How Agent-Driven Commerce Is Reshaping Risk: Inside Akamai’s New Framework and the Next Era of Digital Retail and Finance
Explore how agent-driven commerce and Akamai’s Agentic Security Framework deliver trusted AI agent transactions, real-time risk controls, and revenue models for digital retail and finance.
The advent of agent-driven commerce is forcing directors and executives in retail and finance to completely reimagine operational risk, compliance, and fraud management. Catalyzed by the June 2026 launch of Akamai’s Agentic Security Framework, developed in partnership with Visa, Experian, Skyfire, and TollBit, this moment marks a clear pivot from episodic mitigation projects to continuous, intelligence-driven risk operations. As AI agents increasingly handle a major share of transactions - widely cited vendor figures claim about 20 percent of online retail, with over 90 percent of large retailers preparing for agent flows - compliance now demands always-on, unified strategies aligned with both security and monetization imperatives. This article unpacks the new six-pillar framework, the unique contributions of each partner, and the urgent, outstanding questions for regulatory and risk intelligence leaders as AI agent transactions redefine digital commerce.
TRANSFORM INNOVATION INTO MEASURABLE ROI-BOOK TIME WITH OUR CEO 
BOOK TIME WITH OUR CEO
From Episodic Controls to Always-On Risk Operations: The Agent-Driven Commerce Shift
For years, retailers and financial institutions have relied on periodic bot mitigation campaigns, point-in-time audits, and project-driven fraud controls. However, the proliferation of AI-driven automated agents has upended this model. Machine-initiated flows are now always-on, with transactions, account interactions, and data requests occurring around the clock and far beyond traditional operational perimeters. This persistent automation is rapidly eroding the boundaries that previously defined enterprises' digital risk management strategies.
Vendor and industry accounts, echoed broadly across the press and partner statements, suggest that as of mid-2026, agent-initiated commerce already represents about 20 percent of all online retail transactions, and over 90 percent of large retailers are either piloting or preparing to process agent-driven transactions at scale. These figures, urgent as they may appear, are based solely on vendor and ecosystem reporting and have yet to be validated by independent analysts or third-party market research. Nevertheless, the underlying trend - that agent-mediated transactions are rendering episodic project controls obsolete - has broad consensus in both strategic and technical commentary. The consequence is a decaying operational perimeter: as the volume and complexity of agent flows rise, the need for persistent, real-time risk intelligence becomes not only a technical obligation but a board-level mandate 
This environment demands that organizations no longer think of compliance, fraud detection, and monetization as isolated projects. Instead, they must embrace an integrated approach - powered by continuous threat assessment, dynamic controls, and collaborative standards - that can distinguish between human, legitimate agent, and malicious automation in every moment of commerce.
Akamai’s Agentic Security Framework: Six Pillars, Core Architecture, and Partner Differentiation
Recognizing these demands, Akamai’s Agentic Security Framework delivers a holistic, operationalized defense model designed to address the realities of agent-driven commerce. Developed directly with Visa, Experian, Skyfire, and TollBit, its architecture is anchored in six functional pillars, each mapping to a critical operational, compliance, or monetization requirement.
Verified Agent Identity
Central to the framework is the principle of "Know Your Agent" (KYA), a new standard for persistent machine identity in digital retail and financial operations. In partnership with Visa and Experian, Akamai has developed machine authentication protocols and real-time verification rails to separate legitimate, authorized AI agents from unauthorized or malicious automation. These standards use unique agent fingerprints and network-level identity proofing - enabling enterprises to attribute every agent flow with strong confidence and fulfilling both security and regulatory demands 
Adaptive Trust Analysis
Recognizing that an agent’s legitimacy is contextual and dynamic, adaptive trust analysis is built into the framework. Machine learning algorithms monitor behavior, transaction context, network risk signals, and historical patterns in real time, enabling systems to update risk profiles continuously and dynamically restrict or permit agent actions. This approach provides granular resilience in the face of sophisticated adversaries targeting digital retail and finance 
User-Centric Authentication
To meet audit and compliance demands, every action taken by an agent is anchored to a verified end-user. By integrating Visa’s payment verification rails and Experian’s identity assurance, the framework ensures that every transaction - regardless of whether it is machine- or human-initiated - can be traced directly to an accountable, validated party. This mitigates the risk of synthetic identities or credential abuse and supports comprehensive regulatory reporting.
Edge-Based Enforcement
Given the speed and volume of agent-driven commerce, policy enforcement at the edge is a technical necessity. The framework pushes risk, trust, and compliance decisions as close to the transaction source as possible, minimizing latency and ensuring that only trusted agents - whether shopping bots or payment facilitators - can complete critical operations. This distributed enforcement model reduces the attack surface while maintaining the performance expectations of modern commerce 
Operational Visibility
Real-time operational insight makes regulatory intelligence feasible. Akamai provides complete visibility into all forms of digital traffic: human, authorized agent, and hostile automated flows. By centralizing telemetry and supporting granular behavioral analytics, the framework empowers leaders to respond instantly to emerging threats or compliance gaps while generating actionable intelligence for ongoing optimization 
Content Monetization
Beyond security, the Agentic framework turns compliance into a revenue opportunity. Content publishers and retailers can define granular, tokenized, pay-per-request rules for legitimate agent access. Through TollBit and Skyfire integrations, machine-initiated traffic is not only controlled but monetized, fueling new business models while enforcing permission and pricing at the API level 
Partner Contributions
Each ecosystem partner plays a distinct, operationally differentiated role:
Visa’s contribution centers on embedding KYA protocols into payment flows, leveraging existing financial trust rails to anchor every AI agent transaction with strong authentication and regulatory-grade verification. Experian extends this trust model to the identity and behavioral layer, providing always-on agent verification and risk scoring - ensuring that only authorized digital entities can access sensitive consumer or financial data LinkedIn FinancialIT: Experian Expands Agent Trust Partner Ecosystem.
TRANSFORM INNOVATION INTO MEASURABLE ROI-BOOK TIME WITH OUR CEO BOOK TIME WITH OUR CEO
Skyfire, meanwhile, overlays compliance-aligned content delivery, enabling real-time permissioning, while TollBit’s technology powers tokenized, pay-per-request monetization - granting granular, enforceable access controls for publishers and data owners. These monetization overlays have moved from vendor whitepapers to early ecosystem pilots, where publishers can align revenue directly to verified machine traffic
Notably, high-profile collaborations, including Visa and Experian’s joint KYA pilots and TollBit-driven monetization overlays, demonstrate how this multi-partner approach brings both operational security and new commercial value to the forefront. However, technical integration specifics, deep adoption data, and pilot outcomes largely remain proprietary within the ecosystem.
Adoption Metrics, Persistent Risk, and Open Challenges
While the vendor-cited adoption rates - AI agents performing 20 percent of online retail and over 90 percent of major retailers preparing for agent flows - are cited across press releases, partner channels, and market coverage, there is no independent analyst survey or third-party market study publicly confirming these figures as of June 2026. The definitions of “agent flow” and the criteria for enterprise “preparation” remain opaque, highlighting the need for defensible, sector- and geography-specific measurement in guiding risk investment strategies
Accompanying the promise of always-on compliance and new monetization, the Agentic Security Framework brings forth significant, unresolved risk questions. Enterprises deploying these persistent machine identity and behavioral tracking protocols now face heightened privacy and data sovereignty exposures. Unlike intermittent user authentication, the new always-on model continuously associates every digital action to a specific agent and, by extension, to an end-user or organizational entity. Analyst commentary consistently highlights the lack of published technical mitigations, disclosures, or regulatory engagement focused on privacy-by-design, especially under increasingly strict regimes like GDPR and US privacy laws 
Equally concerning is the risk of ecosystem lock-in. The protocols underpinning KYA, adaptive trust, and monetization are largely proprietary to Akamai and its immediate partner ecosystem. Organizations with complex, heterogeneous tech stacks will find unresolved questions regarding integration with non-partner systems or established federated authentication structures. As of June 2026, no explicit regulatory guidance, such as from the FTC or EU digital authorities, has emerged to define best practices or interoperability standards for KYA, machine identity, or agent traffic management.
Perhaps most critically, public evidence of realized enterprise benefit - such as independently validated fraud reduction, demonstrable compliance lift, or measurable ROI - is currently lacking. All performance and impact claims remain grounded in vendor or partner assertions. No published, third-party peer-reviewed studies or regulatory audits have confirmed the scale, efficacy, or economic value of the Akamai framework as deployed across diverse enterprise environments.
Given these points, regulatory and risk intelligence leaders are advised to prioritize operational upgrades anchored in continuous, adaptive controls, agent-centric identity strategies, and integration models supporting multi-vendor ecosystems. They should also demand public transparency, advocate for industry-wide standards, and push for independent market validation of adoption and performance claims before committing to wholesale deployment.
Conclusion
The rapid ascent of agent-driven commerce marks a clear turning point for operational risk, compliance infrastructure, and digital monetization strategy. Akamai’s Agentic Security Framework, developed in concert with Visa, Experian, Skyfire, and TollBit, delivers an ambitious and highly integrated model rooted in six operational pillars aimed at differentiating legitimate agent flows, enabling continuous compliance, and opening new monetization channels. Yet, despite its technical and strategic depth, the framework’s full value remains unproven in several crucial areas.
Continuous risk intelligence, not episodic project work, is now the enterprise imperative. As boards and senior leaders reevaluate how risk, compliance, and monetization intersect in the age of AI agents, the challenge will be to embrace transparent, openly validated frameworks - grounded in privacy, interoperability, and regulatory clarity - over proprietary or vendor-exclusive controls. Until sector-wide standards emerge and independent outcome data is published, the promise of agentic security for enterprise value and trust remains an evolving, unresolved mandate.
Key Takeaways:
- The shift to agent-driven commerce requires organizations to replace project-based risk routines with always-on, real-time risk intelligence and compliance controls
- Akamai’s Agentic Security Framework, with core partnerships from Visa, Experian, Skyfire, and TollBit, introduces six pillars that unify identity, risk, compliance, and monetization at the operational layer
- Adoption statistics provided by vendors underscore urgency, but lack external, independent market validation as of June 2026
- Major risks - particularly around privacy, interoperability, and vendor lock-in - remain unresolved, with little public evidence of mitigation; no standards-based regulatory frameworks have yet emerged
- Strategic advantage will accrue to enterprises that build on transparent, validated frameworks emphasizing operational openness, regulatory alignment, and ecosystem resilience - not those relying on exclusivity or proprietary advantage.
The final measure of agentic security will rest on independently proven results and real regulatory endorsement - not just ambition or ecosystem scale.
TRANSFORM INNOVATION INTO MEASURABLE ROI-BOOK TIME WITH OUR CEO BOOK TIME WITH OUR CEO
FAQ:
What is agent-driven commerce and how does it differ from traditional e-commerce?
Agent-driven commerce refers to the use of autonomous AI agents that act on behalf of users—such as consumers or businesses—to research, compare, negotiate, and complete purchases. Unlike chatbots that simply recommend or answer questions, agentic commerce empowers these agents to execute transactions within pre-set guardrails, streamlining processes like retail shopping, travel booking, and B2B procurement without requiring manual intervention. Key stakeholders include retailers, payment providers, and platforms implementing new security, consent, and payment integration models Braze Guide
ACI Worldwide
Bloomreach.
How does Akamai’s Agentic Security Framework secure agent-driven commerce?
Akamai’s Agentic Security Framework unifies six pillars: verified agent identity (Know Your Agent/KYA), adaptive trust analysis, user-centric authentication, edge-based enforcement, operational visibility, and pay-per-request monetization. It enables organizations to distinguish and authenticate AI agents, assess and restrict their actions contextually, enforce controls at the edge for speed, and monetize legitimate agent traffic. The framework integrates directly with partner solutions from Visa, Experian, Skyfire, and TollBit, supporting real-time compliance and risk management in digital commerce 
What is Know Your Agent (KYA) in the Akamai framework, and how does it work?
Know Your Agent (KYA) is a protocol for verifying, attributing, and governing AI agent actions. KYA links each agent to a validated human or organization, checks the agent’s authorization to operate within defined permissions, and maintains a chain of accountability. It uses unique agent fingerprints, real-time behavioral monitoring, and can leverage digital credentials and signed transaction proofs. By anchoring every agent action back to a legitimate principal, KYA mitigates fraud and regulatory risks associated with automated transactions Experian Insights
Vouched.ID
Skyfire.
How do TollBit and Skyfire enable pay-per-request monetization for AI bot and agent traffic?
TollBit enables publishers to set pricing and access policies, detect bot/agent identity, and require payment for content/API access. Skyfire provides verified agent identity and integrated payment tokens, allowing publishers to approve access after payment. The combined flow detects agent traffic at the edge, verifies identity and authorization, and applies a pay-per-request or other usage-based pricing model, transforming AI access into metered, revenue-generating transactions 
What privacy and GDPR challenges does continuous machine identity tracking create?
Continuous machine identity tracking can process persistent agent identifiers and behavioral traces that may be considered personal data under GDPR. Risks include potential re-identification, profiling, excessive data processing, and consent management complexity. Organizations face requirements for lawful basis, data minimization, transparent consent, limited retention, and protection against automated decision-making abuses. Robust controls, privacy-by-design, and clear auditability are essential for compliance GDPR.eu
European Parliament Study
TrustArc.
Are there vendor lock-in risks with the Akamai Agentic Security Framework?
While Akamai describes its API Security and related offerings as vendor-neutral and not requiring the use of additional Akamai products, deploying the full Agentic Security Framework may introduce practical switching costs—such as dependencies on integration, data export formats, or proprietary enforcement infrastructure. Akamai advises customers to seek agility and avoid long-term lock-in by prioritizing open standards and multi-vendor compatibility 
Related Topics
AI Workflow Automation Raises the Stakes: Canals’ $35M Funding Signals a New Era for Outcome-Driven Manufacturing Ventures
Compliance-By-Design in Lending: How Regulation Built Into the Core is Redefining Digital Lending for 2025-2026