Shelf Life | Vol. 44 - Secret Identities: Agentic Commerce's Latest Wins and Its Kryptonite

🗓️ March 2026 | ✍️ Shelf Life

Agentic commerce is suiting up. The question is whether your organization knows who's wearing the cape.

Catch Me Live Today at 2pm ET

Before we get into it — today at 2pm ET, I'm co-presenting a Retail Dive webinar with David Januchowski, Principal Strategic Advisor at Okta, on the topic that's keeping every retail exec up at night: "Securing the AI Agents that Power the Future of Retail."

We cover agentic commerce maturity, the non-human insider threat, identity as a security foundation, and what retailers actually need to do right now. It's the conversation the industry isn't having loudly enough.

👉 [Register / Watch here: Securing the AI Agents that Power the Future of Retail]

Now, back to the chaos.

Top Shelf Insights

🛒 OpenAI's ACP announced itself as the open infrastructure standard for AI-native commerce and it's in a cage match with Google's UCP for who owns the checkout layer of the future.

🔒 AI agents are your next insider threat. The same technology powering agentic commerce is also your most unsecured non-human employee.

🏃♀️ First-mover advantage in agentic commerce is real. The window is open. The window is also closing.

📱 GAP, Walmart, Sephora, Target, Nordstrom, Lowe's, Best Buy, and Wayfair have already suited up. So the question isn't if, it's when, is your brand getting on the shelf?

Origin Story: The Ground Just Shifted... Again

Shoptalk week was a frenzy. While everyone was working the conference floor in Vegas, OpenAI launched richer, more visual shopping in ChatGPT where you can browse products visually, compare side-by-side, get detailed up-to-date info, all in one place. OpenAI Cool upgrade. But the real story is the pivot underneath it.

OpenAI moved away from native Instant Checkout and shifted toward dedicated merchant apps within ChatGPT, rerouting users to retailers' own sites to complete purchases, giving brands more control of the transaction and customer experience.

The headline reaction: OpenAI stumbled. My reaction: OpenAI learned.

Payments are complex, require heavy compliance, and order completion is emotional. It's easy to lose customers' patience, trust, and attention before they finish. Native checkout in an AI chat thread is genuinely hard. Nobody has cracked it yet. The retailers acting like this is a crisis are the same ones who called e-commerce a fad in 2002.

The actual takeaway:

🔹 Discovery is ready. Checkout is not... yet...

🔹 Asking questions and researching a product are consumers' top two use cases in answer engines. Completing a purchase is their least-adopted. The funnel is just being rebuilt from the top down.

🔹 The retailers getting fluent in discovery now will be the ones the agent recommends when checkout finally works.

Choose Your Superpower: ACP vs. UCP

Two open standards are competing to own the infrastructure layer of agentic commerce. Here's your cheat sheet:

OpenAI's ACP (Agentic Commerce Protocol)

🔹 Co-developed with Stripe. Works across platforms and payment processors without requiring merchants to change backend systems. Merchants stay merchant of record.

🔹 Target, Sephora, Nordstrom, Lowe's, Best Buy, Home Depot, and Wayfair are already integrated for discovery.

🔹 Discovery-first for now. Checkout via dedicated apps or redirect to merchant site.

Google's UCP (Universal Commerce Protocol)

🔹 Announced at NRF, co-developed with Shopify, Etsy, Wayfair, Target, and Walmart, endorsed by 20+ partners including Visa, Mastercard, American Express, and Stripe.

🔹 GAP is the first major fashion brand all-in, because as their CTO put it, "it's not just keyword search anymore — it's conversations."

🔹 Still pursuing in-line checkout. Has the loyalty and multi-cart infrastructure to back it up.

The bottom line: This isn't winner-take-all and we definitely do not have an answer yet. The result is likely a negotiated ecosystem where retailers participate in agent-driven discovery but insist on directing the transaction back into their own environments.

Your checkout is still your superpower. Don't give it away.

The Villain Has Entered the Building

Here's the uncomfortable truth behind all this excitement: the agents powering agentic commerce are also your organization's most unsecured actors. Every superhero story needs a villain and this one is already inside your walls.

I covered this in depth on today's webinar with Okta's David Januchowski. The highlights:

🔹 The non-human insider threat is real. Agents are trying to be helpful. The problem is most orgs haven't implemented a least-privileged approach so agents may be accessing data and taking actions nobody explicitly authorized. Add an (unintentional) bad actor and you have a serious exposure.

🔹 Shadow AI is already in your building. Employees are deploying agents the security team doesn't know exist. Great intentions. Potentially catastrophic data hygiene.

🔹 Proprietary data doesn't stay proprietary by accident. Put client or customer data into a public AI tool without governance and it may as well be a press release.

🔹 Identity is a security strategy. Agents need clear lines around what they can and cannot access.

Every Hero Needs an Origin Protocol

What to actually do about it:

✅ Govern before you scale. Encourage agent use, but not without guardrails. Agents should operate within defined lanes, not freelance across your entire tech stack.

✅ Make identity your superpower. Every agent interaction (human or non-human) should have clear authorization context. Who or what is accessing what, and are they authorized?

✅ Invest in AI literacy across the org. Responsible use is cultural muscle. Everyone from the merchant team to the CFO needs to understand what they're handing an agent and what happens to that data next.

With great power comes great responsibility. (Yes, I just quoted Spider-Man in a retail newsletter. I regret nothing.)

On the House

The agentic commerce race is being covered like a horse race — who's ahead, who stumbled, who's out. That framing misses the point.

This isn't a sprint. It's infrastructure. The retailers building catalog fluency, clean data, and brand context that agents can actually use right now are the ones who will win when the checkout layer fully matures.

The only wrong move is waiting for someone to hand you a cape.

The Last Look

Identity is the foundation. Clean data is the foundation. Organizational readiness is the foundation. The rest is just the interface changing.

And if you want to go deeper on all of the above... today's your day. 👇

"Securing the AI Agents that Power the Future of Retail" 🕑 Today at 2pm ET | Retail Dive Webinar with Jackie Swanson & David Januchowski, Okta

👉 [Register / Watch here: Securing the AI Agents that Power the Future of Retail]

More to come in the Shelf Life series. Jackie Swanson is a Managing Partner at Gartner Consulting, where she advises retailers and consumer brands on AI-readiness, agentic commerce strategy, and large-scale transformation. She lives in New York with her husband and three children, which is either great preparation for managing complex client engagements, or the other way around.

📩 Ready to talk about what agentic commerce means for your organization? [Book a 1:1 with Jackie → jackie.swanson@gartner.com]

Follow Shelf Life on LinkedIn | Substack | Instagram @ShelfLifebyJKS.

#ShelfLife #AgenticCommerce #AIinRetail #Cybersecurity #RetailStrategy #DigitalCommerce #AEO #FutureOfCommerce #GartnerConsulting