When software becomes the customer.

For twenty years, e-commerce security has turned on whether the buyer typing on the screen is a human being or a bot. That assumption is now being dismantled by the networks themselves. In April 2025, Mastercard unveiled Agent Pay; six months later, Visa introduced its Trusted Agent Protocol. The world's two dominant card schemes are building plumbing for a retail market in which the buyer knocking on a merchant's digital storefront is software acting on a human's behalf, part of a broader global race, from Silicon Valley to Shenzhen, to make autonomous agents transact. When the schemes rebuild checkout, every issuer and acquirer on the continent eventually inherits the consequences, whether or not it volunteered.

Card-network announcements generate plenty of buzz at Nairobi payments conferences, yet they offer no proof of everyday uptake by Kenyan households or merchants. Before a payments director opens the checkout lane to autonomous shopping agents, she has to solve an older commercial problem that cryptographic bot credentials leave untouched: proving what the customer actually authorised the software to buy, and deciding whose balance sheet absorbs the loss when the machine misreads a casual instruction.

Separating a casual conversation from a binding commercial mandate.

Think about how people delegate everyday errands. A professional in Westlands asks her digital assistant to find an affordable laptop for her university-bound niece. That single instruction leaves half a dozen contractual terms open. Does affordable mean KSh35,000 or KSh65,000? Does the quoted price include courier delivery to Eldoret? Is a refurbished import acceptable? Will the shop take the machine back if the battery dies in week two?

When a merchant accepts an order, it needs a firm contract: the stock-keeping unit, the exact shilling price, the delivery terms, and irrevocable payment authority. A conversational summary generated by an assistant is not a purchase order. For predictable repeat payments, banking already has cheap, reliable tools that need no artificial intelligence: a standing order that pays rent on the first of the month, an inventory rule that reorders printer paper when stock drops below ten reams at a pre-agreed price. Handing an open-ended shopping brief to a generative model introduces a different risk class entirely, because the very flexibility that lets an agent compare twenty merchant websites also lets it misread product specifications, or obey hidden instructions planted on an untrusted page.

Authenticating the identity while caging the spending authority.

Visa's protocol addresses the front-door identity problem: a merchant can verify that an incoming software agent belongs to a recognised provider rather than a credential-stuffing script. But knowing the courier's name does not tell the shopkeeper whether the courier has permission to empty the safe.

In 2024, security researchers released the AgentDojo benchmark to test how tool-using language-model agents behave when exposed to adversarial prompt injections tucked inside ordinary web pages and emails. Across those environments, agents repeatedly failed security checks and were hijacked by malicious text hidden inside external content. Now picture a Kenyan e-commerce site or classified listing carrying invisible text that instructs visiting shopping agents to ignore price caps or route payments to a fraudster's till number. The attack surface is not hypothetical; it is the open web the agent must browse to be useful.

To protect customers from their own software, banks and wallet issuers must separate identity authentication from spending power. A safe agent mandate works like a pre-loaded fuel voucher rather than a blank cheque: locked by hard rules inside the bank's core ledger to a single merchant category code, a strict shilling ceiling, a 24-hour expiry window and a one-tap kill switch. When a customer withdraws permission at 2.00 pm, that revocation must kill the payment token at the switch immediately, not send her off to email ten online shops to cancel pending orders.

Pricing the chargebacks before chasing the transaction volume.

Every player in an automated checkout chain wants the interchange, and nobody wants the dispute ticket. A single agent purchase can cross an external AI model provider, a mobile wallet, an issuing bank, a card scheme and a merchant acquirer. When the laptop arrives with the wrong specifications, and the buyer demands her KSh55,000 back, the dispute officer faces a tangle: unauthorised fraud, a software hallucination, or buyer's remorse over an approved purchase? Each answer assigns the loss to a different balance sheet, and the rulebooks that usually settle such questions have not been written.

Storing every customer's full private chat transcript indefinitely to fight chargebacks collides with data-minimisation rules under Kenya's Data Protection Act, 2019, whereas keeping only the final payment token leaves the bank unable to prove what the customer told the software to do. For a merchant, a wave of automated bot traffic can drive up cloud-hosting and stock-reservation bills while leaving negative margins once disputed returns and support calls are subtracted. Any 2027 pilot should stay restricted to a narrow, pre-authenticated merchant category with mandatory human tap-to-approve confirmation before money leaves the account, backed by live red-team tests and a six-month review of net profitable orders after refunds and chargebacks. Giving software the power to shop is pointless if the customer loses the power to stop the sale.