AI agents can already browse, compare, recommend, and negotiate. In fact, according to a Deloitte study, retailers are already seeing 15-20% of referral traffic coming from AI chat interfaces. And soon, they won’t just be referring traffic, but they’ll actually be the ones spending money, at scale.
But before this can happen, agent actions have to be identifiable and accountable.
Someone has to build the infrastructure to make that possible.
Payment networks are a preview of what agentic AI in commerce will need because they’ve already solved versions of these problems once at global scale. As Greg Ulrich, Mastercard’s Chief AI and Data Officer, put it to me: “We have an ability to manage these systems with trust and responsibility that’s been proven over decades.”
I sat down with Greg the other week to explore what has to exist before AI agents can safely spend money, what Mastercard is doing to prepare for that, and what Greg is most bullish about for agentic commerce.
A Means to an End
Payments are much more than just the movement of money. They are identity, authorization, fraud detection, merchant trust, consumer protection, dispute resolution, compliance, and auditability. Mastercard has spent decades developing and supporting this environment.
“Data and AI are really at the foundation of a lot of what we’re doing today, and it has been for a while,” Greg told me. Mastercard sits in the ecosystem as a network provider and payment infrastructure company. “The transmission of data, the use of AI in that transaction, has been fundamental to what we’ve been doing for decades.”
Notably, AI is not a standalone strategy for Mastercard. It is embedded into how they grow payments, build services, and run their own operations. “It is still a key enabler of our strategy,” he told me. “It’s a means to an end, in my mind, as opposed to an end in and of itself.”
Greg organizes Mastercard’s AI strategy into four layers:
The foundational layer
The value AI creates for Mastercard’s own people
The value AI creates for Mastercard’s customers
The role Mastercard plays in shaping the broader ecosystem.
Each of these layers has the same goal, which is to make AI more capable and more trusted. Ultimately, Mastercard sees its role as helping build the infrastructure that makes AI trustworthy at scale.
Importantly, for Greg, AI capability isn’t the binding constraint. As AI becomes more capable, he believes the limit will be what people, businesses, and institutions are willing to let it do on their behalf. “How does AI work securely, responsibly and at scale for the entire ecosystem?” he said. “And how do we enable that? How do we bring in the data, the trust and the role we play to be a unique and positive force in that?”
Trusted intent to scale agentic commerce
Today, Mastercard lets consumers, merchants, acquirers, and issuers transact with trust and zero friction. Agentic commerce introduces a fifth actor.
“When you add in a new party, like the agent, how do we envision that ecosystem? How do we enable that ecosystem? How do we make sure we can identify the agents and make sure that that is a known transaction? How do we understand the intent of the consumer when you’re purchasing something so we can track it along this ecosystem to make sure that the product you have is what you asked the agent for?” Greg told me.
“In digital commerce, intent is implicit: I click buy, and the click is the intent,” he said. “Intent and action are bundled together. But in agentic commerce, they separate. Intent is an artifact that needs to be captured and verified, and potentially disputed.”
This opens up questions that didn’t exist a year ago around agent identity, delegated authority, fraud scoring for agent actions, consent sharing. Taken together, they point towards needing to extend the trust that already exists in digital commerce such that machines and agents can now operate in the system we’ve already built for people, businesses, and merchants.
Mastercard is building the standards and infrastructure to make this possible. One example Greg mentioned is Verifiable Intent, a standards-based trust paradigm for agentic commerce co-developed with Google. It’s a standard for safely passing information through the ecosystem so that a user’s intent can be captured, executed correctly, and traced if it isn’t.
Greg also described the importance they place on working with tech leaders, industry standards bodies, and customers in order to “build a system that’s going to work for all parties.” The ecosystem role, as he framed it, is about helping define standards, policies, and “the right balance between innovation and responsibility.”
The foundations for trust at scale
A standard is only as good as the infrastructure that enforces it. “This starts below the product surface,” Greg told me. You now need to verify delegated authority instead of just authenticating credentials.
For Mastercard, this is the foundation of trust and it comes from five connected capabilities:
Identity to know who is acting
Intent to prove what was authorized
Controls to define what an agent can do
Trusted execution to protect and govern transactions
Intelligence to assess risk and detect fraud
None of these are products. They’re requirements, and meeting them at scale takes three things Mastercard is building.
A harness. “We need standards, we need governance, we need compliance, we need observability,” Greg told me. Doing that bespoke for every AI deployment is untenable, so Mastercard is building what Greg calls an agentic factory: “Building an entire harness for all of that, which embeds all of our principles. That’s the operating system, if you will, for the agents.” As I’ve written about previously here and here, the differentiation is not so much in the model as it is in the harness around the model.
Data as a governed asset. Mastercard has spent the last 18 months building what it calls its Data Commercialization Platform to “bring the data together, to democratize it, to have gold data products available to the enterprise, to have the right controls,” he said, adding: “It’s not just transaction data. It’s how we leverage all the data assets that we have with the right controls, the right governance, and the right linkages.” Those foundations become even more important in an agentic world, where agents will increasingly need access to trusted data and clear permissions.
A foundation model for transactions. The most technically distinctive thing Mastercard is building is what Greg calls a Large Tabular Model, “the equivalent of an LLM, but for transaction or tabular data. It’s a model on the data that we have that helps predict behavior and helps understand entities more effectively.” It’s built on 15 billion transactions, with a much larger version coming.
In Mastercard’s view, trust at scale is built not through a single product or model, but through the infrastructure that governs how agents operate.
The customer-facing work of trusted AI
On top of these foundations, Greg characterizes Mastercard’s customer-facing AI work into three key areas: making commerce safer, making customers smarter, and enabling more personalized experiences. Each component is connected to a piece of infrastructure agents will need.
Real-time trust scoring. “We’re going to provide a score on that transaction about how likely it is to be fraudulent or legitimate,” Greg said. “It’s not about adding friction to the ecosystem. It’s about making it more seamless.” Decision Intelligence Pro, Mastercard’s real-time transaction scoring product, is one example. Greg also mentioned Mastercard’s Safety Net solution, which looks for malicious actors throughout the ecosystem, in addition to Mastercard’s acquisition of Recorded Future, a threat intelligence company that uses AI, analytics and data to help organizations identify, prioritize and respond to cyber threats before they become attacks. Every agentic system will eventually need a real-time trust score on actions and intent, not just transactions. Fraud scoring is the mature template of this.
Static to dynamic insights. “A lot of things that we used to provide in a static format are now much more dynamic,” Greg said. “We’re bringing in more data and intelligence because of what the technology allows, but also making it a lot easier to use by putting an AI interface on top that lets customers find their room for optimization, learn about their portfolio, and get better insights.” Rather than a static report, the deliverable is the interface that lets customers dynamically pull insights.
Consent that travels. Greg continued: “For an agent to be able to recommend or negotiate or buy on your behalf, it needs your data. It needs to know your preferences, your purchase history and payment credentials. And then that data needs to move from you to your agent, and then from your agent to merchants and payment networks. As that data moves, your consent needs to move with it. Infrastructure is thus needed to transmit and honor those permissions across handoffs, as well as to decide who bears liability when data gets used beyond what you consented to.”
Owning the layer that differentiates
Mastercard recognizes that no single company will build the AI future alone, and instead, success will come from orchestrating a trusted ecosystem of model providers, cloud platforms, data partners and innovators, while contributing the security, governance, observability and proprietary intelligence that makes AI safe and effective at scale. Mastercard’s role is not to build every agent or model, but to help define and operate the trust layer that allows agentic commerce to function across parties, platforms and markets and allows customers to scale AI across their enterprises.
Exponential models, linear humans
At this point, the gap between what’s possible with AI and what’s actually happening within large enterprises is less about technology and more about adoption. As Greg puts it, “The quality of the models continue to go up at this exponential rate, but people’s ability to consume this and change the way they’re operating is going at a linear pace.”
For Mastercard, closing the gap has required more than just granting access to AI tools. Mastercard has helped employees develop new ways of working so that AI is now embedded into everyday workflows across the business. Engineers were among the earliest users, but Mastercard quickly realized that AI is most effective when it supports the entire product development lifecycle and broader enterprise processes.
Mastercard sees AI as a force multiplier that helps accelerate innovation and deliver better outcomes for customers. The goal isn’t just around efficiency, but instead to enable the organization to scale expertise and bring new capabilities to market more quickly.
Trust that can scale global commerce
At the end of our conversation, I asked Greg what excites him most about the next phase of AI in payments and commerce. “I think it’s around scale in a trusted way,” he said. Most of what’s happening in agentic commerce right now, even at the pace it’s taken off, “is people experimenting and seeing how it works.”
Whether cause or effect, consumers remain reluctant to transact through agents. In Accenture’s 2026 survey of more than 25,000 people across 16 countries, 74% said they’d let an agent handle routine tasks, but only 9% are open to letting one shop autonomously on their behalf. People are ready for agents that recommend, but they’re not ready for agents that pay.
We’ve seen this dynamic before. In a 1995 Pew Research report, only 8% of internet users had bought anything online in the previous month. Today 84.3% of the US population shops online at least once per year. What closed the trust gap was infrastructure: fraud scoring, zero liability, dispute rights.
Mastercard has built this kind of infrastructure for previous evolutions in commerce and is positioned to build it again. “We have a fundamental role to play in agentic commerce by building the trust infrastructure that allows agents to transact safely and at scale given where we sit in this ecosystem,” Greg told me.
He continued: “I believe agentic commerce will follow a similar arc as e-commerce: first a trust gap, then infrastructure, then adoption. The difference will be the speed of that arc. Agentic commerce will proliferate much faster in large part because the institutions that closed the last trust gap are already building for this one.” What comes next, as Greg sees it, is enterprise adoption and scale with trust, as he put it, “at the heart of everything.”
Author’s note: An LLM was used for light copy editing only (spelling, grammar, and clarity). Content, meaning, tone, and structure remain unchanged.