What are agentic protocols? A plain-English guide

What a protocol is

A protocol is a shared set of rules that lets two parties work together without having to agree on everything from scratch every time.

You use them constantly without noticing. Driving on the right side of the road is a protocol. So is a handshake, or the way a phone call starts with "hello." None of these are complicated. Their power comes from the fact that everyone follows the same ones.

The internet runs on the same idea. Email works because every email provider follows the same rules for sending and receiving messages, which is why a Gmail user can write to an Outlook user. Websites work because every browser and every server follow the same rules for asking for a page and sending it back. Nobody had to build a special connection between your browser and every website on earth. They all just speak the same language.

That's what a protocol buys you: build once, work with everyone.

Why AI agents need new protocols

Almost everything about online commerce was designed for a person sitting in front of a screen. Product pages are built for eyes. Checkout buttons are built for a mouse. Fraud systems watch how a human types and scrolls. Bot protection exists to block anything that isn't a human. Even the question every payment rests on, "did you authorize this?", assumes you were the one who clicked "Pay."

AI agents break every one of those assumptions. An agent doesn't look at pages, it reads data. It doesn't click, it sends requests. It can act while you're asleep. And from the outside, a helpful agent and a malicious bot can look exactly the same.

Without shared rules, every agent would need a custom setup for every store, every bank, and every payment method, and every store would have to guess which agents to trust. That doesn't scale. So the industry is doing what it did for email and the web: writing new protocols, this time with agents in mind.

The catch is that there isn't one protocol. There are several, each built by a different group of companies to solve a different piece of the problem.

The protocols at a glance

The easiest way to understand them is to follow an agent through a purchase. Each protocol takes care of a different step, from getting through the store's front door to paying.

Protocol	Who's behind it	The step it handles	In one line
Visa TAP	Visa	Getting in the door	Lets a website tell a trusted shopping agent apart from a bad bot
UCP	Google and Shopify	Shopping	A common language for agents to search products, build carts, and check out at any store
ACP	OpenAI and Stripe	Shopping and paying	A shopping flow plus a single-use payment token, so the agent never sees your card
AP2	Google, now the FIDO Alliance	Permission and paying	Signed proof of what the person asked for, what the agent picked, and what was paid
x402	Coinbase, now the Linux Foundation	Machine-to-machine payments	Lets agents pay tiny amounts instantly for data, tools, and content, no account needed

They overlap in places, and many of them are designed to work together. An agent could show a Visa TAP badge at the door, shop through UCP, and pay with AP2, all in the same purchase. Each post in this series explains one of them in more detail.

What every protocol leaves open

Read through all of them and a pattern shows up. Each protocol answers a mechanical question very well. Can this agent understand my catalog? Did this agent come from a registered company? Was this payment signed? Has this request been paid for?

None of them answers the question a bank, a payment provider, or a merchant actually has to decide on: should I let this agent do this specific thing, right now?

That isn't a flaw. Protocols are supposed to be neutral rules that everyone can follow. Deciding what's risky is a judgment, and judgments depend on context: who the customer is, what they normally do, what they actually asked for, and what this particular business is willing to accept. A protocol can carry that context from one place to another. It can't weigh it.

So every protocol ends at the same spot. It hands over a well-formed, verified request, and then someone still has to say yes or no.

Where Beltic fits in

Beltic is the one who says yes or no. Or more precisely, Beltic gives the business everything it needs to say it with confidence.

Think of the protocols as the roads, the traffic signs, and the license plates of agentic commerce. They make sure every car can drive everywhere and that every car can be identified. Beltic is the part that looks at a specific car, on a specific road, doing a specific thing, and decides whether that looks right.

Here's how it works in practice. Whatever protocol an agent arrives through, Beltic takes the inputs the business already has: the Visa TAP badge, the UCP or ACP order, the AP2 mandates, the x402 payment request, plus what the business knows about its own customers. From all of that, Beltic works out who is behind the agent, what the person actually asked for, whether what the agent is doing matches that request, and how risky the action is. Then it applies the business's own rules and returns a clear decision: accept, deny, or ask the customer to confirm. Every decision is recorded, so there's a clear trail if anyone ever asks why.

This is also why Beltic doesn't pick a side. The protocol landscape is still moving fast. Some of these standards will grow, some will merge, and new ones will appear. A business shouldn't have to rebuild its trust and risk decisions every time that happens. Beltic works the same way across all of them, so the business plugs in once and stays covered as the protocols change underneath.

The protocols make it possible for agents to shop and pay anywhere. Beltic makes sure every business knows which of those agents to say yes to.