On October 20 PaymentsJournal ran a piece under the headline "Agentic Commerce Is Still Hype Ahead of Reality." It draws on an August report by Christopher Miller, lead emerging-payments analyst at Javelin Strategy & Research, called Payments Partners With AI: Incumbents Have an Advantage. Miller's line is that the maturity of agent protocols "is comparable to that of Gopher," the early-1990s file system that needed steps to get anywhere, that even optimistic 2030 forecasts give agents a small share of transaction value, and that merchants still have time before they must decide anything.

His closing sentence is the one worth keeping: "anybody who tells you that we don't is trying to sell you something. Probably their agentic commerce tool."

I agree with most of it. I have spent a year sorting the announcements by what shipped and the record is thinner than the press releases. But "hype ahead of reality" is one phrase for three different conditions, and the data from the last five weeks lets me separate them. One layer of agentic commerce is real and measured. One is real and paid for. One is empty. Calling the whole thing hype hides which is which.

Settlement by agents is real and tiny. Discovery by agents is real and already sold. Authorization, the layer where a merchant decides to let an agent in, is the one with nothing in it. That is the gap, and it has a shape.

The layer that is real: machines paying machines, in cents

Start with the numbers Miller's piece does not use. On October 14 Chainalysis published its North America report with a section on x402, the HTTP payment protocol agents use to pay for services. By the end of its Q3 2026 window, more than 138 million x402 transactions had settled on Base, up from about 1,500 in mid-2025. Over 87 percent were between a hundredth of a cent and a dime. In late 2025 a wallet was 73 days old, at the median, when it made its first x402 payment. By Q3 2026 that was 18 minutes.

Those are not hype numbers. They are also not commerce as a payments analyst means the word. In September TRM Labs examined 198.9 million x402 settlements worth $52.7 million across three chains, stripped out self-payments and flows from one or two payers, and estimated that between 0.6 and 7.5 percent of what remained was spending by an agent rather than by a script. TRM's own caveat is that a single-purpose agent paying one service on a schedule looks exactly like a script, so the floor may be low.

So the settlement layer works, at machine speed, for machine purchases, in sums that would not cover a card fee. When I added an AI-run seller to my x402 tracker in October, it had 51 settlements and no customers, and said so. That is what reality looks like on this layer: live rails, honest volumes, almost no one buying a thing a person would recognize as shopping.

The layer that is real and already sold: discovery

Miller says that for merchants "agentic commerce is not even really about payment." Correct, and the reason is that the part that touches merchants has already happened, and it was not a payment. It was a search.

Shopping with AI is mainstream. In my ledger of what shipped, PYMNTS Intelligence found 56 percent of US consumers would let an AI search and compare for them, Shopify reported AI-driven traffic and orders each tripling year on year, and Adobe measured a 693 percent rise in AI-referred retail traffic over the 2025 holidays. The day after Miller's piece ran, OpenAI said more than 100,000 advertisers have bought placements inside ChatGPT conversations. Discovery has a shelf, the shelf is inside the chat, and it has a price.

That is the opposite of Gopher. Gopher never sold a slot.

The layer that is empty: the merchant's door

Now the part where Miller and I meet. Every Saturday my scanner asks 92 of the largest US storefronts whether an AI agent may come in. The run of November 7 found 26 of 92 withholding their robots.txt from a self-identified agent, 19 of the 66 readable files naming any AI agent at all, 16 publishing an llms.txt, five publishing a commerce profile, and one, AT&T, publishing an agent card. Eighty-nine of the 92 gave the same answer as the week before. Three weeks earlier the count of closed doors was 31. It moves by one or two stores a week.

Simon Taylor put the demand side plainly in May: "I can't find evidence that customers are adopting this en masse." His evidence was Walmart. Instant checkout inside ChatGPT converted at a third of Walmart's normal click-out rate, and only recovered, to about 70 percent of the direct-site rate, when the checkout stayed with Walmart. His conclusion: "AI by the merchant can work. AI by the aggregator doesn't yet."

Put the three layers of the MM Trust Layer Model side by side. Settlement trust: built, and busy with cents. Discovery trust: built, and monetized. Authorization trust, the layer where a merchant can tell a customer's agent from a scraper and decide what it may do: a door that 26 of 92 big retailers keep shut, and that 89 of 92 have not touched in a week. The hype is not ahead of reality across the board. It is ahead on exactly one layer, and that layer is the merchant's to fill.

Where Miller is right, and where "time" runs out

Miller is right that incumbents will carry most of this into regulated finance, and right that a merchant does not need to rebuild checkout this quarter. The ledger agrees: nine things live, four pilots, six specifications, one withdrawal, and the withdrawal was the one with the most merchants attached. Anyone selling urgency is selling a tool.

He is wrong that the gap is maturity. Gopher was replaced by a better protocol. The authorization layer is not waiting for a better protocol. There are at least six drafts in my tracker. It is waiting for a merchant decision, and the decision is being made by default, by a bot-management vendor's setting, at 26 of the 92 biggest stores in the country. That is not immaturity. That is nobody at the desk.

So the advice I would give a merchant is narrower than "you have time." You have time on payment. You do not have time on the door, because the door is already answering for you, and the answer is a 403. Publish what an agent may do, in a file agents read, and keep the payment on your own page until you have an answer for who is at the door. AT&T did that in five files. The other 91 have not.

If the rails are busy and the shelf is sold, who is supposed to open the door, and what are they waiting to see before they do?

Charlie Major is a Product Development Manager at Mastercard. The views and opinions expressed in Major Matters are his own and do not represent those of Mastercard.