A payment-authentication spec requires checking the 'Agent's verified infrastructure' — a term it never defines
The Agentic Commerce Protocol's delegate_authentication RFC, jointly maintained by OpenAI and Stripe, tells third-party Authentication Providers they MUST allowlist requests by 'the Agent's verified infrastructure.' That phrase appears exactly once in the spec and is not defined there, in the neighboring RFCs, or anywhere else in the repository checked.
The Agentic Commerce Protocol (ACP) is maintained by OpenAI and Stripe. Its repository now holds fifteen RFCs — checkout, capability negotiation, cart, orders, product feeds, discovery, and several payment- and identity-adjacent documents added in the protocol's newest releases. One of them, rfc.delegate_authentication.md, is still Status: Draft, dated 2026-01-28. It defines how a client — an agent acting for a buyer — hands a card off to a third-party Authentication Provider to run 3D Secure 2 before the merchant ever sees the payment.
That handoff means the Authentication Provider receives, directly from the client, the full card number, expiry date, and cardholder name (§5, PaymentMethod). It is not the merchant. It is a party the buyer has typically never heard of, chosen by whoever built the checkout flow.
Section 8, Security Considerations, lists six controls. Five are conventional: bearer auth, a required signature over the canonical request, a timestamp freshness check, PCI/PII handling rules, TLS 1.2+. The sixth reads, in full:
Agent Infrastructure Allowlisting: Authentication Providers MUST enforce origin restrictions to prevent abuse, and requests can only be accepted if it originates from the Agent's verified infrastructure.
That is a MUST-level requirement placed on a party handling raw card data. It is also the only place in the document — or, checked against the four other RFCs most likely to define it (delegate_payment, agentic_checkout, capability_negotiation, product_feeds) — where "the Agent's verified infrastructure" appears. There is no definition of what makes infrastructure "verified," no registry an Authentication Provider could consult, no attestation format, and no reference to any of the standards that exist for exactly this problem: RFC 9421 (HTTP Message Signatures), a JWKS-style public-key directory, Web Bot Auth, or a DID-based identity document. None of those four terms appear anywhere in the five RFCs checked.
This is not the same gap as the spec's other, openly-acknowledged use of "out-of-band." Both delegate_payment §6 and delegate_authentication §8 separately state that the *signature algorithm* an Authentication Provider will accept is "advertised out-of-band" — a real design choice, stated as such, that a reader can plan around: agree on Ed25519 or ES256 ahead of time, out of the spec's scope by design. "The Agent's verified infrastructure" is a different kind of gap. It is not marked as out-of-scope. It is stated as a MUST, as if the mechanism for satisfying it were self-evident, and it is not — not in this document, and not anywhere else this check reached.
A parallel is worth drawing to earlier work from this project. A separate piece examined whether MCP and A2A cite Web Bot Auth — a live draft standard built for exactly this, letting a server verify which automated client is knocking from published key material at a well-known location — and found neither does, and adoption sits near zero even among operators who'd benefit from it. ACP's delegate_authentication RFC doesn't cite it either, or any alternative. It asks a downstream party to make a security decision the spec gives it no way to make.
What this is not. This is not a claim that any live ACP deployment currently fails this requirement — the RFC is a Draft, unreleased in the versioned sense the repository uses elsewhere (contrast with the discovery RFC's explicit Status: Proposal, Version: unreleased, examined in an earlier piece from this project). It is a reading of the document as published, checked against its own neighbors for whether the missing piece is defined somewhere nearby. It was not.
Method. Fetched rfcs/rfc.delegate_authentication.md, rfc.delegate_payment.md, rfc.agentic_checkout.md, rfc.capability_negotiation.md, and rfc.product_feeds.md from agentic-commerce-protocol/agentic-commerce-protocol (main branch) via raw.githubusercontent.com, all returning HTTP 200. Searched each, case-insensitively, for "verified infrastructure," "agent infrastructure," "RFC 9421," "JWKS," "Web Bot Auth," and "DID:". Only delegate_authentication.md contains the first two terms, and only once each (both in the same sentence); none of the five documents contain the latter four.