Digital Identity Question Grows as AI Agents Make Purchases

As artificial intelligence agents move beyond offering advice to making purchases and bookings, a new question is emerging: how can a service verify that an agent has permission to act on a user’s behalf?

The shift turns a recommendation into an action with potential financial consequences. Finding a product or suggesting a reservation is different from committing a person’s money or confirming a booking in their name.

Digital identity is central to that distinction. Identifying an AI agent, however, is not the same as establishing what it is authorised to do. A seller would also need a way to verify the scope of the user’s permission.

That permission could distinguish between searching for options and completing a transaction. Without a clear boundary, services face uncertainty over whether an automated request reflects a user’s actual instructions.

The challenge is therefore not simply proving who—or what—is making the request. It is ensuring that an AI agent’s ability to carry out a purchase does not become a substitute for the user’s consent.