# Agentic Rails Atlas > Research atlas of eight agent identity, checkout and payment protocols (ERC-8004, x402, Visa TAP, ACP, UCP, MPP, AP2, Mastercard Agent Pay): sourced claims, diagrams, security and controls, by merces.ai. Published by merces.ai (https://merces.ai), the controls platform for agentic transactions. Built 2026-10-15. Every factual statement on the site is a claim with a source record and a confidence level (verified, reported or unverified); numbers carry an "as of" date. Each protocol page has twenty sections: summary and key facts, a detailed explanation in four reading modes (plain language, practitioner, spec-deep and Simplified Technical English), diagrams and an interactive flow player, personas, resources, verified publications, a security threat model, a controls lens, compliance, an observability lens, ecosystem and costs, timeline, code, a browser-only playground simulation, comparison with the other seven protocols, FAQ, open questions and a self-test. When citing, link to the page URL and quote the "as of" date shown with any number. Content is not legal, financial or security advice. ## Protocol pages - [ERC-8004: Trustless Agents](https://atlas.merces.ai/p/erc-8004/): A Draft Ethereum standard that gives AI agents a portable on-chain identity (an ERC-721 token that points to a registration file) and a public feedback log. A third registry for independent validation is specified but not officially deployed. It moves no money, which is why it is often paired with x402. (last verified 2026-10-11) - [x402](https://atlas.merces.ai/p/x402/): An open protocol that turns HTTP 402 Payment Required into a working pay-per-request flow. The server quotes a price, the client signs a payment, and a facilitator verifies and settles it, most often in USDC. Originated at Coinbase and governed since 2026 by the x402 Foundation, a Linux Foundation project. (last verified 2026-10-11) - [Visa Trusted Agent Protocol](https://atlas.merces.ai/p/visa-tap/): A Visa specification that lets a merchant's site tell an approved AI agent from an unknown bot. The agent signs each web request with RFC 9421 HTTP Message Signatures, tagged for browsing or for paying, and can attach signed consumer and payment objects at checkout. Built with Cloudflare as part of Visa Intelligent Commerce, it identifies agents and moves no money by itself. (last verified 2026-10-11) - [Agentic Commerce Protocol (ACP)](https://atlas.merces.ai/p/openai-acp/): The Agentic Commerce Protocol, from OpenAI and Stripe, defines how an AI surface runs checkout against a merchant's own REST API and passes a scoped, single-use payment token. It launched with ChatGPT Instant Checkout on 2025-09-29. Since March 2026 ChatGPT uses it mainly for product feeds and discovery, with checkout on the merchant's side. (last verified 2026-10-11) - [UCP](https://atlas.merces.ai/p/ucp/): The Universal Commerce Protocol lets any agent read a store's published profile, agree on the capabilities both sides support, and run checkout, cart and orders over REST, MCP, A2A or an embedded UI. The store stays merchant of record and payments arrive as opaque tokens. Google launched it with Shopify and others in 2026, and it powers checkout in AI Mode and Gemini. (last verified 2026-10-11) - [Stripe MPP (Machine Payments Protocol)](https://atlas.merces.ai/p/stripe-mpp/): The Machine Payments Protocol, co-authored by Tempo and Stripe, adds a Payment authentication scheme to HTTP 402. A server issues a challenge, the client pays through a named method and retries with a credential, and the server returns a receipt. Charges and subscriptions are specified intents; metered sessions are defined per method. Rails include Tempo stablecoins, Stripe Shared Payment Tokens, Visa network tokens and Lightning. (last verified 2026-10-11) - [AP2](https://atlas.merces.ai/p/ap2/): Signed mandates that prove what a user authorized an agent to buy. Version 0.2 has Checkout and Payment Mandates, each closed (exact values) or open (constraints). Created at Google, donated to the FIDO Alliance on 2026-04-28, and carried inside UCP as an extension; live use is unverified. (last verified 2026-10-11) - [Mastercard Agent Pay](https://atlas.merces.ai/p/mastercard-agent-pay/): Mastercard's proprietary program for agent payments. Registered agents get agentic tokens built on Mastercard tokenization and limited by the consumer, and merchants recognize those agents from signed web requests. Verifiable Intent, a separate open specification, adds signed proof of what the user approved. Named transactions so far are pilots or first transactions. (last verified 2026-10-11) ## Cross-cutting pages - [Compare](https://atlas.merces.ai/compare/): the eight protocols on 34 dimensions, each cell with a value, confidence and sources. - [Stack](https://atlas.merces.ai/stack/): where each protocol sits, from discovery to reputation. - [Controls](https://atlas.merces.ai/controls/): fourteen controls (consent, caps, scoping, expiry, revocation, step-up, replay protection, receipts, disputes, reputation, monitoring, kill switch) and how much each protocol provides natively. - [Scenarios](https://atlas.merces.ai/scenarios/): eight end-to-end walkthroughs across protocols. - [Timeline](https://atlas.merces.ai/timeline/): every dated event, with lanes for standards, policy, market and prehistory. - [Glossary](https://atlas.merces.ai/glossary/): 200+ terms with plain and Simplified Technical English definitions. - [Library](https://atlas.merces.ai/library/): specifications, SDKs, talks and verified research papers, exportable as BibTeX, RIS and CSV. - [Orbit](https://atlas.merces.ai/orbit/): related standards and programs. - [Personas](https://atlas.merces.ai/personas/): each protocol from nineteen seats, from the delegating consumer to the agent itself. - [Methodology](https://atlas.merces.ai/methodology/): sources policy, verification method, claim counts by confidence, known gaps and errata. - [What's new](https://atlas.merces.ai/whats-new/): spec repository activity and events from the last 90 days. ## Scenarios - [An agent buys one API call](https://atlas.merces.ai/scenarios/agent-buys-one-api-call/): A client agent finds a paid weather endpoint through the x402 Bazaar or an ERC-8004 registration, pays for one call with x402 V2 exact, and leaves ERC-8004 feedback whose proof of payment sits in an off-chain file. - [Metered inference](https://atlas.merces.ai/scenarios/metered-inference/): An agent streams tokens from an inference API and pays per unit through an MPP session on Tempo, with a deposit, off-chain vouchers, a top-up and a cooperative close; the forced close is the fallback. Compared with x402 upto and batch-settlement. - [A shopper buys running shoes in Gemini](https://atlas.merces.ai/scenarios/shopper-in-gemini/): A shopper asks Gemini for running shoes. UCP handles discovery, checkout, the Google Pay handler and signed order webhooks; an AP2 checkout mandate with the human present is shown as the specification describes it, with live use unverified. Google Pay on Google surfaces uses only PAN_ONLY. - [Autonomous restock while the user is away](https://atlas.merces.ai/scenarios/autonomous-restock/): A cafe owner signs AP2 v0.2 open mandates with allowed merchants, a per-order cap, a weekly recurrence and a total budget. While the owner is away the agent closes them with its own key, three verifiers check the bindings, and signed receipts come back. Specified only; production use is unverified. - [An agent shops on a merchant website with a Visa card](https://atlas.merces.ai/scenarios/agent-shops-with-visa-card/): An agent browses a merchant site with TAP agent-browser-auth signatures, gets a passkey-approved Payment Instruction and an agent-specific token from Visa Intelligent Commerce, then checks out with an agent-payer-auth signature and the agenticConsumer and agenticPaymentContainer objects. A CDN verifies the signatures at the edge. Visa's public key directory held only an RSA sandbox key on 2026-10-11, and the specification's examples cannot verify. - [From ChatGPT discovery to merchant checkout](https://atlas.merces.ai/scenarios/chatgpt-discovery-to-checkout/): A merchant pushes an ACP product feed and a shopper finds the item in ChatGPT, then opens the merchant's ChatGPT app. Most purchases finish on the merchant's own checkout, which is generally available. Select marketplace partners can use the ChatGPT payment sheet, a private beta; only PCI DSS Level 1 merchants that want raw card data implement ACP Delegate Payment with an allowance. Instant Checkout's 2025 form appears as history only. - [A Mastercard Virtual Card Token in an existing checkout form](https://atlas.merces.ai/scenarios/mastercard-token-in-checkout-form/): A registered agent signs its requests with RFC 9421 and Mastercard's single tag Agent-pay-auth, verified at the edge against a key directory whose public location is unknown. At checkout it types a Mastercard Virtual Card Token and a one-time DTVC into the merchant's standard card fields. Verifiable Intent L3a and L3b, linked by checkout_hash, are specified; live use is not shown publicly. - [A crawler pays per page](https://atlas.merces.ai/scenarios/crawler-pays-per-page/): Two separate Cloudflare variants, never one path. (a) The Monetization Gateway closed beta of 2026-09-30 answers with an inline x402 402 and settles USDC on Base through Coinbase's x402 facilitator. (b) The credit-backed batch-settlement binding on the cloudflare:402 network has the crawler sign with RFC 9421 while Cloudflare, as merchant of record, bills later off chain, as the x402 spec describes it for pay-per-crawl. ## Related standards with their own page - [A2A (Agent2Agent)](https://atlas.merces.ai/orbit/a2a/): An open protocol for agents to find each other through Agent Cards and hand off tasks over JSON-RPC, gRPC or HTTP bindings. - [EMVCo agentic payments framework](https://atlas.merces.ai/orbit/emvco-agentic-framework/): A draft EMVCo framework for card-based agentic payments, built around Intent Services, a shared layer to register, look up and manage the intent a consumer has authorized. - [ERC-3643 and ONCHAINID](https://atlas.merces.ai/orbit/erc-3643/): A Final Ethereum token standard for permissioned (regulated) tokens whose holders need an ONCHAINID identity contract carrying claims signed by trusted issuers. - [ERC-7715 wallet execution permissions and ERC-7710 delegation](https://atlas.merces.ai/orbit/erc-7715-7710/): Two Draft Ethereum standards that let a user grant an app or agent scoped spending authority; ERC-7715 is how the app asks the wallet for permissions, and ERC-7710 is how the granted delegation is redeemed on-chain. - [FIDO passkeys and the FIDO agentic working groups](https://atlas.merces.ai/orbit/fido-passkeys-agentic/): The FIDO Alliance publishes the passkey standards (CTAP, with W3C WebAuthn) and, since 2026-04-28, hosts standards work on AI agents, including AP2 and Mastercard's Verifiable Intent. - [IETF Web Bot Auth](https://atlas.merces.ai/orbit/web-bot-auth/): An IETF working group that standardizes how bots, crawlers and AI agents prove who they are to websites by signing HTTP requests with RFC 9421 HTTP Message Signatures. - [Know Your Agent (KYA) cluster](https://atlas.merces.ai/orbit/know-your-agent/): Know Your Agent names efforts to tie an AI agent to a verified person or organization before it pays; this cluster covers Skyfire KYAPay, Mastercard's agent registration and the GLEIF vLEI agent mandate proposal. - [L402 and the Lightning Network](https://atlas.merces.ai/orbit/l402/): An HTTP 402 authentication scheme from Lightning Labs in which a server returns a Lightning invoice plus a bearer token, and the client proves payment by presenting the token with the invoice preimage. - [MCP (Model Context Protocol)](https://atlas.merces.ai/orbit/mcp/): An open JSON-RPC protocol that lets LLM applications connect to servers that offer tools, resources and prompts. - [NPCI UPI agentic payments](https://atlas.merces.ai/orbit/npci-upi-agentic/): Pilots in which AI assistants (first ChatGPT, then Claude) pay Indian merchants over UPI, using UPI Reserve Pay so the user approves one spending limit for a merchant and the agent then completes several debits within it. - [RFC 9421 HTTP Message Signatures and RFC 9530 Digest Fields](https://atlas.merces.ai/orbit/rfc-9421-9530/): Two IETF Proposed Standards from February 2024; RFC 9421 signs chosen parts of an HTTP message, and RFC 9530 carries a digest of the message content so a signature can cover the body. - [Visa Intelligent Commerce](https://atlas.merces.ai/orbit/visa-intelligent-commerce/): Visa's program and API platform for agent-initiated card payments (tokenized credentials for agents, passkey-confirmed payment instructions and transaction signals back to Visa), with the Trusted Agent Protocol as one component. - [W3C Verifiable Credentials 2.0, DIDs, SD-JWT VC, OpenID4VP and the Digital Credentials API](https://atlas.merces.ai/orbit/verifiable-credentials/): The family of standards for signed, selectively disclosable credentials and how a wallet presents them; AP2 v0.2 uses SD-JWT VC, OpenID4VP and the Digital Credentials API, while VC 2.0 and DIDs are the wider family. ## Optional - [Sitemap](https://atlas.merces.ai/sitemap.xml) - [merces.ai](https://merces.ai)