Consumers are not shopping the way they did five years ago. Just as every other industry has been reshaped by the pace of technology adoption, retail is no exception. Shoppers increasingly begin their journey inside generative AI engines (like ChatGPT, Gemini, or Perplexity) to research products, compare options, and recommend what to buy. Roughly six in ten consumers already use AI to shop, and around three-quarters say they are open to AI-driven recommendations.

This is more than a new channel. When an AI assistant becomes the first,and sometimes the only surface a customer interacts with, the retailer faces real disintermediation risk. The risks include losing the direct relationship, the brand moment, or even the ability to recognize a returning customer. The strategic response many retailers are converging on is unified commerce — a single, consistent experience whether the customer arrives through a store, a website, a branded app, or a third-party AI agent — so that brand loyalty, and recognition persist across every entry point.

The Opportunities and Security Risks of Agentic Commerce

Agentic commerce is not a distant concept. It is already emerging, and it introduces fundamentally new questions around trust, consent, visibility, and control. Those opportunities come paired with risk:

• Brand and content integrity. Agents are only as good as the content they read. If an AI engine pulls from a stale page or, worse, a malicious site impersonating a real retailer, the result can be wrong prices, wrong availability, or outright fraud — with lasting damage to brand equity and consumer trust. Ensuring agents reach the correct, current, authoritative content is now a security concern, not just a marketing one.
• Data exposure. Personal and financial information stored within or passed to AI engines expands the attack surface.
• Accountability for agent-led actions. Purchases and commitments made by an agent on a shopper’s behalf raise new questions of consent and dispute resolution — which is one reason the industry is, for now, moving cautiously on fully agent-mediated payments.

Internally, the upside is just as real. Retailers are making “non-regrettable” investments — enriching the product catalog with persona, use-case, and contextual data so agents can actually reason over products; exposing real-time pricing, inventory, and delivery data to internal agents (for example, through emerging standards like the Model Context Protocol); and equipping associates and customer-service teams with generative AI tools. These improve customer satisfaction, sharpen cross-sell and up-sell, and automate manual work — whether the end experience is a traditional search box or a conversational agent.

But the rapid adoption of AI strains security functions that predate it. Traditional models were never designed for autonomous, non-human actors that make decisions and act on them. And the discipline most exposed by that gap is Identity and Access Management. In an agent-driven world, identity becomes the control plane — the place where you establish who (or what) an actor is, what it is permitted to do, and on whose behalf. Get identity right, and the rest of the controls have something to anchor to. Get it wrong, and every downstream guardrail is built on sand.

5 Steps to Secure Identity in an AI-Driven Retail Environment

Organizations entering the AI arena are rarely easing in — more often they are thrown in. As more than one CISO has put it, it feels less like wading in from the shallow end and more like being dropped into the deep water. With employees and customers rapidly adopting agentic and generative AI, the “AI airplane” is already in the air. Securing it mid-flight means doing two jobs at once: building safety protocols and governance frameworks even as the technology is already in use.

1. Know what you are running

The first step is the inventory of AI models and agents. Highly regulated industries already operate under prescriptive rules for model inventory; for many retailers, the concept is new — and it gets harder with agents.

Unlike conventional systems, agents do not just consume information — they make decisions and act, much as a person would. A retailer might soon run a dynamic-pricing agent, a replenishment agent, a return-processing agent, and a personalization agent, each making consequential calls. That raises a fundamental question: what is the authoritative source of an agent’s identity, in the same way an HR system is the authoritative source of an employee’s identity? And once defined, who owns it?

A new employee is interviewed, vetted, assigned to a manager, and placed in a hierarchy where someone is accountable for their actions. Who plays that role as an agent? Without an answer, a retailer is running a workforce it cannot see, which is exactly why an authoritative model-and-agent inventory must come first.

2. How should retailers govern non-human identities?

The principle sounds simple: give an agent only what it needs. If it were truly that simple, IAM would not be its own discipline.

At one extreme, an agent inherits all the access of the person who invoked it. This tends to over-entitle. Imagine a returns agent that, through inheritance, can touch pricing or supplier-contract systems, while still failing to grant what the task requires. At the other extreme, the agent starts with nothing, and you grant the bare minimum per task. Risk managers love it, but arriving at the right access by trial and error does not scale in a world where agents will outnumber humans.

The practical middle is delegated, scoped, least-privilege access. Modern patterns — delegated consent and scoped tokens under OAuth 2.1, with both the agent’s identity and the user’s identity propagated through each call — let an agent act on behalf of a user with fine-grained, auditable authorization. Carrying both sets of claims through the transaction is what limits over-entitlement and contains lateral movement if something goes wrong.

3. Tell agents apart from humans

You cannot apply the right policy until you know what you are dealing with. Retailers increasingly need to distinguish human traffic from agent traffic — and one agent from another — then apply different authentication and authorization flows based on agent type and trust level. Bot-management and agent-detection signals at the edge should feed directly into the identity layer, so policy decisions reflect who the actor really is.

This also reshapes onboarding. Account opening and verification have to work in agentic channels: frictionless enough not to kill the experience, strong enough to be safe — which means well-placed MFA for consumers, and for B2B, verifying both the company and the individual’s authority to transact under a contract.

4. When agents talk to each other

An agent’s ability to collaborate with other agents to complete a task is a major advantage — and a new risk surface. Consider the human guardrail: ask your HR representative for salary data you have no right to see, and you will get a polite refusal. Now translate that to agents. A shopper’s personal agent calls a retailer’s loyalty or fulfillment agent and requests order history, stored payment details, or other customer data. How does each agent know what it may share with the other? The trust boundaries humans navigate by judgment must be made explicit between agents — and solved deliberately before agents interact at scale.

5. Defense in depth, from edge to backend

Identity is the control plane, but it is not the only layer. Because agent behavior is probabilistic and non-deterministic, controls have to be stacked and continuously tuned: AI-aware firewalls performing prompt moderation, PII detection, and intent scoping on inputs and outputs; API security for the interfaces agents actually use; and micro-segmentation to limit east-west traffic and protect sensitive data and models from lateral movement. Testing must evolve, too — one-time test cases do not capture probabilistic systems, so continuous monitoring, alerting, and iterative policy refinement becomes the norm.

Identity Strategy Across B2E, B2B, and B2C Retail

Agentic AI shows up in three distinct relationships, and each places different demands on identity and access. A strategy built for only one will underserve or over-expose the others.

• B2E — business-to-employee is the internal frontier: agents that employees and the enterprise use to drive productivity, from drafting, summarizing, coding, and analysis to associate- and customer-service-facing tools. The challenge here is governing a fast-growing population of non-human workers inside the trust boundary — tying each agent to an accountable owner, scoping it to only the systems its job requires, and preventing the over-entitlement and lateral movement that broad internal access naturally invites.
• B2B — business-to-business covers the partners a retailer transacts with, suppliers on one side, and enterprise customers buying products and services on the other. These relationships are governed by agreements and trust established between organizations, which is what makes identity doubly hard. Authenticating a single user or agent is not enough; you have to establish that an agent represents the partner it claims to and is operating within that relationship’s bounds. Organization-to-organization and agent-to-agent trust become first-class problems, in their own right.
• B2C — business-to-consumers are the regular shoppers. These journeys start with conversational search, discovery, and support, then gradually layer in identity-aware and payment-enabled experiences as trust frameworks mature. The priorities are frictionless onboarding, recognizing a returning customer across channels, and well-placed verification that protects the account without killing the experience.

The throughline is that all three are identity problems first. Designing for one context at a time produces silos and gaps; designing for all three against a common identity fabric — where every actor, human or agent, internal or external, is known, scoped, and accountable — is what lets a retailer extend AI safely across the entire business.

The Bottom Line

Agentic commerce is arriving whether the foundations are ready or not. The retailers who win will be the ones who treat identity as the control plane — establishing who and what is acting, with what permissions, on whose behalf — and build their guardrails outward from there. Get identity right, and retail can capture the full benefit of AI without inheriting risks it cannot see.