point the same way, and none of them is a commerce announcement.
In short
- The prediction: one of ACP, UCP or AP2 likely moves under neutral foundation governance (most plausibly the Agentic AI Foundation) by 31 March 2027. A near-term checkpoint sits at 31 December 2026: a public working-group, donation or intent-to-contribute statement.
- Signal 1: Agent2Agent became a hosted Agentic AI Foundation project on 17 August 2026, giving the foundation five hosted projects and, per the foundation’s own account, membership growth from fewer than 40 at its December 2025 launch to more than 250, including Shopify and Block.
- Signal 2: Cloudflare announced Cloudflare Wallets and cloudflare.pay on 4 August 2026, settling over x402, a protocol governed by the x402 Foundation rather than by Cloudflare or Coinbase directly.
- Signal 3: Best Buy used its 27 August 2026 Q2 FY2027 earnings call to disclose a completed commerce integration with OpenAI, moving agentic checkout from a pilot line into investor-facing language.
- The read-across: every layer of the agentic commerce stack except checkout itself has already found a neutral home. Checkout is the last vendor-held layer, and merchant integration cost is the force that usually breaks that pattern.
Why this matters now
Merchants are being asked to integrate against a moving target. In the space of thirteen months the industry produced at least five overlapping specifications that touch the same transaction: ACP for agent-initiated checkout, UCP for agent-facing catalogue and checkout on Google surfaces, AP2 for payment authorisation, x402 for machine-to-machine settlement, and Visa’s Trusted Agent Protocol for agent identity. Each arrived with a coalition and an Apache 2.0 repository. None of the commerce-layer ones arrived with neutral governance.
That distinction matters more than the spec text. An Apache 2.0 licence tells you that you may fork the code; it says nothing about who decides the roadmap. When a protocol’s roadmap sits inside a company that also sells the commercial layer above it, integration becomes a bet on that company’s product strategy rather than on the standard. We argued a version of this point in July, when the evidence suggested agentic commerce would not crown a single standard in 2026 and that abstraction layers would absorb the fragmentation instead.
The August evidence sharpens that argument rather than replacing it. Fragmentation has not resolved, but the governance question underneath it has started moving, and it is moving in one direction. The signals below are not about which protocol wins. They are about where protocols go once the vendors that wrote them stop being able to carry the integration cost alone.
For a retailer planning 2027 engineering budget, this is the difference between two very different line items. Integrating against a vendor-governed protocol is a partnership commitment with renewal risk. Integrating against a foundation-governed protocol is closer to shipping a sitemap: unglamorous, durable, and unlikely to be withdrawn on a product-strategy call.
Signal 1: Agent-to-agent plumbing moved to neutral governance on 17 August
Agent2Agent, the specification Google published in April 2025 for how agents built on different frameworks discover each other and hand off work, became a hosted project of the Agentic AI Foundation on 17 August 2026. The move was reported by Axios as an exclusive on the day. The foundation’s own announcement frames the rationale plainly: neutral governance means the protocol an organisation’s agents depend on is not subject to a single vendor’s product decisions.
The sequencing is the interesting part. Google donated the A2A specification, SDKs and tooling to the Linux Foundation in June 2025 alongside AWS, Cisco, Microsoft, Salesforce, SAP and ServiceNow. The August 2026 move consolidated it into the agent-specific foundation that launched in December 2025 with Anthropic’s Model Context Protocol, Block’s goose agent framework and OpenAI’s AGENTS.md convention. A2A now sits beside MCP, goose, AGENTS.md and Agentgateway as one of five hosted projects.
Two numbers carry weight here. The foundation reports growth from fewer than 40 members at launch to more than 250 by August 2026, with Google, Microsoft, Amazon, Anthropic, OpenAI and Bloomberg among the backers. A2A itself is described as backed by more than 150 organisations. That is a membership base large enough to absorb a commerce protocol without the donating vendor losing meaningful influence, which is usually the blocking objection.
The commerce-relevant detail is quieter: Shopify and Block are both listed among the foundation’s backers. Shopify co-authored UCP. Block operates Square. Neither is a bystander to the checkout layer, and both are already inside the tent where the commerce protocol would land.
The foundation’s own project roster is the cleanest way to falsify this piece. As of 1 September 2026 it lists five projects and no commerce or payments protocol among them, which is exactly what makes the prediction checkable.
The Agentic AI Foundation project list is the primary source a reader can check in March 2027.
Signal 2: Cloudflare put the settlement leg in a foundation, not in a product
On 4 August 2026 Cloudflare announced Cloudflare Wallets, which lets AI agents hold stablecoins and pay for what they consume, alongside cloudflare.pay, an identity handle that tells a merchant which account an agent is acting for. The architecture is a two-tier delegation: human or organisation-controlled Account Wallets fund and delegate spending authority to per-agent Virtual Wallets keyed to API credentials. Guardrails include spending caps, maximum transaction sizes, merchant allowlists and anomaly detection.
The governance choice underneath is the signal, not the product. Payments settle over x402, the revived HTTP 402 “Payment Required” mechanism, which is maintained by the x402 Foundation with Cloudflare and Coinbase as founding members. Cloudflare did not build a proprietary agent-payment rail and market it as a differentiator. It built the wallet layer as product and left the rail in a foundation.
That is the same pattern the settlement conversation followed in traditional retail crypto, where the durable adoption landed in back-office rails rather than the consumer-facing button. We covered that dynamic in July when the evidence suggested retail’s 2026 stablecoin wave would land in settlement rather than checkout. The Cloudflare architecture is that argument expressed as an org chart.
Two caveats belong here and the piece will not hide them. The wallet’s payment functionality was described as coming soon at announcement, with handle claiming live first, and the seller-side Monetization Gateway announced on 1 July 2026 remains waitlist-only. An announcement is not a shipped rail, and the gap between the two has been wide across this whole category.
Even so, an infrastructure company with Cloudflare’s position in front of a large share of web traffic choosing foundation-governed settlement over a proprietary rail is a directional data point. It reduces the number of layers a merchant would have to negotiate bilaterally, and it sets the expectation that the money leg is neutral. Once identity and settlement are neutral, checkout is the odd layer out.
Signal 3: Best Buy moved an agentic integration into earnings-call language
On 27 August 2026 Best Buy reported Q2 FY2027 results: revenue of $9.78bn, up 3.6% year on year, enterprise comparable sales of 4.1% against prior guidance of roughly 1%, and adjusted diluted EPS of $1.47, up 15%. On the same call the company disclosed that it had completed its commerce integration with OpenAI, letting customers discover products, receive recommendations and complete purchases inside ChatGPT. Jason Bonfig, chief customer, product and fulfillment officer and incoming chief executive, framed it as expanding the digital ecosystem.
The financial result is not the signal. The disclosure venue is. Agentic checkout has spent eighteen months in press releases, developer blogs and conference keynotes. A completed integration named on a quarterly call, by an incoming chief executive, in a quarter that beat comparable-sales guidance by roughly three points, is a different category of statement. It is the point at which the integration becomes something investors will ask about again next quarter.
It also reveals the shape of what is actually being built, which cuts partly against the prediction. Reporting indicates OpenAI retired its original Instant Checkout flow in March 2026 and replaced it with dedicated retailer apps inside ChatGPT, with Walmart, Target and Instacart as launch partners. If that is the operative model, Best Buy’s integration is a bilateral partnership rather than a protocol adoption, and bilateral partnerships do not need neutral standards.
The counter-reading is that bilateral integrations are exactly what generates demand for a standard. A retailer that has now built one agentic surface has a concrete cost estimate for building the second and the third. That estimate is what turns a standards conversation from an abstraction into a budget line, and it echoes the argument that agentic commerce settles on retailer-controlled checkout rather than on a platform-owned funnel.
The three signals side by side
| Signal | Date | Signal type | What it directly shows | Read-across to the prediction |
|---|---|---|---|---|
| A2A joins the Agentic AI Foundation | 17 Aug 2026 | Governance / standards | Agent transport layer now neutrally governed; five hosted projects; 250+ members | A working, commerce-adjacent destination now exists and has absorbed a Google-origin protocol without incident |
| Cloudflare Wallets and cloudflare.pay | 4 Aug 2026 | Tech adoption / API release | Agent settlement built on x402, governed by the x402 Foundation, not by Cloudflare | An infrastructure incumbent chose neutral rails over a proprietary one at the money layer |
| Best Buy Q2 FY2027 disclosure | 27 Aug 2026 | Earnings forward-looking language | Completed OpenAI commerce integration named on a quarterly call by the incoming CEO | Merchant-side integration cost is now a board-level number, which is what historically forces standardisation |
What the pattern suggests
Read together, the three signals describe a stack that is going neutral from the outside in. Agent-to-agent transport went neutral in August. Tool and data access went neutral in December 2025 when MCP was contributed. Settlement is governed by the x402 Foundation. Agent identity is converging on IETF work, with Web Bot Auth and RFC 9421 HTTP Message Signatures underpinning Visa’s Trusted Agent Protocol. Checkout is the only layer still held entirely by the vendors that wrote it.
It is worth being precise about what “neutral” buys an adopter, because the term is used loosely. A foundation-hosted protocol has a published governance process, a technical steering body that is not a single company’s product team, and a trademark or specification licence that survives the founding vendor losing interest. None of that guarantees good technical decisions. It guarantees that the decision-making venue is visible and that an adopter can participate in it.
The commerce layer has none of those properties today. A merchant that builds against ACP is trusting that OpenAI and Stripe continue to want the same things they wanted in September 2025, and the March 2026 change to the Instant Checkout approach is a live demonstration that those preferences can change inside six months. A merchant that builds against UCP is making the same bet on Google and Shopify. Neither bet is unreasonable; both are bets on a company rather than on a specification.
That asymmetry is unstable for a structural reason rather than an ideological one. A protocol layer stays vendor-governed while the vendor can carry the entire integration cost through its own distribution. It goes neutral when the number of counterparties exceeds what bilateral deal-making can service. Best Buy’s disclosure is one retailer reaching that point; the interesting question is how many are three months behind it.
Governance status by layer
| Layer | Leading specification | Origin | Governance today | Neutral? |
|---|---|---|---|---|
| Tool and data access | Model Context Protocol | Anthropic | Agentic AI Foundation, Linux Foundation | Yes, since Dec 2025 |
| Agent-to-agent transport | Agent2Agent | Agentic AI Foundation, Linux Foundation | Yes, since 17 Aug 2026 | |
| Agent identity and verification | Web Bot Auth, RFC 9421; Visa TAP as an implementation | IETF work; Visa and Cloudflare | IETF process, with a Visa-operated key directory | Partly; the spec is neutral, the directory is not |
| Machine-to-machine settlement | x402 | Coinbase | x402 Foundation (Cloudflare and Coinbase founding members) | Yes, foundation-held |
| Payment authorisation | Agent Payments Protocol | Google Cloud and PayPal | Vendor-maintained, 60+ partner coalition | No |
| Agentic checkout | Agentic Commerce Protocol | OpenAI and Stripe | Vendor-maintained, Apache 2.0 repository | No |
| Agentic catalogue and checkout on Google surfaces | Universal Commerce Protocol | Google and Shopify | Vendor-maintained, Apache 2.0 repository | No |
Three of the seven rows moved to a neutral column within roughly nine months of each other. The remaining three commerce rows share an author set with the neutral rows: Google appears in both UCP and A2A, OpenAI in both ACP and AGENTS.md, Shopify in UCP and in the foundation’s membership. The organisations that would have to make the donation have already made analogous donations.
There is a second, less obvious pressure in the same direction. Foundation membership creates a forum where the vendors holding the commerce layer already meet the vendors holding everything else, and forums of that kind tend to generate scope creep. A2A sitting beside MCP inside one body means the agent-transport and tool-access conversations now happen in the same room. Payment authorisation is the natural next item on that agenda, which is part of why AP2 looks like the most exposed of the three.
How long the prior handoffs took
| Protocol | First published | Moved to neutral governance | Approximate lag |
|---|---|---|---|
| Model Context Protocol | Nov 2024 | Dec 2025, Agentic AI Foundation founding contribution | 13 months |
| Agent2Agent | Apr 2025 | Jun 2025 to Linux Foundation; Aug 2026 to AAIF | 2 months, then 14 months to consolidate |
| AGENTS.md | 2025 | Dec 2025, AAIF founding contribution | Under 12 months |
| Agentic Commerce Protocol | 29 Sep 2025 | Not yet | 11 months and counting |
| Universal Commerce Protocol | 11 Jan 2026, NRF keynote | Not yet | 8 months and counting |
The observed lag from publication to a neutral home has clustered between two and fourteen months across the agent-protocol set. ACP is already at eleven months and UCP at eight. If the commerce layer follows the same distribution, the window between now and the end of Q1 2027 is where the handoff would land. That is the arithmetic behind the timeframe, and it is a pattern argument rather than a certainty.
Wider context: the identity layer is doing the heavy lifting
The reason a checkout protocol can plausibly go neutral is that the commercially valuable question has moved underneath it. Visa’s Trusted Agent Protocol, announced with Cloudflare in October 2025 alongside twelve launch partners including Adyen, Ant International, Checkout.com, Coinbase, CyberSource, Elavon, Fiserv, Microsoft, Nuvei, Shopify, Stripe and Worldpay, signs agent identity into HTTP request headers so a merchant can cryptographically answer one question: is this agent legitimate?
The mechanism uses RFC 9421 HTTP Message Signatures built on the emerging Web Bot Auth standard, with merchants verifying Ed25519 signatures against a Visa-operated directory of agent public keys. The specification is heading through IETF process; the directory is not. That split is where the durable commercial position sits, and it looks a great deal like the position card networks already hold in card-present commerce.
We flagged the shape of this in June, when the payment-rail evidence suggested tokenised agent identity would become the gate for agentic checkout. The August signals do not contradict that; they explain why the checkout protocol itself is becoming cheap to give away. If the money and the trust decision live in the identity directory and the settlement rail, the checkout message format is plumbing.
This is the standard economic logic of commoditising the complement. A firm that controls the identity directory or the acquiring relationship benefits from the widest possible adoption of the message format above it, and the fastest route to wide adoption of a message format is neutral governance. The incentive that used to argue against donating ACP or UCP now argues for it.
Implications for retailers, platforms and payment providers
For retailers, the practical instruction is to separate the durable investments from the reversible ones. The product feed, the inventory and price accuracy behind it, the returns policy expressed in machine-readable form and the agent-verification handling at the edge are durable regardless of which protocol wins. The specific checkout adapter is not, and it should be built as a thin, swappable layer rather than as a platform commitment.
For merchants sizing effort, the honest budget split is roughly the reverse of the industry conversation. Most of the work in serving agents well is catalogue quality, availability truthfulness and post-purchase data, not checkout message handling. A merchant that treats agentic readiness as a checkout project will spend its budget on the layer most likely to be standardised out from under it.
For platforms and payment providers, the strategic question is which layer to defend. Defending the checkout protocol is likely to become an expensive way to hold a position that neutral governance will erode anyway. Defending identity, dispute handling and settlement is where the observable investment has gone, and the dispute question is genuinely unresolved: the evidence in August suggested agent chargeback rules would likely miss the 2026 holidays altogether.
For investors, the useful reframing is that the checkout protocol is not where the durable margin sits, so protocol announcements are weak evidence about competitive position. The stronger tells are ownership of the agent key directory, the acquiring relationship, and the dispute and chargeback framework that has to exist before large retailers will accept agent-initiated orders at volume. Those three are slower to build and much harder to donate.
A reasonable monitoring routine for the next two quarters is short. Watch the Agentic AI Foundation project roster and any working-group formation announcements. Watch whether Cloudflare Wallets moves from handle claiming to live payments. Watch Q3 and Q4 earnings calls for whether retailers describe agentic integrations in bilateral partnership language or in protocol language, because that word choice is the clearest available proxy for which of the scenarios below is playing out.
Three scenarios to the end of Q1 2027
| Scenario | Rough likelihood | Earliest visible tell | What merchants should do |
|---|---|---|---|
| Handoff happens: ACP, UCP or AP2 becomes a hosted foundation project or enters a formal standards process | The base case on the signal set, though well short of certain | A working-group formation, an intent-to-contribute statement, or a new project listing before 31 Dec 2026 | Build the checkout adapter thin; invest in feed and identity handling |
| Bilateral lock-in: platforms settle on direct retailer integrations and no protocol needs neutral governance | The strongest competing case, supported by the retailer-app model | More completed bilateral integrations named on Q3 and Q4 calls with no protocol language attached | Negotiate per-platform terms and budget for repeated integration work |
| Stall: commerce protocols stay vendor-held and adoption plateaus through the 2027 planning cycle | Plausible if the money layer slips | Cloudflare Wallets payment functionality still unshipped at year-end; no new AAIF commerce project | Defer deep integration; keep feeds clean, which pays off in either direction |
Note that the merchant instruction is close to identical across all three scenarios. That is usually a sign that the prediction is more interesting for platform strategy than for retail operations, and it is worth saying plainly rather than dressing the forecast up as an urgent operational deadline.
Caveats: what could go wrong
The strongest objection is economic. MCP, A2A and AGENTS.md were cheap to donate because none of them is directly monetised: they are cost centres that get more valuable as adoption widens. Checkout is not in that category. ACP routes transactions toward Stripe’s processing relationships and UCP routes them toward Google’s surfaces and Shopify’s merchant base, so donating either has a revenue-adjacent cost the prior donations did not.
The second objection is that the bilateral model may simply win. If the operative pattern is dedicated retailer apps inside assistant products, as the March 2026 change to OpenAI’s checkout approach suggests, then the counterparty count stays in the dozens rather than the thousands. Bilateral deal-making services dozens of counterparties comfortably, and the pressure that forces standardisation never builds.
The third objection is that governance handoffs can be nominal. A2A had already been donated to the Linux Foundation in June 2025; the August 2026 move arguably clarified hosting rather than transferring control. A commerce protocol could make the same move and leave the effective roadmap exactly where it was, which would satisfy the letter of this prediction while missing its point.
The fourth is execution risk on the settlement leg. Cloudflare’s payment functionality was not live at announcement and the seller-side gateway is waitlist-only. Stablecoin-denominated agent settlement also carries regulatory exposure that could slow the x402 path independently of anything happening at the protocol layer.
A fifth, narrower risk is that the category’s centre of gravity moves before the governance question resolves. If agentic buying concentrates in categories with different economics, such as groceries and local pickup where fulfilment rather than checkout is the binding constraint, the winning integration pattern may be defined by logistics interfaces rather than by checkout message formats. A protocol handoff would then arrive after the market has already routed around the problem.
Taken together, these do not overturn the base case, but they should hold it well below high confidence. The signals establish that a neutral destination exists, that it is absorbing adjacent protocols, and that merchant-side cost is becoming visible. They do not establish that the vendors holding the commerce layer have decided to let go.
FAQ
What exactly would count as this prediction coming true?
A public listing of ACP, UCP or AP2 as a hosted project of the Agentic AI Foundation, or a formal contribution to an equivalent neutral body such as the Linux Foundation directly, the IETF or W3C, with the announcement dated on or before 31 March 2027. The Agentic AI Foundation project page is the simplest single check, since it listed five projects and no commerce protocol as of 1 September 2026.
Isn’t Apache 2.0 licensing already neutral enough?
No, and the distinction is the crux of the piece. An open licence governs your right to use and fork the code; it does not govern who decides what ships in the next version. Both ACP and UCP are published under Apache 2.0 while remaining vendor-maintained, which is precisely the arrangement the Agentic AI Foundation’s own framing describes as leaving adopters subject to a single vendor’s product decisions.
Which of the three protocols is most likely to move first?
AP2 looks like the softest target on the available evidence. It is an authorisation layer rather than a checkout surface, its economics are closer to plumbing than to distribution, and its architectural relationship to A2A means it already sits adjacent to a foundation-hosted project. ACP and UCP both carry direct distribution value to their authors, which makes them harder to give away.
What is the strongest argument that this prediction is wrong?
That checkout is the monetisable layer and the previous donations were not. Anthropic gave away MCP at no revenue cost; Stripe giving away governance of ACP would touch a routing decision that connects to processing volume. If that asymmetry dominates, the commerce layer stays vendor-held indefinitely and this forecast fails on economics rather than on timing.
Does the Best Buy disclosure actually support the prediction, or undercut it?
Honestly, both. It undercuts the prediction insofar as the integration appears bilateral rather than protocol-mediated, which is the pattern that removes the need for a standard. It supports it insofar as a completed integration produces a concrete internal cost estimate for the second and third agentic surface, and that estimate is what usually turns retailers into standards advocates.
Should a mid-market retailer be integrating any of these protocols today?
The pattern suggests building the underlying assets and deferring the protocol commitment. Accurate feeds, real-time availability, machine-readable returns and shipping terms, and correct handling of signed agent requests at the CDN or WAF layer all pay off under every scenario in the table above. A specific checkout adapter is the part most likely to be rewritten, so it should be isolated behind an interface.
How does agent identity verification relate to all this?
It is the layer that makes the checkout layer safe to commoditise. Visa’s Trusted Agent Protocol signs agent identity into HTTP headers using RFC 9421 signatures over the Web Bot Auth pattern, with verification against a network-operated key directory. Whoever operates the directory holds a durable position regardless of which checkout message format merchants adopt.
What is the nearest-term thing to watch?
Two things before the end of 2026. First, whether Cloudflare Wallets ships payment functionality rather than just handle claiming, which tests whether the settlement leg is real. Second, whether any working group, intent-to-contribute statement or foundation project listing appears for a commerce protocol, which would be the leading indicator for the March 2027 checkpoint.
Could a commerce protocol go to the IETF or W3C instead of the Linux Foundation?
Yes, and that would still satisfy the prediction as stated. The identity layer is already taking the IETF route through Web Bot Auth and RFC 9421, which establishes a precedent within the same stack. IETF process is slower than a foundation contribution, so a body such as the Agentic AI Foundation remains the more probable destination on timing grounds alone.
This piece is analysis rather than reporting. Signals were drawn from announcements and disclosures dated 4, 17 and 27 August 2026; the prediction is falsifiable against the Agentic AI Foundation project roster on 31 March 2027.