Buried in the developer sessions at WWDC 2026 was the detail that mattered most, and it had nothing to do with Siri. A developer can now swap the AI model powering their app, from Apple's own to Google's Gemini to Anthropic's Claude, by changing a single Swift Package Manager dependency. No rewrite. No new logic. One line in a manifest.

That is the sound of the model layer becoming a commodity. And when the model becomes a commodity, the value moves somewhere else. It moves up, to whoever orchestrates the models and the apps, and it moves down, to whoever can prove who an agent is acting for. Apple just made a decisive grab for the first. It left the second untouched.

The keynote story was a smarter Siri. The strategy story is that Apple stopped selling AI as a feature and started owning it as a surface.

What Apple actually did

Forget the assistant for a moment. Look at the architecture.

Apple turned its operating system into the execution surface for the agentic web. The new Foundation Models framework is a single native API for calling any model, opened to outside providers through a protocol that treats Gemini and Claude as interchangeable parts. App Intents and Siri Extensions turn installed apps into tools the system can call and chain. And Xcode now brings coding agents from Anthropic, Google, and OpenAI directly into the build, wired together over the Model Context Protocol.

This is the 2008 playbook, run one level higher. Back then Apple did not write the apps. It owned the store, the payments, and the rules. In 2026 Apple does not train the frontier model. It rents one from Google, reportedly for around $1 billion a year, and keeps the layer that decides which model runs, which app fires, and when. The company that spent a decade selling on-device silicon as its moat just rented the brain and kept the surface. That trade tells you exactly what Apple thinks is scarce.

For everyone building on the agentic web, the lesson is blunt. The model you pick is now a configuration choice. The surface you run on is a strategic one.

The password agent is a dress rehearsal

The most revealing announcement was dressed up as a security feature. Apple's Passwords app will now use Apple Intelligence and Safari to agentically navigate to each website, sign in, and replace weak credentials with strong ones, after a single tap, displayed as a Live Activity while it works.

Strip away the framing and look at what it is. An agent, dispatched by the operating system, performing authenticated, state-changing actions on infrastructure that does not belong to Apple. That is not password hygiene. That is agent-led checkout with the payment removed.

And it will mostly fail at launch, for the most instructive reason possible. The websites on the other side do not know the agent is Apple, do not know it is acting for the real account holder, and are engineered to stop precisely this behavior. The hard part, as security observers noted within hours, is multi-page logins, two-factor prompts, and CAPTCHAs. The agent reaches the door. It cannot prove it belongs there.

Owning the execution surface gets the agent to the merchant's door. It does nothing to make the merchant open it.

The layer Apple left on the table

Here is the part that should concentrate minds in payments. Apple built the agent, the surface it runs on, and even the identity root beneath it, through mandatory device-level child accounts and age assurance that move verification from the app into the operating system. What Apple did not build is the credential that the rest of the web needs in order to trust that agent at the moment it acts.

That credential is not an operating system feature. It is a network function. It looks like a verifiable token that says: this agent is acting on behalf of this authenticated user, within these limits, and here is the cryptographic proof. As we mapped in our analysis of the agentic commerce standards race, this is the layer Mastercard, Visa, and a stack of protocol authors have been racing to define for over a year.

WWDC just validated the entire thesis. The platform that controls the most valuable agentic surface on earth shipped an agent that cannot transact on third-party sites, because trust at the action boundary is missing. The networks exist to supply exactly that. The question is whether they ship it before the surface owners define trust by omission and route around them.

Who wins, who loses

Apple wins the orchestration layer and the identity root. That is an enormous position, and developers will feel it as gravity: implement App Intents or become invisible to the agent, adopt the Foundation Models surface or build outside the system.

Merchants face a new and uncomfortable visitor. An agent will increasingly arrive at checkout claiming to act for a customer, and the merchant will have no native way to tell a legitimate delegated agent from a bot. Friction goes up or fraud goes up, unless someone supplies the proof in between.

Payments networks have the clearest opening and the shortest runway. They already issue trusted credentials at scale and already sit at the trust boundary of every transaction. If they extend that to agents, with verifiable intent and delegated authority that a merchant can check in milliseconds, they become indispensable to the agentic surface Apple just built. If they hesitate, the surface owners will improvise something narrower, and the networks will spend the next decade integrating into someone else's rails instead of owning their own.

What to watch

Watch whether Apple exposes any agent attestation that a third party can verify, or whether its agents stay anonymous at the door. Watch the completion rate when the Passwords agent ships with iOS 27, because that number is a live readout of how much the web currently trusts an OS-resident agent. And watch whether a network announces a verifiable-agent credential this year. The execution surface is spoken for. The trust layer is still, for now, anyone's to take.

Sources

If the operating system owns the agent and the network owns the trust, who owns the customer?

Charlie Major is a Product Development Manager at Mastercard. The views and opinions expressed in Major Matters are his own and do not represent those of Mastercard.