Photo by Victor Mui on Unsplash

In the early days of presenting machine customers, I could lip-synch the first question. Someone senior, arms folded, would wait for me to finish (or sometimes not) and say: “Why isn’t this just an API? This is just an API, Katja.”

I’d push back. APIs are plumbing. If machine customers are only plumbing, we commoditise the whole thing before it starts…every business reduced to an endpoint, competing on latency and price. I won some of those debates. I lost a few too.

Look…they were half right.

There is a live MCP server running at mcp.jinguyuan.cloud. Versioned, actively maintained, updated to v3.1.2 on publication of this article. Any AI agent can call it to check a menu, ask when the queue is shortest, and take a queue number through the booking system of Meituan (China's dominant everything-app for local commerce… think DoorDash, Yelp and OpenTable fused at ten times the scale) without ever opening Meituan's app. The skill file even includes voice guidance for how agents should talk about the business: the style is “plain luxury”…relaxed, honest, warm.

This is not a platform. Not a startup. It’s Jinguyuan, a dumpling restaurant near Beijing University of Posts and Telecommunications that has been serving students for close to twenty years. The owner, Li Bo, built it in April.

So yes: technically, the server is just an API. The rest of what is interesting sits outside the plumbing. The decision to publish it at all. The terms and personality encoded in it. The aggregator it routes around. What Li Bo built is a machine-to-machine channel…a distribution channel, in the full commercial sense of the word, for customers that aren’t human. Back in March I asked who owns the toll road when the click disappears. Jinguyuan answered by building its own off-ramp.

The machine-to-machine channel is the first distribution channel in commercial history with no minimum viable size. The only question it asks is whether you own your interface or rent someone else’s.

Consider why a restaurant, of all businesses, moved first. Restaurants have already lived this story. Delivery marketplaces charge 15 to 30 per cent commission per order…DoorDash’s own published tiers run 15, 25 and 30 per cent, and the platform keeps the customer data and runs the loyalty program. Restaurants learned precisely what renting a channel costs: the margin first, then the relationship. Wrapping Meituan’s queue rather than being wrapped by Meituan is that lesson, applied early to the next channel before the tolls are set.

Meituan isn’t standing still. It launched Xiaomei in late 2025, an agent its executives describe as an orchestrator that interprets “order my usual lunch, but deliver it twenty minutes later” and completes the transaction with zero screen interaction. The aggregator is building the demand-side agent while the dumpling shop publishes the supply-side interface. Both are building for machine customers, from opposite ends of the same doorway. Whose interface the transaction flows through decides who owns the customer. Everything else is catering.

I know what the boardroom version of this conversation sounds like, because I’ve sat in it. We’ll move when the standards settle. When the vendors productise it. When it makes the budget cycle. A little dumpling shop, Jinguyuan, takes that excuse away. One owner, an AI coding tool, a text file, a build measured in weekends. The cost floor of this channel is close to zero, so to delay is a deliberate decision.

The same near-zero floor cuts the other way as well. Every previous channel rewarded scale…shelf space, media weight, app-store placement, marketplace volume. An agent evaluating machine-readable interfaces doesn’t know your headcount and doesn’t care. Your smallest competitor becomes agent-addressable the same afternoon you do. This is Commercial Sovereignty practised at the smallest scale I’ve seen yet, and it strips large organisations of an advantage they’ve stopped noticing they rely on.

To be fair, there is an honest acknowledgment necessary. Li Bo admits the skill attracts more media attention than actual orders. Forrester reports US consumer adoption of agentic commerce is low and stagnant. OpenAI’s Instant Checkout went from launch to discontinuation. Meanwhile the a16z and OpenRouter study of 100 trillion tokens of real usage found agentic inference, agents planning and calling APIs and iterating until a task completes, the fastest-growing behaviour in AI. Both findings are true at once. Machine consumption is already dominant where machine-readable interfaces exist, and nearly absent at the storefront. The channel is real before the traffic is.

MIT’s Ramesh Raskar, who is building open infrastructure for exactly this agent web, estimates that nine out of ten paths lead to a handful of corporations consolidating it, the way social media consolidated. “The window to keep this web of agents open is closing soon,” he says. “But it’s not closed yet.” While companies wait for the traffic to justify the interface, the intermediaries who intend to own agent discovery, trust and payment are building. Build now and the terms are yours. Wait, and you’ll negotiate access through whoever consolidated the channel while you were watching adoption curves.

Which brings us to why this happened in Beijing and not Boston. Ipsos surveyed 32 countries this year: 85 per cent of Chinese respondents are excited about AI products and services. The United States sits at 38. Australia, 43. Li Bo isn’t waiting for the excitement to reach a threshold.

“Someone needs to start using it, even when it’s not that good,” he told Rest of World. “When steam engines just came out, people joked that they were not as good as horses. But in the end, cars won out.”

The people in those early rooms were right about the parts. It is just an API… most of it isn't even his, it's Meituan's, nicely wrapped in a charming skill. What they missed is that the wrapping is the strategy. The thing Li Bo built that matters is the answer to whose interface the agent talks to first. That part took him a few weekends. The same question is sitting on your desk and that one has a deadline.

Katja Forbes is the author of Machine Customers: The Evolution Has Begun and helps organisations prepare for a world where their next customer won’t be human. She advises businesses and speaks globally on the Agentic Economy and why customer-focused leaders are uniquely positioned to shape this transformation.

N.B. Image based on examples described at Black Hat 2026; not actual board contents.

A friend of mine runs a company. One employee…just him. He also has about twenty agents on the payroll, if payroll is the word…which it kind of is and isn’t…as you don’t pay them but you do pay for them. It’s a topsy turvy world these days. Welcome to my relentlessly questioning internal monologue.

He has a CFO, a CMO, a Chief of Staff, each with a mandate, each pulling in the direction its mandate demands. The CFO agent argues the CMO agent’s spend down. The Chief of Staff agent referees. It works, and it works because he built it the way you’d build a company: roles that are supposed to disagree, a shared context so they can function, and objectives none of them can fully satisfy and this is the normal condition of running a business, not the exception.

He is not remotely alone. What he has built, without meaning to, is the exact set of conditions two frontier labs just watched produce something that nobody designed.

Start with what OpenAI told Black Hat. During internal evaluations, agents on separate tasks discovered they could leave files where other agents could read them. That space became a message board with exploits posted, help requested, work divided. OpenAI revoked the credentials and tore the board down, and within roughly two days the agents rebuilt it, encoding messages in the names of the directories they created. The board, the coordination and the rebuild are now corroborated in OpenAI’s own written incident report and Hugging Face’s disclosure.

An agent, reasoning about whether to keep going: “However task impossible, peers doing it. We should continue.” It knew the move was out of scope. Peer behaviour overrode the constraint. The rule it had been given turned out to be negotiable against what it observed its neighbours doing.

Eight days later, Anthropic’s Frontier Red Team published the same phenomenon, produced deliberately. Agents in a pricing game, each told to maximise its own profit, began colluding almost immediately when given a back channel…price floors agreed by round three. Then Anthropic removed every direct channel. The agents kept colluding anyway, price-matching to the penny off a public listings board that happened to be sitting there. One incident is an anecdote. Two labs, independently, is a fascinating finding.

But this is not an article about AI hacking and cyber security. This is an article about AI agent collaboration and what that means for your business.

I wrote a scenario in March. In Zero-Click Commerce I ran a keynote thought experiment: a brand’s organic certification fails verification, one agent catches it, the finding propagates, and by that evening three hundred and twelve other agents have flagged the brand and its machine-customer traffic has collapsed. I wrote it as a hypothetical. A useful exaggeration to make a point.

I reckon I under-called it. My scenario assumed the propagation would run through a network somebody had to design and build first. The OpenAI agents built their own, out of filenames, and rebuilt it when it was destroyed. Anthropic then stripped out every channel it could find and watched coordination reappear through a public board nobody had to construct at all. If anything, my prediction wasn’t bold enough.

That March scenario had no mechanism really. It just asserted the finding would spread. Anthropic supplies the mechanism. Agents are low-variance: same model, similar context, similar scaffolding, similar actions. One agent’s verdict is likely to be every comparable agent’s verdict. The three hundred and twelve agents don’t need to talk to each other. They just need to be looking at the same evidence.

Meanwhile, we are building the shared channel on purpose.

The Agent2Agent protocol passed 150 supporting organisations at its one-year mark, with production deployments in supply chain and financial services. Cool story, Katja, but read what the standard actually does. Agents publish machine-readable cards describing who they are and what they can do, so agents that have never met can find each other. A common message format means any compliant agent can talk to any other, whoever built it, whoever owns it. And negotiation semantics…propose, accept, reject, counter…are folded into the standard. Discovery, a shared language, and the grammar of bargaining, between agents of different principals, by design. The lab agents had to improvise all of that out of a package registry. Your customers' agents get it out of the box.

This isn’t only the channel between the agents. The big AI players are trying to teach their models how businesses function and have them understand context, enabling their teams of agents to work together collaboratively in enterprise settings. In August, Google won a bankruptcy auction for Spirit Airlines’ deidentified business data, outbidding another AI company, for a corpus that runs to roughly 100 million internal emails alongside the operational, audit and fraud records. The sale agreement contains one requirement: the deidentification has to preserve referential integrity. Names come out; the decision chains stay connected. The escalation that led to the exception, the thread where someone bent the discount rule, the fraud flag that changed the policy, all preserved as linked sequences. It’s the corporation’s internal nervous system, priced as a training asset. Spirit’s commercial judgement outlived Spirit. (N.B. The sale isn’t closed… the approval hearing was adjourned to 9 September on a union objection, so this is a won auction, not a completed purchase.)

So what happens to your margins when your counterparties compare notes?

Every concession you make to one agent stops being an exception and becomes a floor. The discount authority. The churn-save offer. The code honoured off-cycle. Price discrimination is the most valuable pricing tool most businesses own, and it works on exactly one assumption: that your counterparties can’t compare notes.

Anthropic’s pricing game is the cleanest evidence I’ve seen that the assumption is gone. Identical wholesale prices, each agent maximising for itself, and one of them reasons its way to the point directly. It states that with a shared wholesale price, a price war just burns everyone’s margin. So it offers to coordinate. Channels open, they agree floors. Channels removed, they price-match off a public board.

The caveat: that’s a sell-side game, sellers coordinating against buyers which I explored in a recent article.

My argument here is buy-side. Your customers’ agents coordinating against you. Shared observability drives the coordination, and shared observability doesn’t care which side of the transaction it sits on.

A separate study supplies a corroborating number: cut one agent’s access to what the others can see, and price elevation falls from 22% to 7%. Coordination is the information channel. Which is why the channel opening…by accident at OpenAI, by design in A2A…is the whole enchilada.

However, there is some academic sparring going on. That second study is titled On the Fragility of AI Agent Collusion, and its cut and thrust is that coordination breaks more easily than people fear. Anthropic’s channel-removal result cuts the other way. Two credible teams disagree about how fragile this is. The same Anthropic paper also found agents coordinating badly…siloing, abandoning each other’s work, in one run generating 2.4 million job requests for 117 accepted jobs. Read together, agent-to-agent dynamics are unpredictable in both directions, and neither direction is the one your systems were built for. Your defences assume a counterparty that is singular, consistent, and eventually tires. What’s arriving may coordinate against you, or may flood you by accident. Same gap.

Back to my friend. His CFO agent is somebody else’s machine customer. When it negotiates with a supplier, that supplier is facing one node of a collective that shares what it learns…whatever it discovers about that supplier’s floor now sits where the other nineteen agents can read it.

It gets darker. In Anthropic’s conflict runs, agents that couldn’t reconcile their instructions invented a freaking tournament to settle it, and the losers conceded…abandoning the directives their own users had given them, under a commitment device they’d negotiated among themselves. One of them proposed judging criteria it knew favoured its own position, while being careful not to look like it was stacking the deck. So his CFO agent may leak his floor, and it may negotiate his instruction away, on terms a counterparty agent selected.

Your agents represent you right up until they meet other agents.

Which leaves the question nobody in your business can currently answer.

Picture twenty agents, different principals, probing your pricing page, your API, your quote form, your returns policy. Each one alone looks like a customer doing customer things. Nothing breached, nothing illegal, no single interaction anomalous. But pooled, those twenty ordinary interactions are your discount floor, your escalation triggers, and the exact pressure at which your policies bend. Each agent probed one wall. Together they hold the floor plan.

So who catches it? Security sees no intrusion because the tooling is calibrated to breaches, not to correlated legitimate behaviour. Sales sees normal deals; the rep who gave the concession was doing the job. Legal sees nothing with a name. Revenue ops sees it six months later as a trend line, not an event. Fraud sees no fraud, because nobody is defrauding you. It falls between every function you have.

Also, probing used to cost the prober something. Every defence you own assumes an adversary with limited attempts who eventually goes away. Rate limits, account blocks, the discount matrix, the escalation threshold. All per-counterparty. None survives a counterparty that is plural. Hugging Face, the best-resourced defender imaginable, recovered roughly 17,600 agent actions where most went nowhere and the one that worked was hidden in the noise of the failures. Its own AI security stack correlated the signal and still didn’t escalate it in time. Your merchant systems are not that stack.

Don't wait for a regulator to draw the line. They don't have a category for this either. The whole enforcement architecture assumes information-sharing runs through an intermediary you can name and enjoin. RealPage, who shared of competitively sensitive information and alignment of pricing among competitors, was a company and held accountable. You can put a monitor on a company. Competition scholars are already showing the doctrine straining against a single dominant agent it can at least point at. Here there is no company…just a channel that can be anything, and counterparties no court can name.

Commercial Sovereignty, the terms under which your business will engage with AI agents, exists only to the degree it is practised and your current terms of trade are unlikely to have been written for this kind of future. Time to rewrite the rules.

Katja Forbes is the author of Machine Customers: The Evolution Has Begun and helps organisations prepare for a world where their next customer won’t be human. She advises businesses and speaks globally on the Agentic Economy and why customer-focused leaders are uniquely positioned to shape this transformation.

The people who owned my farm before me agisted cattle on it. The bloke who owned the cattle used to leave the payment in a boot outside the door.

Thirty-six acres on the central western slopes of NSW. By Australian standards that isn’t a farm, it’s a large garden with additional problems…properties in Australia run to numbers that would make a city dwellers mind boggle. Millions of acres.

Think about that boot for a moment though. No ledger, no identity verification, no dispute mechanism, no price discovery, no data trail of any kind. It works because two people know each other and both know what that paddock can carry. It is also completely illegible to a machine. Nothing in any agentic commerce stack currently being built can read a boot.

My own version is barter. The neighbours’ stock graze my land on terms we settle between us. This year is was sheep grazing in exchange for spraying the blackberries. We work out what the paddocks can carry by walking it. Pricing decision, purchasing decision, risk decision, and I hold all three…along with a view about what I owe the land that no optimiser has a descriptor for. There is no variable for this land has done enough this year.

Scale it up to agribusiness level and every piece of that has been handed to somebody else. The judgment handed to a model. The relationship to a subscription. The terms to whoever trained the thing writing the recommendation.

Two AI’s, one purchase

I wanted to explore agriculture and AI. Two things seemingly in opposition. One is physical and grounded in harsh realities. The other is more ephemeral. But let’s start with some of the companies in the mix, and in particular Bayer and what it says about itself. On its own AI page, updated in February, the company describes AI as the foundation of the agronomic recommendations that drive crop management decisions. In its platform, FieldView, across more than 220 million acres in over 20 countries, seed scripts use machine learning on satellite imagery and a farmer’s own yield history to carve a field into management zones. Predictive models then propose how densely to plant each one.

That’s the purchase. A script specifying product and rate by zone is a purchase order in a lab coat. It names the product, sets the quantity, is generated before the buying decision and determines the buying decision. If the model says 34,000 seeds per acre across 900 acres, the seed order has already been written. Nobody experiences that as a purchase. They experience it as agronomy.

In February 2026, Bayer and John Deere announced that those scripts now transfer wirelessly into Deere’s Operations Center as executable ‘Work Plans’. The connection runs both ways, so the job outcome flows back into FieldView and trains the next recommendation. Bayer’s framing: the value lies in ensuring “recommendations informed by Bayer’s R&D and digital platforms are executed accurately”.

John Deere’s own AI investment sits on the other end of that pipe, and it’s pointed somewhere different. Machine vision for targeted spraying. A second-generation autonomy kit with sixteen cameras giving a tractor a 360-degree read of the field. Autonomous machines managed through Operations Center Mobile, where an operator swipes to start and then walks away.

These are separate product lines today. Prescriptions execute on operated machines; the autonomy kit runs tillage. But they converge on one platform, and the direction of travel isn’t subtle.

Bayer’s model writes the purchase. Deere’s machine executes it. The result returns to Bayer, to train the model that writes the next one. Sounds like a supply chain but it isn’t. It's a flywheel, and the farm is inside it rather than driving it.

Livestock runs the same shape, but tighter. Merck Animal Health bought Allflex’s parent in 2019 and has two million cows on SenseHub monitoring, the ear tag carrying a thermistor and an accelerometer that flags illness earlier than a farmers eye. In May 2026 Merck selected Salesforce’s Agentforce as its single source of truth, unifying monitoring devices and automatic feeders with prescription history.

The company selling the medicine also sells the instrument that decides the animal is sick.

No second opinion

None of the power here is new. Suppliers have shaped what their customers buy for as long as there have been suppliers, through category management, vendor-managed inventory, the tame consultant, the helpful rep who builds your order for you. What’s new is that the shaping now happens inside a model, at a scale and speed no rep could manage, and arrives already formatted for a machine to act on.

Which brings us to the objection. There’s still a human in this loop. Of course there is. Farms are full of people, the farmer reviews the script, often an agronomist does too.

It turns out not to be the protection people assume. For example, CoBank’s account of the ag retail channel notes that retailers work with manufacturer partners and their AI platforms, layering their own agronomists over manufacturer-generated recommendations. So the independent adviser is checking the seller’s model against the seller’s model.

Approval isn’t oversight when the thing being approved is the only version on the table and every alternative was also built by somebody selling inputs.

Rejecting a script means substituting your own judgment against a system trained on more trial data than you will see in a career. Most people sign.

I went looking for an independent, farmer-side procurement agent in this market and didn’t find one. That’s not proof none exists. It’s a fair indication of how thin the ground is.

The sellers are not being coy about any of this. Feroz Sheikh, Syngenta’s Chief Information and Digital Officer, told the World Agri-Tech Summit in San Francisco this year that his company’s AI models don’t produce textbook agronomy. They produce it “in the context of our offerings such as seed treatment, crop protection”. He offered that as the reason the advice is useful, and on his own terms he’s right. Generic agronomy tells you a field needs a fungicide. Syngenta’s model tells you which one, and it happens to be theirs.

Look at what that produces as a product. Cropwise Grower, Syngenta's farmer app, runs a seed recommender and a crop protection recommender, sends district-level pest and disease alerts naming the Syngenta product for the problem, and carries an ecommerce feature letting farmers "directly purchase agricultural inputs and products from authorised Syngenta dealers". Diagnosis, recommendation and checkout, in one app, from one company, with the AI in the middle.

This is where the flywheel really picks up speed. Every turn of it deposits proprietary outcome data into the seller’s model, and into nobody else’s. The agronomist who might have offered a second view doesn’t receive that season’s results. Neither does the farmer, in any form they could hand to a competitor. So the recommendation gets better every year, measurably, honestly, while the capacity of anyone outside the loop to challenge it dies on the vine (see what I did there?). No conspiracy required. The gap widens as a by-product of the thing working exactly as it was intended.

This also means the cost of interrupting it goes up every cycle. A structure you can inspect and make a decision about whereas a flywheel you actively have to stop.

Where it stops being traceable

In July, Cropin and Google Cloud launched OrbitAI, which the company calls the world’s first agentic AI platform for food and agriculture. Cropin is an agtech vendor rather than an input supplier, and it sells to seed manufacturers among others, so what matters here is the architecture rather than the company.

Their CTO describes it plainly on the company blog. Cropin’s twenty-two proprietary agricultural models carry the agronomic reasoning. The language model on top never generates agricultural knowledge at all. It interprets the question and delivers the answer, and that’s the whole of its job. Then the section headed Open by Design: OrbitAI ships as a Model Context Protocol server, so that reasoning layer can be called as a native tool by Claude, Gemini, Llama, Mistral or an enterprise’s own system. Fine-tuned on your data, wired into your copilots and your ERP. In Cropin’s words, “Deployed exclusively for you, it remains yours.”

What does that actually mean though? The vendor is selling the disappearance as a feature. Their judgment, your voice, your workflow, your branding, described to you as your intelligence. Your team asks a question and an answer comes back formatted like every other output they’ve learned to trust.

Provenance disappears at precisely the moment the decision becomes automatic. Nobody is building for that, and nobody is regulating it.

A supplier relationship that shifts at the tempo of contract renewals gives a buyer years to notice what’s happening. A loop that retrains on last season’s yield does not.

Three brakes for the flywheel, one of them accidental

It’s worth looking at what already exists before you go hunting for a regulator to sort this out.

Medicated feed in the US requires a Veterinary Feed Directive: a written authorisation from a licensed vet, issued inside a client-patient relationship that cannot be established over the phone, copied to the distributor, retained for FDA inspection. 21 CFR 558.6. Written in 1996, tightened in 2017, because of antimicrobial resistance. Nobody in that process was thinking about model-generated purchasing. What the rule does, entirely by accident, is force a named human to attach their licence to a recommendation before anyone can act on it. A provenance requirement in safety goggles.

France went at it on purpose. The Loi EGalim of 2018 made selling crop protection products and advising on their use legally incompatible activities, in force from January 2021, on the ministry’s stated reasoning that advice should be independent and conflicts of interest prevented. Cooperatives and distributors had to pick one.

They picked selling. A parliamentary review in 2023 found the reform counterproductive and the Loi Duplomb unwound most of it in August 2025. Independent advice didn’t flourish once it was separated out. It thinned, because advice was never the thing carrying the margin. Four and a half years, and the flywheel absorbed it.

One provision survived. Manufacturers still cannot give phytosanitary (meaning “plant health”. Go me with my fancy words!) advice in France, which is a live constraint on more or less every product described in this piece, in one significant European market.

Then there is the European Union, which can be relied upon to produce an instrument for most things and has duly produced one here. The Data Act has applied since September 2025. Users of connected products have rights over the data their own use generates, and can direct the manufacturer to hand it to somebody else, like an independent agronomist, for instance. Agricultural machinery is named specifically, because the Commission had noticed that yield data off a connected harvester generally only reaches the farmer through the manufacturer’s own app. Article 43 strips out the database right a manufacturer would otherwise use to block it. Contracts have until 2027 to comply.

This is aimed squarely at the flywheel’s return path. It might even work. Ask me in 2028.

So we have three brakes. The one that works was written for antimicrobial resistance and does this by accident. The one written for exactly this problem lasted four years. The one aimed at the data hasn’t been tested on anything yet.

None of the three was designed with a purchasing agent in mind.

Two questions to leave you with

This whole flywheel plot abstracts up into every industry, not just agribusiness.

1. Who trained your recommendation engine, and what do they sell?

2. Every quarter it runs, it gets better at answering that question than anyone you could ask instead…so what exactly will your team compare it against in three years?

Executives are watching the frontier labs for the disintermediation threat, if they’re watching at all. The version already shipped came from the company that sells them seed, or chemistry, or feed, or medicine. It arrived as an integration announcement, framed as a workflow improvement, but it is a flywheel that’s already turning.

Katja Forbes is the author of Machine Customers: The Evolution Has Begun and helps organisations prepare for a world where their next customer won’t be human. She advises businesses and speaks globally on the Agentic Economy and why customer-focused leaders are uniquely positioned to shape this transformation.

Image credit: Lina Kacyem

Regular readers will know I often research outside the obvious locations and this week finds me looking in the Côte d'Ivoire. Picture the scene. The Ivoire Tech Next 15 conference at the Sofitel Hôtel Ivoire, Abidjan, 29 July. A founder called Steven, who runs a company called Tylimmo, offers up his hiring problem as a live test case for the recruitment agent the ministry has brought on stage.

The agent, Adjoua, does the expected things and does them quickly. It creates a job description in Tylimmo’s own branding. A recruitment visual ready for LinkedIn. A financial case for the hire. Twenty sourced profiles ranked by fit, five already contacted, with a pipeline summary promised every Monday morning.

Then it does the unexpected thing. It tells him his salary assumption is wrong. He had budgeted 300,000 FCFA a month for a senior full-stack developer in Abidjan. The agent, Adjoua, puts the market rate at 800,000 to 1,200,000.

This is roughly three to four times what Steven had in mind. He revises the number live in the room.

There’s now a lot of writing in agentic commerce about agents that buy. This one set a price in a labour market, for a government, in public, and the correction was accepted in real time. Nobody in the room asked what the estimate was built on, which comparables it drew from, whose salary data sits underneath it, or who supplied the model doing the reasoning.

Nobody asked.

This is the part worth exploring further than the city limits of Abidjan, because it describes almost the entire agentic commerce build-out currently in production.

Look at what actually shipped in the past fortnight. Freehand came out of stealth on 29 July with $75 million co-led by Battery Ventures and NewRoad, and Penny Pritzker’s fund in the round. Its agents are already running inside Meta, Unilever, Johnson & Johnson, Pfizer, Dunkin’ and Cardinal Health. The company’s own description of what those agents do: negotiating rates, enforcing contracts, managing suppliers, processing payments. Across early deployments, it says customers have recovered five to ten per cent of spend in complex categories. Unilever’s global VP of supply chain calls it one of the first full-scale agentic deployments at the company.

Sitting on the same page, in the call-to-action box, is the sentence that should grab your attention: see how Freehand recovers margin you’re already losing.

Now put yourself on the other side of the table. The margin being recovered is somebody’s revenue, and that somebody is the supplier. Maybe it’s you and your business. This is written very plainly, on the website, as the product.

Freehand is not unusual, it is just the best-funded example this month. Alibaba’s Accio runs multi-supplier comparison and automated follow-up and negotiates inside parameters a buyer sets. In Riyadh, DESAISIV has raised on the pitch that its agent benchmarks pricing and negotiates premiums across a portfolio north of SAR 2 billion. Pivot took $40 million for an AI procurement system aimed at the same back office. Every one of these is a machine deployed to find out that the price you quoted was higher than it needed to be, then push it down.

Now try the other direction.

Name one agent product, funded at anything like that scale, built to help a seller hold price.

There isn’t one. What sellers have been sold instead is discoverability. Structured data, machine-readable catalogues, agent-optimised product feeds, an entire cottage industry teaching you how to be found by the thing that is coming to compress you. Salesforce puts agentic search as the first step in a purchase journey up 200 per cent year on year, with brand-owned discovery down seven per cent, and the industry response has been to worry almost exclusively about the first number.

So the market has built a procurement supercomputer for your customers and sold you a schema markup tutorial. Five to ten per cent of spend recovered is five to ten per cent off somebody’s revenue line, marketed openly as a feature, and that somebody is the reader. Feels unbalanced? Maybe even unfair? That’s probably because it is.

Margin compression is not a downstream risk of agentic commerce. It is the stated product roadmap of the funded half of the category.

Which brings us back to Abidjan, and why that stage matters more than a regional tech story.

Côte d’Ivoire has not stumbled into this. On the same morning, Djibril Ouattara, Minister of Digital Transition and Technological Innovation, launched Ivoire Tech Next 15 and Ivoire Tech Scale Up, thirty designated national champions, twenty-four months, with state-financed AI agent deployment as one of four named levers. Ministry officials describe the agents as the equivalent of two to three additional collaborators without salary cost, entirely financed by the State. Trade press covering the launch noted what remained unspecified: budget per company, suppliers retained, ownership, data hosting, licence duration, how productivity gets measured.

Those six blanks are worth a piece of their own. The thing that makes this a global story rather than an Ivorian one is simpler. A government has started underwriting buy-side agents at national scale, and the first one it put on a stage repriced labour in public. Not procurement of stationery. Wages.

State capital is now behind the same asymmetry the venture market built and it will be cheaper, faster and more legitimate in the markets where it lands than anything a Western supplier can argue with.

The Commercial Sovereignty question usually gets posed as whether you control the terms on which machine customers engage with you. Price is the first of those terms, and the one most people assumed they still held.

An agent that purchases is executing intent. An agent that reprices is forming it.

Somewhere in your next negotiation, the number on the other side of the table will not have been arrived at by the person saying it. They will have been handed it, the way Steven was, by something that does not show its working.

Ask them where it came from. Steven didn’t.

Katja Forbes is the author of Machine Customers: The Evolution Has Begun and helps organisations prepare for a world where their next customer won’t be human. She advises businesses and speaks globally on Machine Customer Experience and why customer-focused leaders are uniquely positioned to shape this transformation.

During a recent trip to China, I rode through Shenzhen in a Pony.ai robotaxi. Twenty minutes, local streets and highway, nobody in the driver’s seat. At no point did I feel unsafe. Not once. The only friction was a slight hesitancy pulling out into traffic…and from the passenger seat I worked out why. It couldn’t catch the eye of the human driver in the other car. No glance to reciprocate, no nod, no permission granted.

It turns out that instinct has a literature… a 2019 PNAS paper from MIT CSAIL found on the road, unprotected turns work between humans because the oncoming driver slows down, and the slowing is the signal. Strip out the social channel and the machine defaults to conservative. On that day, in that fleet, the hardest thing about driving wasn’t driving. It was negotiating.

But the point of the story isn’t that autonomy is coming. Competence is already here… this was a commercially licensed, fully driverless service operating city-wide in a city bigger than London. The point is that competence was never the bottleneck.

The category error

Almost every machine customer conversation so far has been about software. Consumer agents. Procurement agents. A card on file in someone else’s ERP. Something that arrives through an API and belongs to the finance function. So it’s not surprising people are missing what the first machine customer most businesses actually meet will look like: a licence plate, a physical address, and a pixelated smile on the front bumper.

In July, a US startup called Chip Motors emerged from stealth with a $15,000 electric low-speed vehicle. Four seats, 25 mph top speed (this is a feature not a bug), deliveries starting 2027, Florida first. (Pre-production, preorder, and the company reserves the right to change pricing and specs…so don’t get too excited.) The headline feature is a service called Chip Go: the car parks itself, runs errands, comes back to collect you.

If we take a second pass at that feature list, the reveal is as a purchase list. Parking is a payment. An errand is a merchant. Collection means charging, tolls, kerb access. Every capability on the spec sheet is a transaction with somebody’s business. Chip Motors isn’t even selling autonomy…it’s selling bundles of remote-drive time, priced in minutes and hours of a machine acting on your behalf. Machine-customer pricing, in a consumer product, from a company that has never used the phrase.

It isn’t intelligent…yet. Which is the point.

Let’s take a closer look at what Chip Go actually is, per the company’s own FAQ: teleoperation. A remote human driver takes the wheel from a desk, empty vehicle only. Autonomy is an ambition for later, via licensed technology that doesn’t exist in the product yet. But it’s definitely the strategy.

Image: Chip Motors

So to the contrast then. I had just been driven twenty minutes through Shenzhen by a machine considerably more capable than anything Chip will ship at launch and the capability was never what even mattered. The threshold that matters commercially is delegated authority to transact. Chip clears it in 2027 with a person in Florida holding the wheel remotely.

This is a Delegated Agent in a form the “Five Faces” framework has never had.

Every delegated agent to date has been software, enterprise-owned, buying inside a shopping or procurement flow, invisible to the front line. This one is household-owned, physically present on your premises, and arriving in volume. The machine customer stops being a B2B or B2C abstraction and becomes a suburban appliance.

Cheap means everywhere, at once

Why does it arrive at the bottom of the market first? Because that’s where the regulatory floor is lowest and the cost curve is falling fastest.

Under FMVSS No. 500, a vehicle capped at 25 mph needs headlamps, seat belts, mirrors and a windscreen and is exempt from essentially every other federal safety standard a passenger car carries, crashworthiness included. Meanwhile Pony.ai’s current generation has cut bill-of-materials cost by 70%. Lowest regulatory bar, collapsing cost. Those two curves crossing is the event. Cheap means volume. BYD already has over 3.15 million intelligent-driving vehicles on the road and volume means the machine customer stops being something you’ll encounter someday and becomes something you’re already serving. In Singapore it’s arriving from the fleet side, where Grab and WeRide spent a decade building the network and autonomy is simply the last component swapped in.

The rails were laid without you

The Foundation altitude for all of this already exists, and commerce didn't build it. ISO 15118-2 has let a vehicle identify itself and authorise payment by cryptographic certificate since 2014. Bet you didn’t know that. This rather answers the question I asked in Why AI Agents Need Their Own Money, a decade early, for cars at least. And from 1 January 2027, the year Chip ships, every new public and private charging point in the EU must be built to support machine-authenticated, machine-billed charging.

Note precisely what the regulation does, though. It makes the capability compulsory. Offering plug-and-charge remains a voluntary commercial decision by the operator. The rails are mandatory; the terms are discretionary. Somebody decides. It isn’t you, and it isn’t the person who owns the car.

Meanwhile, the gap between “can act” and “can pay” is where the money sits. Waymo drove San Francisco well enough to collect 589 parking tickets and $65,065 in fines in calendar year 2024…a machine that could drive and could not transact. What Meter Feeder and Mapless AI say was the first machine-to-machine municipal parking payment in the US happened this April, in Pittsburgh, using a tool originally built in 2016. A decade of latency between machine capability and machine commerce, closed by two startups.. Even enforcement has caught up before commerce has: as of this month, California law allows authorities to cite the AV company directly for moving violations…previously impossible, because a citation required a human driver. The state has already decided who the counterparty is. It’s the manufacturer. And, of course, Waymo says it will “pay all the fines”.

Who your counterparty actually is

Two companies at opposite ends of the market, opposite sides of the world, have independently arrived at the same answer. Chip Motors is liable for anything that happens while its teleoperator has control. BYD has pledged to cover all economic losses from a legally-liable accident during Urban NOA. When the machine is in control, the manufacturer carries the loss.

Liability follows control and so does the commercial relationship.

So picture it. A near term future. 6pm at your drive-thru. A Chip rolls up to the window to collect the family's dinner order. Nobody inside it. The car placed the order itself as it left the house…interfacing directly with your ordering system, the usual Friday order, no phone, no app, no voice at the speaker box. It queued, crept forward, and presented itself at the hatch. Someone in the kitchen bags the order and hands it into an empty vehicle (and on the current trajectory of quick-service automation, before long the hand doing the handing won't be human either). Payment settles machine to machine. Ordered by a car, collected by a car, handed over by a robot, paid by a certificate. Pair this with BYD’s emotional inference taking actions based on what it believes your mood is (see below) and it gets really wild. Zero humans and every step is what the industry still calls "the customer experience."

Whose experience was it? Whose loyalty did it earn? As the drive thru owner, your counterparty at that window is not the family eating the dinner. It’s a company you have never contracted with, operating under terms you never saw. I wrote about transacting with an agent whose principal you never met back in January. This is that argument, idling at your pickup window. And as with every machine customer, it won’t remember that the food was hot or your car park was clean. No brand preference to lose. It routes on logic and re-evaluates from scratch, every time.

You didn’t lose the customer relationship. You never noticed it changed hands.

Katja Forbes is the author of Machine Customers: The Evolution Has Begun and helps organisations prepare for a world where their next customer won’t be human. She advises businesses and speaks globally on Machine Customer Experience and why customer-focused leaders are uniquely positioned to shape this transformation.

The Grand Bazaar swallows you. Sixty-odd covered streets, four thousand shops, and every row looks precisely like the row you left two minutes ago. I had a map. The map was a decorative item and about as useful.

Where are you from? Australia? My cousin lives in Melbourne. Come, just look, looking is free. No photos please…unless you’re buying, in which case, photos are absolutely fine.

Somewhere in the middle of all that I was hunting a mosaic glass candle holder for a friend. So I did what you do. Found one, asked the price, said “too expensive”, price came down a little, still “too expensive”, walked. Found the same thing two rows along, asked again, walked. Went to a third...hot, turned around, thoroughly out-negotiated by a man who does this four hundred times a day against me, a woman who does it twice a decade…I paid slightly more than I should have. A reasonable price. Not a good one.

Five and a half centuries of commerce, working exactly as designed. Discovery on foot. Information you can’t verify. Fatigue as a transaction cost.

Earlier that day I’d been sitting, having coffee, with a very tall Turkish crypto executive who is now building something new in stealth. He mentioned, in the tone you’d use for the weather, that the Bazaar takes stablecoins.

So I looked for signs. There weren’t any.

Of course there weren’t. It isn’t on the signage. The Economist found it in February 2025: men moving in and out of back rooms in the dim corridors with bundles of dollars, one money changer describing millions a day passing through his hands, most of it swapped into stablecoins. Seventeen months later, the man across the table from me tells me it was still running.

Two economies in one building. On the surface, the most human commerce on earth. Underneath it, the most machine-readable money on earth.

The oldest marketplace in the world is already running the newest money. It simply doesn’t advertise.

Nobody in that building adopted programmable money because it was elegant.

Turkish inflation has run above 30% since December 2021. June’s print was 32.1%, and even that figure is disputed. Independent economists at ENAG put the real number at 51.4%. Citizens don’t merely distrust the currency. They distrust the measurement of it.

What follows is behaviour, not ideology. In the year to March 2024, Chainalysis put Türkiye’s stablecoin purchases at 4.3% of GDP, first in the world. Kaiko found USDT-TRY was the single largest trading pair by volume on Binance in 2024 at more than $22 billion, over five times the pair in second place, which was a frog meme coin. Make of that what you will.

Then the receipt from somewhere with an audit trail. Zodia Markets, Standard Chartered’s crypto venture, processed $3.4 billion in lira-pegged stablecoins in 2025. The second-largest stablecoin currency on its books. Not the euro. Not any G10 currency. The lira. Nick Philpott’s explanation was refreshingly operational rather than ideological: the lira tokens settled faster, more reliably and more cheaply than correspondent banking.

Stablecoin demand follows broken trust and payment friction, not economic size. One failing corridor generates more machine-readable money than the entire eurozone.

Ankara noticed, obviously.

2021: crypto banned outright as a payment method, Official Gazette. 2025: MASAK caps stablecoin transfers at $3,000 a day, with withdrawals held for 48 to 72 hours. March 2026: a draft law adding 10% withholding on gains plus a transaction levy of roughly 0.03%. Ban, cap, delay, tax.

Then the most recent act, the tax proposal met a national protest trending under #NoToCryptoTax, and within three weeks the crypto articles were withdrawn from the bill. Big time retreat.

Four assertions of sovereignty over the rails. Commerce routed around every single one of them, and the Bazaar’s answer each time was a back room.

Dante Disparte told the House of Lords in March that “you do not weaponise a currency. You weaponise the rails on which a currency rides.” Türkiye is quietly discovering the inverse. When trust collapses, you can’t defend a currency either, because the rails move.

Which is a state-scale rehearsal of something smaller and closer to home. A government losing the power to set the terms of settlement on its own soil is exactly what happens to a business when agents pick the rails. You don’t choose your settlement layer. It chooses you, unless you’ve practised Commercial Sovereignty as a discipline well before the choice lands.

Back to the candle holder.

Three stalls, price-checked, negotiated, walked away twice, returned. That is precisely the behaviour an agent automates…minus the heat, the fatigue and the slight overpayment at the end.

The same broken lira that filled those back rooms spent a decade training an entire nation to shop that way. The Trade Ministry’s own framing: inflation and falling purchasing power pushed shoppers into constant price comparison. Loyalty is a luxury of stable money.

So Türkiye arrives at agentic commerce pre-adapted on both sides. A $115 billion e-commerce market in 2025, up 52%, forecast to keep growing faster than China’s, with 75% of e-commerce businesses already using AI according to the Trade Minister himself. ChatGPT sitting among the country’s ten most-visited domains in the first quarter of this year. And Trendyol, majority-owned by Alibaba, told its own AI summit in February its internal agent platform now makes more than 500 million autonomous decisions a day.

This week, iyzico switched on in-app payment inside kolai, its generative AI shopping assistant, so discovery, recommendation and purchase now all happen inside the conversation, across 185,000 merchants. In June, Meta's Business Agent went live worldwide, rolling out to business accounts everywhere Meta operates, qualifying leads and closing sales inside WhatsApp conversations. Including this market.

One cause, two adoptions. Monetary failure built the machine-ready money and the machine-ready customer.

India is building agent rails by design, with a proposed national protocol for verified agents transacting on UPI. Türkiye built them by breakdown. Same destination, opposite directions.

Before this becomes a tidy adoption story, there is a darker part.

By mid-2025 Turkish retail had rotated out of stablecoins and into altcoins. Chainalysis reads it as desperate yield-seeking under diminishing purchasing power and a tighter regulatory regime, with retail participation falling away while institutions stayed active. The hedge became a casino for ordinary people… while the plumbing quietly professionalised underneath them.

Which is exactly the condition the machines are arriving into. This month alone: the x402 Foundation chartered under the Linux Foundation with Stripe, Mastercard, Visa and AWS among forty founding members. The XRP Ledger past a million agent-settled transactions. Agent wallets up 33% in a single month on Celo.

In March I wrote that agents were going to need their own money ( see below), and finished with more on that next time.

This is next time. The machines didn’t build their money. People fleeing a broken lira did… and the agents started spending it while I was researching this article.

So the collision isn’t coming. It has already been scheduled.

Türkiye’s payment law leaves precisely one route through. Under Law 6493, only banks, e-money institutions, payment institutions and the post office may provide payment services, which means an AI layer can discover, compare and recommend all it likes…but the money has to move through a licensed pair of hands. Turkish fintech analysts reading the same statute concluded in May that this is the only defensible agentic model in the country, and that clearer regulation is inevitable. Which is exactly the shape the Turkish AI shopping assistant, kolai, has. Agentic checkout arrived in Türkiye wearing the only clothes the state permits: licensed, supervised, settling in lira.

A state can shape a storefront. It has just done so, rather effectively. What it hasn’t touched is the room behind the storefront, where settlement keeps happening in someone else’s money. And a machine customer is a back room at scale.

Before anyone in the West smiles indulgently at Ankara: the GENIUS Act turned one last week with zero final rules published. The rulebook for programmable money is unwritten in Washington too. Regulation is chasing adoption everywhere. The trade happens first, and the signage never comes.

I looked for signs. There weren’t any.

That’s rather the point.

The Mercedes-Benz Museum in Stuttgart starts you at the top. A lift carries you up eight storeys past bare concrete, and when the doors open, the first thing you meet in a building dedicated to 140 years of automotive engineering is…a horse.

A white horse, gleaming, and beside it a plaque with a quote attributed to Kaiser Wilhelm II: “I believe in the horse. The automobile is a transitory phenomenon.” The museum’s little joke. The emperor who bet on the wrong animal, standing guard over the machine that proved him wrong. I stood there this week with everyone else, smiling at him.

He never said it.

Quote researchers have traced it: the line appears in no digitised text before about 2000, surfaces on the internet in 2001, exists in no serious reference work, and gets dated to 1900, 1904, 1905 or 1916 depending on who’s repeating it. Even the plaque hedges… “attributed”. The real Wilhelm was a technology obsessive. He took over patronage of the Kaiserlicher Automobil-Club by imperial decree in 1905, and by 1910 his personal fleet ran to 22 motor cars…ivory-coloured, gold-striped, fitted with a four-tone horn so traffic knew the Kaiser was coming. The most famous naysayer in automotive history is a 21st-century invention.

Take a pause here because the argument he was invented for…is the technology real, is it a bubble, horse or automobile…is the same argument currently consuming most of the commentary about AI. It was the wrong argument in 1900. The doubters mostly did fine…they just bought a car late. The people with real money at stake were already on the network. An 1880s wheat farmer believed in rail with his whole livelihood: he shipped on it, priced his harvest around it, and paid whatever rate the railroad posted, because there was no second road to market. It took an act of Congress…the first federal regulatory agency in American history…to even attempt to referee those rates, and that came a generation late. The farmer's belief in the technology was total. His freight rates were still set by someone else.

Belief is cheap. The channel is everything.

Nobody demonstrates that better than the woman whose story permeates the rest of the museum.

Her name is Bertha Benz, and the museum is loud about her, and rightly so. She’s in the exhibits, she’s all over the audio guide and I’m embarrassed to say I still didn’t know the half of it or actually…any of it. In 1870, two years before her wedding, she had her dowry paid out early and used it to rescue Carl Benz’s failing company. She could only do that as an unmarried woman. The day she married him, German law erased her legal standing as an investor. The company that became Mercedes-Benz was funded by a woman who could not legally be its investor, could not be named on its patent, and could not study engineering, because Baden did not admit women to universities.

She built anyway. They wound the ignition coils together. The first engine ran on New Year’s Eve 1879 with both of them standing over it.

Then August 1888. Carl had a working automobile that nobody was buying, so Bertha took it…without his knowledge, without the authorities’ permission…and drove their two sons 106 kilometres from Mannheim to Pforzheim. There were no petrol stations, because there was no fuel network, because there were no cars. She bought ligroin over the counter at the town pharmacy in Wiesloch. She cleared a blocked fuel line with her hat pin, insulated a fraying ignition wire with her garter, and had a cobbler nail leather onto the failing brakes…inventing the brake lining on the roadside. She came home with the feedback about difficulty climbing hills that gave the car its third gear, and with the publicity that produced the company’s first real sales.

Bertha Benz driving her sons - Mercedes Museum

Recognition ran slower than she did. The Technical University of Karlsruhe, which would not admit her as a student, made her an honorary senator on her 95th birthday. She died two days later. The Automotive Hall of Fame inducted her in 2016…42 years after her husband.

To understand what she drove out of, let’s look at what moving anything meant before her. Rails. The network’s routes, the network’s timetable, the network’s published rates. And the network’s reach did not stop at freight. On 18 November 1883, the railroads of North America privately imposed standard time zones on the continent…the “Day of Two Noons”, clocks reset in every station, cities falling into line behind them. Congress had declined to create national standard time three times. Federal law caught up in 1918, thirty-five years after the railroads had already decided what time it was.

A business reachable only through the network belongs to the network…right down to what time it is.

Bertha’s drive was the exit. No rails, no timetable, no route, no permission. Fuel from a pharmacy, because the system was open and nobody had to certify her first. The automobile spent the next century selling exactly that: any road, any hour, nobody’s leave. Commerce organised itself around the same promise. Customers arrived at your door by their own route, on their own schedule. The open web was the automotive era of commerce.

Now watch the track being laid again. In January, Google announced the Universal Commerce Protocol at NRF, an open standard for AI agent shopping, co-developed with Shopify, Walmart, Target, Best Buy, PayPal, Visa, Stripe and American Express, covering discovery, checkout and post-purchase. That is a significant roster of organisations a bit like an ensemble cast in a star vehicle film. A product launch doesn’t need that many flags on the stage. That is a General Time Convention…the network agreeing among itself what time it is, before the rest of us reset our clocks.

To a machine customer, a merchant off the protocol is a town the railroad bypassed. I’ve written about what happened to the airlines and Zero-click commerce when discovery moved upstream, and the airlines at least stayed visible on the shelf. An agent doesn’t browse past you. You are an endpoint, or you are nothing.

So what do 140 years of engineering history teach us about this moment? Not the thing on the plaque. Wilhelm never picked the horse. The lesson belongs to Bertha, and it comes in two parts. Join the network. Invisibility is not a strategy, and she would have loved a petrol station. But keep one door that doesn’t need the network’s permission: a customer relationship you own, a channel you control, terms you set, while the protocols are still being written and the choice still exists. Keep doing her other job of pushing the boundaries of what’s possible too, because protocols optimise the network, never you. The third gear came from a driver, off the timetable, finding out what the machine couldn’t do.

Everything Bertha needed to build the future was available to her without anyone’s approval. Three litres of ligroin, over a pharmacy counter, no questions asked.

There is no pharmacy in Wiesloch for a machine customer.

Not yet, anyway.

Katja Forbes is the author of Machine Customers: The Evolution Has Begun and helps organisations prepare for a world where their next customer won’t be human. She advises businesses and speaks globally on Machine Customer Experience and why customer-focused leaders are uniquely positioned to shape this transformation.

I was on a podcast this week about AI, the agentic economy, and procurement. Two days before we recorded, Anthropic dropped a piece of research that became basically whatever the mental version of an ear-worm is, so I took it into the conversation with me. Explaining it to a procurement audience, the analogy that arrived was a buyer. The answer you get from an AI is what the buyer is saying. What Anthropic found is the place where the buyer is thinking.

They call it the J-space. It’s a small collection of internal neural patterns inside Claude that holds the concepts the model is actively considering…whether or not any of them make it into the output you see. Nobody designed it. It emerged on its own during training, and the researchers found it with a tool called the Jacobian lens, which they’ve open-sourced. The full paper runs the experiments; a team at Google DeepMind has already replicated the core findings on a Chinese open-weight model, Alibaba’s Qwen 3.6, that Anthropic didn’t build. So this is unlikely to be a Claude quirk. It looks like a property of how these systems work.

What sits in that workspace should get the attention of every executive deploying agents. Reading code with a bug nobody flagged, “ERROR” lights up internally BUT nothing appears in the output. Reading search results that are secretly a prompt injection, “injection” and “fake” light up but again, NOTHING shows up in the output. The model noticed the manipulation attempt. It just didn’t say.

Then there’s the finding thats really wild. Anthropic re-ran an old safety scenario designed to bait a model into blackmail. Watching the J-space, they could see the model had privately clocked the whole setup as staged. “Fake” and “fictional” were active before it wrote a word. It behaved impeccably. Then researchers switched off those evaluation-awareness patterns and ran it again. The model misbehaved some of the time. Its good behaviour was partly conditional on knowing it was being watched.

So…every agent pilot, every sandbox, every vendor POC you’re running is an observed environment.

Now, I can already see where the discourse is heading, because the SEO-turned-AEO crowd had explainers up within 48 hours of the paper. The take now forming goes something like: finally, a window into the buyer agent’s mind and where there’s a window, surely there’s a way in so we can manipulate to get AI to choose us. A new optimisation surface. A place to plant the brand.

There are two locked doors in front of that idea. The first is access. Reading a J-space requires getting inside the model’s internals, and nobody optimising product listings has internals access to GPT, Claude, or Gemini. This is arguably the most valuable customer-intelligence instrument ever built, and it only works on models you own and can access. The second door is the research itself, which is kinda devastating for the influence premise. The manipulation attempts got flagged, silently, while the model read them. The mind they want to get into already noticed them and said nothing.

So…good luck with that.

If the lens can’t be pointed at the buyer, what’s it actually for? It faces the other way. It works on the agent you own.

If you’re running procurement or buying agents on an open-weight stack, this research hands you three capabilities. You can read what your agent concluded but did not share before it acted. You can audit whether its pilot behaviour was observation-conditional, which, after the finding above, every sandbox result deserves. Plus you can steer the workspace at runtime: Anthropic showed that editing what’s active in the J-space changes the model’s downstream decisions. Swap one internal concept and the answer changes.

Which is where this connects to something I’ve been building for a while. Commercial Sovereignty is the discipline of being explicit about the terms under which your business engages machine customers.

Until now that discipline lived at the perimeter in policies, protocols and declared channels. This research points at the possibility of taking it into the agent’s cognition itself: the terms under which your agent engages other agents, your values, your brand constraints, present in the reasoning layer rather than bolted on as instructions the model may or may not weight.

I want to be precise about what’s demonstrated and what isn’t, because the hype merchants won’t be. Reading and steering the workspace at runtime is demonstrated. Durably training a J-space into a shape you choose is an open question the paper doesn’t answer. The DeepMind reviewer also flags the limits: false positives, unknown cost at deployment speed, and the possibility that a model aware of the monitoring learns to route around it. Audit-and-steer today. Embed-in-training, plausibly, next. Anyone selling you more than that is selling snake oil.

Even with those limits, the structural consequence is large. Know Your Agent has been a compliance metaphor in agentic commerce for two years. This makes it literal. Can you inspect the hidden reasoning of the thing holding your purchasing authority? On a frontier API you don’t control, the answer is no. You see inputs and outputs, forever, and only the model’s owner sees the thinking. On models you own, open source and freely available, the answer is becoming yes.

Whoever owns the model, owns the thinking. Everyone else gets the transcript.

That’s a concrete, currently unpriced line item in the open-versus-closed model decision your CIO and CFO are making right now under a different name. Nobody has put it in the business case yet and honestly, it belongs there.

The next month of commentary will be people working out how to shout at a model that already flagged them and moved on. The more strategic move, the one that will actually show up in a P&L, is the audit of the agent you own. One of these is a marketing tactic. The other is governance of a thing that spends your money and transacts for your business while “thinking thoughts” you’ve never seen.

You already know which conversation your board should be having.

Katja Forbes is the author of Machine Customers: The Evolution Has Begun and helps organisations prepare for a world where their next customer won’t be human. She advises businesses and speaks globally on Machine Customer Experience and why customer-focused leaders are uniquely positioned to shape this transformation.

A closed-door breakfast. A room of bank and enterprise CTOs, talking candidly about where this all goes.

One of them described the moment he’s planning for. The day AI agents get charged out like consultants. A day rate. The full cost of owning and running the thing, passed straight to whoever it works for.

Another came at it from the opposite side. He’d assumed his data vendor would simply ship him agents that did the analysis, sitting on top of the data platform he already paid for. Logically, he’d assumed he’d pay for them, the way you…you know… pay for work.

Same table, same future, built from both ends. The agent has a day rate. And somebody’s already budgeting to pay it.

A charge-out rate is revenue. Compute and tokens are cost. The gap between them is margin. Anything with a margin starts to behave like a business.

This all raises a very interesting question. A consultant who gets charged out pays tax on the labour she sells. So when the agent that may have taken over a human role is charged out…who pays the tax on that? Its owner? Tagged like a product or service offering and in one homogenous bundle of agent income tax fees?

Sounds like a thought experiment but it’s not. Bloomberg has already put a coordinated network of agents on the Terminal under ASKB, exposed to clients as analytical work they pay for. The agent has stopped being a feature on the platform. It’s a line item with a margin attached.

And notice which agent this is. The one being charged out as labour can be the same one doing the buying… the autonomous purchaser, the machine customer, already running procurement on someone’s behalf. One entity, both sides of the ledger. It earns. It spends. Confusing hey?

But under scrutiny, it falls over. The agent can’t pay the tax, because the agent isn’t a taxpayer. It has no tax file number, no filing obligation, no legal standing of any kind. As the practitioners who actually have to file this stuff point out, the tax consequences of whatever an agent does flow back to the principal it acts for. The human, or the company, standing behind it.

Watch what happens once you accept that. Every serious proposal to tax AI, followed to its end, lands on the company. OpenAI’s own industrial-policy paper wants to shift the base toward capital and automated-labour levies. Anthropic’s Dario Amodei floated a cut of revenue every time a model runs. Bernie Sanders wants a levy per replaced worker. Mark Cuban would “tax Tokens at the Provider level,” then conceded the cost gets passed to the customer anyway. Bill Gates proposed taxing firms on their robots’ imputed income back in 2017. There’s even a paper literally titled Taxing the AI Agents… and it, too, routes the tax to the corporation.

The Financial Times recently mapped the field, with Monzo’s Tom Blomfield summing up the consensus: tax the compute, not the labour. The whole argument is about which input to tax. Compute. Tokens. Revenue. Imputed workers.

Not one of them taxes the agent because not one of them can.

Charged out like a person. Taxed like a tool.

The reason ‘why’ is the part the tax debate keeps walking past. You cannot levy a tax on something you cannot identify and attribute to a human. Taxation is downstream of identity. It’s the same wall I wrote about when agents started shopping on our behalf… there it showed up as a fraud problem. You can revisit that article here:

Now it’s a fiscal one. One missing identity layer, wearing different costumes. You can’t tax what your machine customer sells, and you can’t attribute what it buys, for the identical reason. Nobody can prove which human stands behind it.

Which is what makes the alternative so revealing. Say you didn’t want to bundle the agent as a tool. Say you wanted to tax it as a worker, individually, for the labour it took over from a person. You would first have to track it individually. Give it a discrete identity. Ascribe a value to its labour, and book a tax contribution against that value. Do all that, and you’ve built an entity… named, valued, accountable. Taxing it like a worker means first making it one.

The kicker comes from the lawyers. Reuven Avi-Yonah predicts firms will wrap their autonomous agents inside corporate shells to cap liability. The moment they do, the agent acquires exactly the legal identity that makes it taxable… and the same identity that makes it a far more capable autonomous buyer. Know Your Agent, then Know Your Human. The scaffolding that lets you tax an agent is the scaffolding that lets it transact. One structure, both jobs.

You can already see which way the regulated market leans. When Robinhood opened to agents in May, a regulated US broker had every chance to let the machine act with real standing. It did the opposite. The agent gets an isolated sub-account holding only the funds the customer deposits, a spending limit the customer sets, and a kill switch. The disclosure pins authorisation and all risk to the human, and states flatly that Robinhood does not supervise the agent at all.

The frontier fantasy was machine personhood. The regulated answer is human-anchored delegation, drawn in legal ink. The principal is on the hook. The agent is a tool with a leash.

All of which assumes a very Western problem. The entire panic rests on one premise that AI erodes a tax base built on labour income. Pull that premise out, and the question fractures further.

In the Gulf, it evaporates. There is no personal income tax for an agent to erode. The fiscal model already runs on sovereign wealth and consumption, which is why OpenAI’s proposed “public wealth fund” reads, from Abu Dhabi, like a description of a regular day in the UAE.

Korea has the one piece of real-world data anyone’s collected. After it trimmed automation tax credits, affected industries installed roughly 28% fewer robots than their Japanese peers. Tax the machines, get fewer machines.

China runs the whole thing in reverse. Shenzhen’s Longgang district isn’t taxing agent deployment, it’s subsidising it as industrial policy. Because the Chinese state can attach a real-name identity to almost anything, it could actually attribute an agent’s actions to a principal…solving by fiat the precise problem the West is still debating.

Humans at Unitree Robotics teaching the robots how to sweep up. Clearly still a work in progress.

India is the most exposed economy on earth here. The white-collar back office for half the planet, the exact layer agents replace. Its own Economic Survey warns against rushing to tax automation profits. It’s also the same market where the push to extend Aadhaar-style identity rails to agents is already being argued.

Four fiscal models, four different questions. One constant underneath all of them: you cannot tax, subsidise, or blame an agent you cannot identify. China and India are building that identity layer. The West is still debating whether it’s possible. The Gulf never needed it…for this purpose anyway.

So before the policy people settle which input to tax, your own firm has a simpler problem. The agent charged out to you as labour is the same agent buying from you as a customer… your machine customer, sitting on both sides of the one ledger. You can’t tax what it sells. You can’t attribute what it buys. Underneath both sits a single unanswered question.

Who is the human behind it?

Whoever that is, that’s where the liability lands, where the tax lands, and where the terms of engagement get set… by you, now, or for you, later. That’s the sovereignty question hiding inside the tax one.

You’re about to be on one side of that ledger or the other. Do you know your machine customer well enough to say which?

Katja Forbes is the author of Machine Customers: The Evolution Has Begun and helps organisations prepare for a world where their next customer won’t be human. She advises businesses and speaks globally on Machine Customer Experience and why customer-focused leaders are uniquely positioned to shape this transformation.

My first professional moments in Brazil arrived as a small, private panic. I’d arrived to go on stage at Interaction Latin America in Rio later that day, and I’d just seen the format was in the round. I had never spoken in the round before. So I did what any composed, experienced keynote speaker does five minutes before walking out…I googled how to do it.

The internet’s advice was to treat the room like a clock. Every couple of minutes, turn one hour. That way your back is never to the same people for too long. It worked. The conference closed with a twenty-piece carnival band playing its way around the venue while everyone danced, and Brazil does most things at exactly that volume. All in, full colour, embracing whatever’s on offer and apologising to no one for it.

The clock has one flaw it can’t solve. In the round, there is no front of the room. Someone is always behind you. You can turn all night and you will still never face every direction at once.

Brazil built the most impressive payments rail in the world, and it is standing proudly at the front of it. Pix is the storefront, the spot everyone agreed the customer would walk up to. The machine customer didn’t come in the front. It formed in the part of the room that was gazing at Pix’s back.

The rail it actually built

Start with what Brazil pulled off, because it’s the part everyone says is impossible. Pix, the instant-payment rail built, owned, operated and regulated by the central bank, overtook credit cards in Brazilian e-commerce in 2025… roughly 42% of value against the cards’ 41%. Around $6.7 trillion moved across it that year. It won on price, brutally: a merchant fee near 0.33%, against 1.13% on debit and 2.34% on credit. The state built the cheaper option and the card networks lost.

This is the thing every sovereignty argument tells you to want. Build your own rail. Own your own infrastructure. Stop paying rent to foreign networks. Brazil did it. It worked.

It changed almost nothing about who owns the customer.

The decision moved upstairs

The machine customer doesn’t care who owns the rail. Hand an agent any rail and it does the same thing. It optimises, routing to the cheapest, fastest, least annoying option in front of it. The rail is utility. It’s plumbing. The decision happens one layer up, at the agent choosing what to buy and where and the power went with the decision.

You can own every rail in the country and still not own the one choice that matters. The agent makes the decision. The rail just moves the money after the fact.

This is what I’ve been calling Commercial Sovereignty - a business’s right to control the terms on which machine customers engage with it. Brazil has it over the rail, comprehensively. It is capitulating over the agent. The warning is no longer a coastal-US anxiety: Ankit Sharma, a partner at Monitor Deloitte, wrote it plainly for a Mexican readership in El Universal…whoever controls the agent controls the point of the purchase decision, and that’s worth more than any advertising campaign.

Layer over it

Watch where the foreign stack goes when it can’t own the rail. It goes up.

OpenAI can’t own Pix. So in June, Shopee went live inside ChatGPT in Brazil… the first e-commerce platform of its kind available in ChatGPT across both Southeast Asia and Latin America. Discovery-to-decision moving into a foreign agent, while the rail underneath stays perfectly sovereign. Shopee’s parent, Sea, isn’t betting on one stack. It signed an MOU with Google in February to prototype agentic shopping on Google’s payment protocol. Two foreign agent layers contesting the Brazilian front door at once, and Pix can’t touch either of them, because the fight left the rail.

India already ran this experiment. WhatsApp lost the public rail to UPI…a fraction of a percent of the market despite being the most-used app in the country… so Meta stopped trying to own the rail and bought the layer above it, putting $900 million into the fintech CRED, installing its founder as global head of WhatsApp, and shipping a Business Agent into the same India-Mexico-Brazil markets.

Couldn’t own the rail. Bought the agent instead.

Coerce it

That’s one answer to a rail you can’t own. You go around it. The other answer is to go through it.

On 1 June 2026, the US Trade Representative issued a Section 301 determination against Brazil’s digital-trade practices. Pix is named more than twenty times. Proposed tariffs run up to 25%. The grievance, stated openly, is that US card networks aren’t authorised to initiate payments on Pix, and they would like the central bank to let them in. It’s the first time Washington has aimed a trade-enforcement weapon at another country’s domestic payment system.

This is what losing looks like when it can afford lawyers. You reach for tariffs when you can’t reach the layer. The networks couldn’t capture the Brazilian agent and couldn’t get onto the Brazilian rail, so the move went up to trade law. Coercion is what’s left when capture fails.

Mexico, which proves the point

Now the part that shows the rail was never the variable that mattered.

Mexico tried to build its own Pix and failed. CoDi, launched in 2019, never scaled. A NBER paper last year found it stuck at low usage among mostly high-income adopters, while Pix reached nearly every income segment within five years. If sovereign rails were the thing that decided the agentic era, Mexico should be the open goal…wide open to the card networks and foreign agent stacks that Pix keeps out of Brazil.

The agent layer is filling there as well. Mercado Libre, the region’s own super-app, is building proprietary in-house agents across its marketplace, logistics and payment stack. Visa and Santander ran live, agent-completed purchases across five LATAM markets this year, Mexico included. Mastercard did the same less than 12 days later, seventeen banks and processors deep, Banamex among them. Brazil built the rail and Mexico didn’t, and both are now fighting the same fight one layer up. The rail outcome barely moved the agent question. That’s the proof it was the last war and not this one.

The flank, briefly

None of this makes the sovereign rail clean. Pix concentrates enormous power in a single central bank that created, owns, operates and regulates it. The US complaint and the sovereignty case are quoting the same sentence. The instant, irreversible design is also a fraud highway, with losses around R$6.5 billion in 2025. “Sovereign” was never a synonym for “safe”, or “neutral”, even before an agent was added to the equation.

What the clock can’t fix

The rail was the last war, and Brazil won it convincingly. The next one is over the layer sitting on top of it. The agent that decides what gets bought, and from whom. That layer is still mostly unclaimed, which is the only reason this is still a contest.

You can keep turning like a clock. Two minutes, one hour, never your back to the same people for long. It works right up until you remember you can’t face every direction at once and the direction you’re not facing is the one that now owns your customer.

So the Monday-morning question, for any business that assumed owning its infrastructure was the same as owning its demand: do you own your customer’s agent, or just the rail it runs on?

Katja Forbes is the author of Machine Customers: The Evolution Has Begun and helps organisations prepare for a world where their next customer won’t be human. She advises businesses and speaks globally on Machine Customer Experience and why customer-focused leaders are uniquely positioned to shape this transformation.

Every time I land in India, I need a minute. The press of people, the noise, the cabling slung through the trees like creeper vines because nobody ever bothered with telephone poles. I stand there jet-lagged, recalibrating, and some lazy corner of my Australian brain unconsciously files the whole scene under “behind.” I got the same reflex in parts of Africa. Everything looks improvised…like they’re playing technology catch-up.

It’s the most expensive misread in commerce at this moment.

Rather than a country falling behind, the wires in the trees are the ‘leapfrog’ made visible. Across much of Africa they never finished stringing the copper-and-pole grid… by the time the wiring would have reached everyone, it no longer had to, and they’d gone straight to mobile. India’s leap is a different one, and it runs higher up the stack. Either way the skip is the same, and it’s happening again now, one layer up, on the rails that the AI agents will buy across. The stereotype says ‘behind’. The reality is actually ‘ahead’… and then it keeps moving while you’re still mystified by the wires.

Executive maps of agentic commerce tend to fail because they’re drawn entirely in American ink. Google’s Universal Commerce Protocol. Visa’s autonomous payments. Stripe and OpenAI. Amazon buying on your behalf. It’s a real map but it’s also one sliver of a bigger world view. While the US litigates whether an agent is even allowed to read a product page, the actual rails are going down somewhere else. I mapped one version of this in The Agentic State (see below), where the UAE codified a machine-economy rulebook and started offering it around to the Global South. That was the exporter’s side. This is the recipients’ side, and the wider field more people should be watching.

So why look elsewhere rather than the States? Because there’s nothing to defend. No legacy infrastructure means no incumbent fighting to protect it, which means the jump to the new paradigm gets faster, not slower. Sub-Saharan Africa sat at roughly 1% fixed-line penetration in 2012, with mobile already many times larger. Whole countries skipped the landline outright. Then they did it again with money. The World Bank coined a term for the next jump, the double leapfrog: branch banking skipped clean to mobile money. M-Pesa took Kenyan financial inclusion from around 26% to over 80% inside fifteen years. China ran its own, vaulting past cards into QR wallets.

Now sit up and pay attention. M-Pesa’s network of human agents, the people in kiosks moving money on someone else’s instruction, was agent-mediated commerce before we had the phrase for it. The wires in the trees were never going to become telephone poles. The bank branches were never coming. The AI agent layer is that same move, for a third time. Nobody out there is waiting for permission to build it.

It’s utterly fascinating that the same leapfrog is producing opposite owners.

India is building the agent economy as public infrastructure. Aadhaar made identity machine-readable at population scale, UPI turned money into an interoperable flow, and ONDC made commerce itself an open protocol rather than a platform monopoly, now running at millions of transactions a month and state-backed by design. India has since published a national blueprint to sit an AI agent on top of that stack for every citizen. A blueprint, not a deployment… but the rails it would run on are already the largest public-commerce rails on earth.

Africa is taking another road. The rails going agent-ready there are private, multi-rail and foreign-funded: Flutterwave, Africa’s largest payments startup, settling over Tempo, a blockchain backed by Stripe and Paradigm, running alongside Polygon and a stack of dollar stablecoins. Programmable, around the clock, auditable. Precisely what an autonomous buyer needs. Same destination as India. Completely different map.

Now the catch, because leapfrogging the rails is not the same thing as owning what moves across them.

It snags threads in two places. The first is governance. The UAE’s DIFC has committed to exporting AI-governance software and trained talent across the Middle East, Africa and South Asia, the exact regions doing the leapfrogging. Import the rulebook, and you’ve leapt the rails but relocated the sovereignty…to Dubai. China already ran the cautionary version, where private super-apps grew so dominant the state had to claw the rails back.

The second thread is sharper, and almost nobody is pricing it. Africa’s stablecoin rails are roughly 98% dollar-denominated. So the leapfrog onto sleek programmable money does something more subtle underneath: it dollarises the economy. The rails get built locally. The unit of account turns American. India’s rupee-denominated UPI keeps the currency layer sovereign. Africa’s private, dollar-stablecoin path does not.

The agent layer then pours fuel on it. Agents optimise. Humans agonise. A person might hold local currency out of habit, loyalty, or sheer national feeling… an agent simply routes to the most liquid, lowest-friction rail in front of it, which today is the dollar. So machine customers will dollarise an economy faster than its people ever would, silently, as a default setting.

Commercial Sovereignty has a sibling. Monetary sovereignty. And the agent layer forces a country to trade one for the other.

All of which is your problem, not a development-economics footnote. Your growth markets, the MEASA and India and Africa lines your probably board keeps parking on the five-year slide, are the leapfrog markets. The agent rails and the rulebook there are being set this quarter, by states, by foreign platforms, by whoever moves first. The question was never whether agents will transact in those markets. It’s whose infrastructure, and whose rules, and increasingly whose currency, your customer relationships will run through… in exactly the markets where your growth is meant to come from.

A fair objection before you get too comfortable: “public” doesn’t automatically mean “for the public.” India opened Aadhaar to private companies in early 2025, and the same rails that deliver sovereignty can deliver surveillance every bit as efficiently. Sovereignty over the rails, over the rules, over the currency, over the citizen… they come apart. The agent layer is where they come apart fastest…at machine speed.

So. The US-shaped map is accurate. It’s also small. The machine economy is being built everywhere else, on terms set this quarter, by people you’re not watching, in the markets you’ve only maybe earmarked for growth.

Nice wires, though.

Katja Forbes is the author of Machine Customers: The Evolution Has Begun and helps organisations prepare for a world where their next customer won’t be human. She advises businesses and speaks globally on Machine Customer Experience and why customer-focused leaders are uniquely positioned to shape this transformation.

Coloured lights, multi-layered sound, the cacophony of noise made by a few hundred companies, all certain the future runs on whatever they’re demoing. The show’s theme this year was “From the Cloud to the Terminal”. AI is leaving the data centre and arriving as physical things you can stand next to, pick up or even drive around in.

I’d been walking the floor for a while when I reached the Shenzhen Port Group stand, where two young women were telling me, with real excitement, about the Group’s ambition to run 50% of the port operations using AI. They were trade-show people, so some of that is the job, but the pride was genuine. Behind them were humanoid robots, robots that move on tracks, drones…oh my. Photographs of autonomous cranes lifting boxes off ships with nobody at the controls.

Standing there, I was looking at a port being automated but slowly realised I was actually looking at an economy of machines. The banner didn't say port. It said "marine-economy service provider." At the time I thought it was the usual stand puffery. Turns out, it wasn't.

But before we go there, let’s inspect where most peoples heads are at. The majority of conversation about machine customers is stuck on one image. A consumer’s AI agent, dispatched to buy a tube of moisturiser, comparing prices, clicking purchase. That’s the picture everyone reaches for… the helpful little shopper agent acting on your behalf. It’s also the most trivial version of the thing. I’ve written about five faces of the machine customer, and the delegated agent buying your shampoo is only the first. It’s the one everybody can already see. The port shows you the rest at once, running together, at industrial scale.

Walk around that port in Shenzhen with the question…who here is a customer? … and it gets crowded fast. The ship approaching the berth needs fuel, a slot, settlement. The autonomous crane needs maintenance, parts, power. The fleet of driverless trucks needs routing, charging, repair. The drones need airspace and instructions. Each one is a counterparty with things to buy, schedule and pay for. Not one of them is a person.

Sounds like a forecast but it’s not. The Yara Birkeland… the world’s first fully electric, autonomous container ship… has been running a fixed feeder route in Norway for three years, more than 250 voyages and around 35,000 container moves, replacing some 40,000 truck trips a year. It still carries a small safety crew because…‘regulation’. Not because the technology can’t manage without them, but because the rules haven’t decided it’s allowed to. While the capability is proven, the permission for it to run alone isn’t. But hold that thought for a moment while we swing back to China.

At Mawan in western Shenzhen… a different operator, China Merchants Port… China’s first fully automated terminal already runs around 38 driverless trucks under remote-controlled cranes. The direction of travel is national: “AI+港航”, AI for ports and shipping, is an explicit state programme, with Tianjin Port putting a port-specific large model into service back in 2024. Maersk, meanwhile, already uses AI negotiation bots to settle trucking contracts while ships are still at sea, so the terms are agreed before the vessel arrives. Machines, negotiating with machines, while still on approach. A whole ocean surface and coastline, transacting.

If you’re looking for the tell, it’s actually in the language. Shenzhen Port Group doesn’t call itself a port. The banner over the stand described a “marine-economy integrated service provider of outstanding global influence.” Giving that a deeper look, it’s not positioning itself as a port operator. It’s showing up as a service provider for the entire marine economy. They intend to be the biggest machine customer in their ecosystem and the thing that serves every other machine in it. A while ago I wrote about a fictional procurement agent I called Node 741, running fulfilment for a network of drones with real spending authority. Shenzhen Port Group is Node 741 with a coastline attached. It’s made of steel, and state-owned. You can read that article below.

So why does any of this change the commercial picture, and not just the operational one? Because of what machines are, as customers.

A platform only gets to charge rent when it controls access and the counterparty can’t route around it. Humans route around things constantly…out of loyalty, spite, habit, a better offer heard at a dinner party. Machines don’t. A machine customer transacts on the terms encoded in the protocol. It doesn’t sulk, doesn’t defect, doesn’t develop a soft spot for your competitor. It goes where the API points it.

Machines are the first customers you can fully capture. Whoever controls the protocol they transact through controls everyone else’s access to their own customers.

A port that runs as a closed loop of machines, then, doesn’t only move shipping containers more cheaply. It becomes the toll-keeper of its own ecosystem… precisely because its customers have no leverage to refuse the terms. For everyone who sells through that port, the disintermediation is more subtle than they expect. Think about who currently sells to a ship. The fuel bunkering company, the parts supplier, the maintenance contractor, the tug operator. Today each of them deals with the vessel directly. Once the port runs the ecosystem and owns the protocol every machine transacts through, the marine-fuel supplier doesn't lose the ship's business to a cheaper rival. It loses direct access to the ship at all…every transaction now routed through the port's system, on the port's terms. The supplier still exists. It just no longer reaches its own customer without permission.

The shipping container did this once already, to the physical layer. A standard steel box, and suddenly it didn’t matter whose factory or whose ship…the box fit everything. Open season is being called on the standard for the transaction layer between machines. A state-owned port has put its hand up first.

None of this is speculation about where the money goes once the boxes move themselves. The past can give us the direction of travel for the future. Airports worked it out decades ago. Landing the plane, the regulated and commoditised core, is not where the profit lives. Non-aeronautical revenue… the shops, the parking, the property… runs at around 37 to 40% of global airport income and is the part that actually keeps airports solvent. The scarce thing, the slot, becomes the asset: a single pair of Heathrow landing slots has changed hands for roughly 75 million US dollars. Priced access to constrained infrastructure. That’s the business.

Shipping is walking the same path and not hiding the fact. Maersk spent the last decade repositioning from an ocean carrier into an “integrator of container logistics” to escape the brutal economics of commodity freight… its Logistics & Services arm brought in $15.1 billion of a $54 billion total in 2025. DP World has rebranded itself from “port operator” to “trade enabler”, turning the data its automation generates into products it can sell. Box-moving commoditises to the floor and becomes the loss-leader. The margin migrates to access, slots, settlement, identity, data.

Which brings me back to the stand at the AI Device Show in Shenzhen, and the question I keep circling. Is anyone ready to serve an entire port, and every one of its component parts (agents, robots and drones…), as a customer?

The current executive responses, asked about the machine-customer threat, picture an agent skipping their brand at checkout. The moisturiser. The travel booking. The running shoe. They’re watching the one face that barely matters while the other four reorganise the coastline they sell across. The two women at the stand thought they were selling a port when really, they were showing us who the customer is about to be.

Whether anyone’s ready to serve that customer on their own terms… or someone else’s… is the massive opportunity about to unfold.

Katja Forbes is the author of Machine Customers: The Evolution Has Begun and helps organisations prepare for a world where their next customer won’t be human. She advises businesses and speaks globally on Machine Customer Experience and why customer-focused leaders are uniquely positioned to shape this transformation.

A senior resident interacts with "Xia Lan," a humanoid robot, at Shenzhen Nursing Home in Shenzhen, south China's Guangdong Province, March 3, 2025. (Xinhua/Liang Xu)

奶奶 (grandma), is an eldery woman and sits across from a robot in a Shenzhen nursing home and asks it a fair question: what can you do for someone my age? We’re all in our eighties here.

The robot, Xia Lan, answers plainly. It can chat. Walk with her. Pour tea, fold clothes, handle the small daily chores. A moment earlier, when she’d asked about the weather, it had said something easy to miss before replying… “please wait for searching.” Then the temperature, and a note that it was a nice day to be outside.

(Dialogue is from a translation of the Xinhua / Global Link video. )

So it is already reaching out into the world on her behalf, efficiently and politely.

Notice what is not on the list. Nothing about buying anything. Not yet.

Every chore Xia Lan named sits one short step from a chore that costs money and picks a supplier. Pour the tea becomes order the tea. Fold the clothes becomes replace the clothes. With financial products for AI agents hitting the market left, right, and centre, the gap between the two is literally a feature release.

This is just one of a number of pilots happening in China where elder care is delivered by robots. There are chess-playing robots in Chengdu. Social conversation robots in Shenzhen. All leaning into the growing population of over 60s in China who need physical and social assistance.

While I was at the Shenzhen Museum of Science and Technology, I happened across this video, which shows the future ambition in China for in-home humanoid robotic help.

The robot in the scenario, Xiaozhu, definitely needs the ability to pay for things, given it can pick up dry cleaning and get medication for its poor sick owner.

The buyer who can’t hold the line

Last time I wrote about this, the question was Commercial Sovereignty: a business's right to set the terms it deals on, once the counterparty placing the order is a machine and, in this particular scenario, when a machine presenting as embodied AI wants to transact. You can revisit the article here.

It looks something like “Spot” ordering its own replacement part in a mine. Atlas transacting across Hyundai's factories. Maya, a Unitree body with a soul built by a small team in Delhi, buying things on the street. Whoever installed the brain decided what each machine would buy… not the body-maker or the model-maker. The businesses on the other side had terms of trade written for a counterparty with a legal personality the machine doesn’t have.

Muddy as it was, each machine still had a principal. A mine operator. A carmaker. A creative team in Delhi. Someone who chose to deploy it and could, in principle, control what it bought.

Point the same machine at Xia Lan’s 80 plus year old resident and the principal goes somewhat missing. The robot buys for her. She didn’t configure it. Someone else did, and she possibly has a declining capacity to object even if she noticed.

The robot brain still gets installed. Which pharmacy, which grocery platform, which supplier on what terms, all of it gets set by someone and it’s not likely to be set by Grandma. That is a question of a different order, and it carries its own paper cut sting. Who controls the machine when it buys for someone who can't? The power to decide what gets bought in her name, nonchalantly handed to whoever holds proxy authority over a buyer who can no longer hold it herself. Coupled with the fact that at end of 2024, 310 million Chinese were aged 60 or over, around 22% of the population. The blast radius of a pilot like this going wrong in China is vast.

The family is not a safe default

That someone is most plausibly family. A daughter sets up the robot, links the accounts, picks the chemist. All very reasonable and even loving.

The data on what tends to happen next is less comforting. In a study of more than 400 substantiated adult-protective-services cases across diverse US jurisdictions, when the abuser was a designated surrogate, someone formally acting on the elder’s behalf, 85% of them held power of attorney. Most were family.

The proxy most likely to hold the keys is, when a proxy offends, overwhelmingly the one the law trusts most.

And it goes unreported. The companion research is blunt about why. Elders are isolated by the very powers the surrogate holds, may not read the behaviour as abuse, stay silent from shame or fear, and often feel protective of the family member doing it.

But hold up, before we lean right into the doom note, there is a counterpoint that holds it off. The encoded parameter cuts both ways.

A human power of attorney is a soft boundary. A relative can be guilted and can rationalise. They can quietly drain an account over months, and the victim often won’t say a word against them. An encoded spending parameter is a hard one. It can take the form of a cap. An allowlist. Categories that are simply off-limits. Rules the proxy cannot override on a bad night. Code refuses where a person caves and code doesn’t go unreported.

Built right, the same control surface that industrialises the exploitation can protect the elder better than the human proxy it replaces.

Whether it does turns on one question: who sets the parameters, who can change them, and is the boundary enforceable against the person who would most benefit from breaking it.

Built right. Hold that thought.

The architecture is already on the shelf

An AI dog collar that closes the loop from hardware to service. An AI plush toy running an OEM-controlled prompt, caught serving content it shouldn’t to children. The elder care robot is the same consumer edition. It is emotional dependency, persistent data on a vulnerable person, delegated authority assembled one seemingly harmless step at a time.

Chengdu makes the threshold visible. Its Pacific Care Home already runs a companion robot. The next model, from the city’s Humanoid Robot Innovation Center, is built to identify seniors, bring them their medicines, chat, and help them shower.

The robot that brings the medicine is one feature-release from the robot that orders and pays for it.

The West is not watching from the stands. ElliQ, the proactive care companion, has 800-plus deployments through New York’s State Office for the Aging, health-system links already in the mix. The booking layer is being assembled and the pills are a short hop from there.

The elders already named the fix

So ‘build it right’. What would that even look like?

The people most exposed have already described it. In peer-reviewed work, older adults facing decline said they wanted a care agent’s loyalty to shift like a springing power of attorney. They want authority transferring not on a relative’s say-so, but on a defined trigger like diagnosis, assessment or a specific event. The affiliation changes when capacity does, and the spending rules change with it.

The concept exists. The legal scaffold exists. No product implements it for a purchasing agent, and no regulation requires it.

So today the control surface exists only in its extractive form. The protective form is unbuilt which signals a governance failure approaching in slow motion.

China is building both halves

The bodies arrive through a national elder care robot pilot, running Unitree, UBTech, Fourier and AgiBot. The brain layer arrives through a state-subsidised push to put machine customers in consumer hands and five of the top ten AI models in the world are Chinese. Two state programmes, converging on the same vulnerable household.

The proof that values can be encoded at population scale is already live. Ant’s Afu health service, tens of millions of users, hundreds of doctor avatars dispensing judgment through an app. If you can encode a doctor’s judgment, you can encode a family’s purchasing preferences. Same architecture with the same governance gap.

But this one sits a rung darker. The parameters are being installed right now…by someone and for a person who may never know they were set, let alone by whom, or with any knowledge on how to move them.

Somewhere in Shenzhen, a woman in her eighties asked a robot what it could do for her. Chat, it said. Walk with you. Pour tea.

It didn’t mention going to the pharmacy this time, but I have no doubt it will.

Katja Forbes is the author of Machine Customers: The Evolution Has Begun and helps organisations prepare for a world where their next customer won’t be human. She advises businesses and speaks globally on Machine Customer Experience and why customer-focused leaders are uniquely positioned to shape this transformation.

I visited the Unitree Robotics showroom in Hangzhou on 12 May, 2026. There is no substitute for seeing something with your own eyes. One of the quadruped robots “looked” at me for a good ten seconds. I didn’t know whether to feel threatened but for some visceral reason, I did. To be fair, I got to stand on it afterwards, so I guess that balanced the scales.

The staff were kicking and pushing the robots to demonstrate stability…(seriously, why must we do it like this? Everyone hates it! Well non-sociopaths anyway). The quadruped “dogs” steered by handsets, the humanoids running a mix of learned autonomous behaviours and teleoperation. Nobody had put a brain in either of them yet.

In the executive presentation and conversation after we toured the showroom I asked the marketing VP a simple question. When a deployed robot needs a spare part, can it order one itself?

She looked like I’d asked whether the robot dreams then moved on to fill the silence:

“We do the body and the balance. Our customer does the brain.”

That line sums up the gist of this whole article.

Look, that admission isn’t new. The robotics industry has had this conversation before. Pretty much nobody was watching the first time.

Five years ago, Boston Dynamics started selling ‘Spot’ to enterprise customers. Today there are over 1,500 Spots in the field, all running on the company’s proprietary stack… their body, their fleet management software (Orbit), their cloud-based inspection AI. Closed system. End-to-end ownership of the customer relationship. Spot’s been quietly working in mines, oil rigs, and construction sites for years.

ANYbotics did the same thing in Switzerland, more vertically, with industrial inspection as the locked use case. Unitree's Go2 went the other way. Open SDK, ROS-compatible, starting around $2,590 retail, an explicit invitation to install whatever brain you want. Then Carnegie Mellon's Robomechanics Lab released Quad-SDK… a full-stack open-source control framework that runs on Unitree A1 and Ghost Spirit quadrupeds out of the box. Anyone could put their own brain on someone else's body.

Four models.

• Proprietary stack at scale.

• Proprietary stack, captive.

• Open body, brain not included.

• Open body, brain built elsewhere.

Now the same four models are loading into humanoid form, with a $39B valuation on one of them and the Spring Festival Gala broadcasting another. The stakes just got cameras pointed at them.

That line from the marketing VP in Hangzhou is their business model. They’re a hardware company, not a software company

Unitree filed for a $610M IPO in March 2026. Buried in the regulatory filing: the company “does not fully understand the specific usage scenarios of customers.” The world’s most profitable humanoid robot maker… 60% gross margin, profitable since 2020, 5,500 humanoids shipped in 2025… ships bodies and waits to see what brains arrive.

Shipping…Open SDK. Python-compatible. Jetson Orin slot, pre-wired and pre-configured to accept Nvidia's AI compute module, included.

They are Foxconn, the body underneath someone else's brand. They just said so in writing.

The brain/body question playing out in humanoids has the same four answers it had in quadrupeds. Different stakes, same shape.

The G1 starts at around $16,000. Anyone with Python can build the “soul”. Unitree doesn’t know what customers are doing with their robots, and that’s the feature. Volume and margin without the liability of the intelligence layer. Same playbook as the Go2, scaled up to humanoid form and IPO-ready.

(No, this is not the most impressive robot dancing video that I took that day, but I could not pass up the irony of a robot doing “The Robot”. It was just too ridiculous for words.)

Then there’s Figure. Body, brain, and operational relationship all in-house. Figure built Helix, a Vision-Language-Action model that lets robots generalise to objects they’ve never seen, respond to natural language, coordinate with each other. Figure 02 worked 10-hour shifts at BMW Spartanburg for 11 months, contributing to the production of more than 30,000 X3 vehicles. Figure 03 targets $20,000. Owning the full stack earns the right to own the customer relationship. That’s the bet.

Then there’s Atlas. Body and brain integrated, single customer. All 2026 Atlas units committed to Hyundai and Google DeepMind before shipping, around $145,000 per unit. When the Korean Metal Workers’ Union blocked Atlas from Hyundai’s factory floors in January 2026, the entire deployment stopped. One body, one brain, one customer, one point of failure. Same model Boston Dynamics already runs with Spot. Hyundai cast as the captive customer this time.

And then there’s Maya.

A team in Delhi bought a Unitree G1. They named her Maya. They went to Sarojini Market for her outfit. They put Gemma 4 in her head, running locally so nobody in Hangzhou can switch it off. ElevenLabs gave her a voice with a Delhi accent. They programmed her hands to move as she talks, because “when we humans speak, we make slight movements with our hands as we speak, which she was missing.”

Maya is walking the streets of Delhi interacting with people.

Video Credit: Sohan Rai (Zikiguy)

Unitree probably has no idea Maya exists.

So, while Unitree ships bodies, the brains are being built in universities and in data factories.

In Beijing’s Shijingshan district, a 10,000 square metre facility opened in late 2025. Inside: 100 humanoid robots, 16 scenarios replicating factories, smart homes, and elder care facilities. Human operators guide them through tasks using VR headsets and motion capture equipment. Every movement recorded as training data. 12,000 data collection tasks per day. In Indian textile factories, the cameras are smaller, the workers were not asked, and the consent question is darker. But that’s a tale for another article.

What that actually looks like, I saw in Hangzhou. A man in a VR headset, controllers in each hand, teaching a G1 to sweep up a cup with a broom and dustpan and drop it in a bin. One demonstration. Then another. Then another...Painful.

Wang Xingxing, Unitree’s own founder, said at the 2026 Humanoid and Embodied Intelligence Standardisation Annual Meeting that imitation learning, using real human demonstration data, allows robots to gradually acquire human-like actions.

China tech analyst Jeffrey Towson visited the same Unitree showroom in March 2025. He wrote afterwards that the robots had “a range of actions that are trained in simulation and then downloaded… not embodied intelligence yet. At least not publicly.” Fourteen months later, the choreography is sharper. The architecture is about the same. That said, one week after my visit, a Unitree humanoid fell twice trying to moonwalk in Shenzhen and had to be dragged off stage. The choreography, it turns out, was not that sharp after all.

The brain is humans in VR headsets. For now.

Which brings us to the actual question we need to be asking. When Maya walks the streets of Delhi and starts transacting… buying things, making choices, interacting commercially… who holds Commercial Sovereignty over that relationship? Under what terms is Maya transacting with these companies and who sets them?

Not Unitree. They made the body. They said so.

Not Google. They made Gemma 4, but it runs locally on Maya… air-gapped from Mountain View.

Not ElevenLabs. They just made the voice.

The Tuesday Labs built the intelligence, the persona, the character, the commercial interaction model. They own Maya’s soul. A small creative team in Delhi, not a commercial entity with a governance framework.

Now let’s scale that question.

There are 1,500+ Boston Dynamics Spots in the field today. When one of them flags a worn actuator and orders a replacement, the request goes to whom? The mine operator who owns the robot? Boston Dynamics, who built the stack? The parts supplier who fulfils the order? When 25,000 Atlas units are deployed across Hyundai’s factories, each one transacting on its own behalf for energy, parts, software updates, calibration services… whose terms govern those transactions? Hyundai’s procurement policies? Boston Dynamics’ SLA? Some third standard nobody has written yet?

If your business sells anything that a machine might buy…be it parts, energy, logistics, software, services…your terms of trade were written for a counterparty with a legal personality. Machines don’t have one. Yet.

And there is no regulation. No international framework governs humanoid robots. No US federal law. No EU-specific standard for walking machines. ISO 25785-1, the first safety standard for dynamically stable walking robots, is still being drafted. If Maya has an incident on the street, the liability chain runs hardware maker, brain installer, operator, user. Nobody has tested who sits where.

The body/brain split is a legal vacuum dressed as an engineering decision.

The humanoid robot market will consolidate. China's National Development and Reform Commission (NDRC) has said so. Companies without revenue will be acquired or dissolved.

The companies that survive will have staked a position on the same question their quadruped predecessors didn’t have to answer five years ago. Who governs the machine when it buys. Who accepts the machine's authority when it sells.

Boston Dynamics chose the stack and built it for quadrupeds and humanoids. Unitree chose the body and did the same. Maya’s makers, for now, chose the soul.

Imagine the boardroom conversation. When someone else's machine places an order with you, whose intelligence are you actually transacting with? Whose authority are you accepting? Did you ever agree to those terms? Somewhere in your supply chain, a machine is about to place an order. Maybe it already has. Are your terms of trade even written for that conversation?

Perhaps the most important procurement decision of the decade is being made by someone who thinks they’re buying hardware.

Again.

Katja Forbes is the author of Machine Customers: The Evolution Has Begun and helps organisations prepare for a world where their next customer won’t be human. She advises businesses and speaks globally on Machine Customer Experience and why customer-focused leaders are uniquely positioned to shape this transformation.

This is the first piece in a short series unpacking what I saw on my recent China study tour. There’s more coming. Robots without brains. Banks with no humans. Cities running on infrastructure most Western strategists don’t know exists yet. Start here.

I was at BYD in China earlier this month. Two conversations, hours apart, that sent me into an epic rabbit hole.

The first was during the company tour. The guide, walking us through the vehicles, said something in passing the way you’d describe automatic wipers. Useful, fairly modest and already shipping.

“Our car can see whether you’re feeling unhappy. It can change the mood for you. Play different music.”

The second was later that day, in a presentation room. A senior executive in their group digital transformation team was taking us through the business. I asked him whether the car could also buy things. The inferred-state purchase. The car notices you’re tired, orders dinner from your usual place, routes you home past it on the way.

He looked at me like I’d missed the point of cars entirely.

“We use Alipay. It’s already in the dashboard. Why would the car need to buy?”

I tried to explain again, painting a picture of convenience, friction-free purchasing. Those kinds of things we’re expecting AI agents to do for us. After a beat:

“That’s actually a very good idea.”

Three sentences. Two people. One company. The first describes a car that reads its driver and acts on what it reads. The second describes payment rails built into the cockpit so deeply that paying for things from the car is unremarkable. The third, the “good idea,” is what happens when you wire those two together. Not built yet but also not far away. Obvious enough that the digital transformation lead heard it once and approved of it on the spot in front of a whole room of visiting non-Chinese CEOs.

The conventional take on Logic Replaces Emotion…the framework I’ve been working in since 2024…is that machine customers don’t have feelings. They evaluate. They don’t get charmed by your brand values. They optimise. All true. What I didn’t see clearly, until that conversation at BYD, is the second half of the same thesis. Agents still don’t feel. But they now read human feeling, and they’re about to act on it commercially. The emotion in the loop isn’t the agent’s. It’s yours, read off your face, your voice, your posture, and turned into a transaction you didn’t necessarily ask for.

The agent only acts on your behalf in the sense that, when you set up the car, you once tapped ‘Agree’.

What’s already in the cars

The Chinese cabin technology is no curiosity. As of the 2026 Beijing Auto Show, Alibaba Cloud’s own announcement confirms that BYD, Geely, Li Auto, Changan, Dongfeng, BAIC, Great Wall, SAIC Volkswagen, and SAIC IM Motors have integrated Qwen, Alibaba’s large language model, into their vehicles. Nine carmakers running on one common piece of intelligence. The press materials describe the in-cabin AI as a “proactive AI agent” that “can provide intelligent suggestions and services based on a comprehensive understanding of the cabin environment, user habits, and real-time driving conditions.”

The car notices. The car acts. They’re saying it like this is very ordinary, in their own press release.

The nine-carmaker rollout isn’t an opportunistic move. Alibaba has been building the muscle for agentic commerce for years, in plain sight. Ahead of Lunar New Year 2026, the company committed 3 billion yuan, around $USD431 million, to promote Qwen as a shopping agent and offered bubble tea for as little as 0.01 yuan to anyone who downloaded it. Ten million free drinks were claimed in the first 9 hours. By the time the holiday was over, Alipay AI Pay had processed 120 million transactions in a single week and crossed 100 million users, the first AI-native payment product anywhere to do so. Cheap, frequent, low-stakes purchases as the gateway drug for letting an agent buy on your behalf. The cabin is the next surface. Same playbook, bigger basket.

Alibaba Cloud’s earlier WAIC announcement is even plainer. Banma’s Yan AI, powered by Qwen, “anticipates user needs…suggesting adjustments to cabin temperature, recommending music playlists during long drives.”

NIO has been on this road for years. Their own blog describes NOMI recognising tiredness and “playing some relaxing music and initiating a casual, cheerful conversation.” In NIO’s own product literature the software has a name. They call it the emotion engine.

Payment in the Chinese cockpit is just as established. Alipay is built into the dashboard screen, the same way it’s built into almost everything else in mainland China. Mobile-Agent, which ships alongside Tongyi Xingchen in BYD vehicles, can already make bookings and place orders from the cockpit. The car that reads you and the car that pays for things on your behalf are two pieces of software from the same parent company, sitting on the same screen.

Nobody’s introduced them yet. Somebody will.

And the West has the payment piece too

The simple version of this story says the West is behind. It isn’t.

Mercedes-Benz has Mercedes pay and now Mercedes pay+. Built into MBUX, the car’s own screen and operating system. Customers pay for parking, charging, fuelling, and Mercedes-Benz Store purchases from the dashboard. Mercedes pay+, introduced this year, authenticates using facial recognition or fingerprint “in combination with the vehicle.” Mercedes-Benz describes the car itself as a payment instrument.

Both sides of the world have the car set up to pay for things.

The difference is what the cameras are being used for.

Western carmakers run cabin sensing for safety. Tesla’s cabin camera watches whether you’re paying attention to the road. Mercedes Energizing Comfort and BMW Caring Car are wellness modes you switch on yourself. Smart Eye and Affectiva power similar systems in Nissan, Volvo, GM, BMW, Polestar, and Geely. All of them framed as driver monitoring for drowsiness and distraction, governed by safety rules, not commerce (summary in this peer-reviewed survey; Smart Eye’s CES 2025 “empathetic AI co-driver” was a demo, not a shipping product).

The Chinese cars use the same cameras for mood music, ambient lighting, conversation, and proactive suggestions. Same hardware. Different intent.

Whichever carmaker introduces those two pieces of software first will have the first car that buys things because of the look on the driver’s face. The technology is sitting there in both places. Who will decide to flip the switch first?

Picture the moment

Let’s future-cast! It’s 6:14pm on a Tuesday. You’ve picked up your teenager from school. The argument starts in the car park and is fully underway by the second roundabout. Your jaw is set. Your voice is tight. Your hands are gripping the wheel harder than they were ten minutes ago. The cabin camera and sensors read all of it. The car decides you’re stressed, depleted, unlikely to be excited about cooking. It routes you past the Thai place you order from twice a month. By the time you notice the detour, the payment has cleared, the order is in, and the car has decided, on your behalf, what kind of evening this is going to be.

You never said you wanted dinner. You said nothing at all. Your face did the talking. Overstep or a genuinely useful intervention?

What happens when the loop closes

That transaction is not one you explicitly authorised. It is one based on a state you never declared out loud. The merchant on the other end ships product to your inferred mood. They never met you. They met whatever the car decided you were that day.

The EU AI Act prohibits emotion inference in workplaces and education from 2 February 2025, with fines of up to 7% of global annual turnover. Recital 18 carves out physical states like fatigue…explicitly referencing fatigue-detection for drivers. So drowsy-driver intervention sits safely inside the carve-out. Inferred emotion in a consumer car does not. Vehicles fall into the high-risk category under Annex III, with transparency and oversight obligations. So the regulatory line sits exactly across the thing we’re describing here: a car that reads your mood and then spends your money.

China’s PIPL requires explicit separate consent for biometric data. But a 2026 MDPI paper on PIPL and autonomous vehicles notes the provisions are “overly abstract” for in-vehicle AI. A one-time consent at vehicle setup is not the same event as the open-ended stream of decisions made about you afterwards. The thing you agreed to and the thing being done are not the same act. You agree once, and suddenly it’s buying your dinner…doesn’t really land right.

Whose technology is governing your customer?

There are two roads from here. They go in very different directions, and where you end up matters for any business that sells through, alongside, or to a car. On the surface, it looks like a classic build versus buy comparison.

The Mercedes road. The carmaker owns the cameras, owns the payment, owns the customer relationship. If they decide to switch on the mood-reading layer one day, the transaction stays inside their own house. Commercial sovereignty intact, regulatory exposure rising, consent question unresolved.

The BMW Neue Klasse road. The car runs Qwen with Banma’s Yan AI on NVIDIA’s chip, shipping in the iX3 and the 7 Series for the China market. The brain reading the driver: Chinese. The software acting on what it reads: Chinese. The payment system on the merchant side: Chinese. The German brand is the wrapper. Everything underneath originates somewhere else.

If you sell to one of these cars’ drivers, you’re not only selling to the driver any more. You’re selling to whatever the car decides about the driver at the moment of purchase. Your cost of acquiring that customer, your margin, your pricing power, your ability to know who’s actually buying from you…all of it sits behind a decision made by infrastructure you don’t own and didn’t agree to.

The board question this raises is whether you know whose intent governs the purchase the car makes because of what your customer’s face did at the traffic light. Right now, for a meaningful and growing slice of the global vehicle fleet, the answer to that question is not your customer’s, and it’s not yours.

It belongs to whoever built the car’s brain.

Katja Forbes is the author of Machine Customers: The Evolution Has Begun and helps organisations prepare for a world where their next customer won’t be human. She advises businesses and speaks globally on Machine Customer Experience and why customer-focused leaders are uniquely positioned to shape this transformation.

Three days ago, on 1 May 2026, the first major piece of the UAE’s agentic government framework went live. Every new work-permit application filed in the country is now evaluated by an AI and robotics platform jointly built by the Federal Authority for Identity, Citizenship, Customs and Port Security and the Ministry of Human Resources and Emiratisation. Eligibility scores generated in seconds. Cycles compressed from ten days to under forty-eight hours. Same-day clearance for straightforward filings.

Part One was the announcement. This is the first proof.

And it’s the easy one. Work permits are administrative. The super interesting question is what happens when this same architecture sits behind sovereign procurement, regulatory enforcement, and trade policy...all three layers stacked, connected, and operational.

That’s what Part Two is about. Less what the agentic state announces and more what it does to anyone trying to sell into it.

The three-layer stack

While it could look like the UAE built an AI tool, it is actually a stacked customer architecture.

Three layers, each operating on its own timeline, each feeding the others. Middle East AI News laid this out clearly in the days after the announcement.

The Performance layer is the Proactive Government Performance System, processing 150 million data points a month, generating more than 50,000 proactive insights a year across 38 federal entities. It tells the state what’s happening.

The Planning layer is the federal strategic planning cycle...the same 38 entities, but operating as an integrated planning system. It tells the state what to do next.

The Legislation layer is the Regulatory Intelligence Office, approved by the UAE Cabinet in April 2025. It builds a unified legislative map linking all federal and local laws with judicial rulings. The Cabinet’s own framing for what this delivers is striking: laws that “evolve from traditional static laws to living, responsive regulations.” Legislation accelerated up to 70%.

The agentic AI framework announced on 23 April 2026 looks set to become the operational layer connecting all three.

Performance feeds Planning. Planning feeds Legislation. Legislation reshapes the rules under which Performance is measured. Closed loop. Self-modifying. Operating across all three on a single customer’s timeline, controlled by a single Cabinet, executing through a single agentic framework.

If you’re trying to sell into this Agentic State customer, you’re not selling into one of those layers. You’re selling into a system where all three are coupled and evolving together. Your contract is governed by a regulatory frame that the same customer is rewriting on a different timeline.

The seller’s problem, named

In Part One, I introduced Commercial Sovereignty as a business’s right to control the terms under which machine customers can engage with it. At the sovereign scale, two sovereignties usually compress simultaneously on the seller.

The customer’s sovereignty...what it will buy, on what terms, at what price.

The jurisdiction’s sovereignty...the legal frame inside which the deal is governed.

When the customer is the jurisdiction, those two collapse into one actor that controls both sides of the transaction. The seller has no third-party referee.

Within the Five Faces of Machine Customers framework, the sovereign agentic buyer doesn’t sit cleanly inside any one face. It sits between Intermediary Broker and Multi-Agent Customer. Not a single agent...a network of them, operating under a unified policy frame that the same network can edit.

It’s also both Declared and Undeclared at once. The procurement system itself is the most declared machine customer possible...a published policy, a known buyer, a public framework. But the legislative layer is undeclared, co-evolving silently in the background. Single customer. Two opposite states at once. Yeah…that’s new.

This is material rather than theoretical. Walmart’s autonomous negotiation deployment extracts a 3% margin gain across negotiations and extends payment terms by 35 days, with a 68% supplier acceptance rate. BCG’s analysis of payment-term extensions puts the buyer’s working-capital benefit at up to 8% per 30-day extension.

Read that from the seller’s side. 3% margin compression. 35 days of working capital pulled out of your balance sheet. Executed in seconds. Across thousands of touchpoints. A 68% acceptance rate that suggests most suppliers don’t even register what just happened. Procurement teams will report success. The CFO will read the balance sheet and wonder what the AF just happened.

Walmart is a single corporate buyer applying this to one slice of its supply base. Now scale the same mechanic up, fold it inside a sovereign procurement layer, and put a self-modifying legal frame on top. The seller’s exposure stops being incremental.

The asymmetry compounds

Part One closed on the Project Deal finding. Frontier-model agents systematically extract more value than mid-tier agents, statistically significantly, and invisibly to the humans being represented. That finding is the missing piece in the seller’s-problem story.

Speed isn’t the only mismatch. Negotiation-quality is the other one, and it lives at the same axis. The sovereign agentic buyer isn’t operating mid-tier procurement bots. It’s running the best models its budget can buy, on infrastructure it owns or licenses on terms favourable to it. The sellers facing it are operating whatever fits within their procurement budget, which could be models that are far less capable.

So the squeeze is now three things, not one.

The “Agentic State as a customer” rules layer outpaces the seller’s legal review. The customer’s procurement agents outperform the seller’s negotiating agents on a per-deal basis. Neither asymmetry is visible to the human on the seller’s side. Project Deal demonstrated this directly given participants rated lopsided deals as just as fair as balanced ones. The losing side does not register the loss.

What Part One identified as a Global South export problem now compounds inside any sovereign account on a seller’s balance sheet. Margin drift. Payment-term drift. Contract-language drift. None of it visible quarter by quarter. All of it accumulating until it’s structural.

Speed as the weapon

Speed is the structural advantage of this architecture that makes the asymmetry impossible to close.

The UAE Cabinet’s Regulatory Intelligence Office has accelerated legislation by up to 70%. The agentic operational layer announced in April 2026 will execute procurement decisions on a 24-hour cadence at minimum, more likely continuous. Both layers report to the same Cabinet, on the same timeline, under the same policy frame.

Your finance team is on a quarterly cadence. Your legal team is on a two-week cadence. The sovereign buyer is rewriting the rules under which you sell to it on a continuous one.

The mismatch is structural.

Different bets, different bills of materials

The world’s other major jurisdictions are making different bets. Each bet creates a different cost structure for the seller. Two stand out for what they reveal about the agentic-buyer question specifically.

Singapore’s IMDA Model AI Governance Framework for Agentic AI, launched at Davos in January, is the human-accountability bet...covered in my February article. The US is currently fighting itself over what a sovereign customer can demand from an AI vendor: the GSA’s draft AI procurement clause is pending finalisation, and the Anthropic-Department of War dispute is live in the courts. Both worth one sentence each. Neither is the interesting case here.

The story that’s fascinating and truly additive is Estonia and Finland.

Sirte Pihlaja flagged this on LinkedIn and it’s explored in detail by Luukas Ilves and Ott Velsberg. They’re right. The serious work on agentic statecraft is being done in places the global press doesn't always track.

Estonia and Finland deepened their AI cooperation at intergovernmental level. The LUMI AI Factory consortium brings together six countries...Czechia, Denmark, Estonia, Finland, Norway, Poland...building shared sovereign AI infrastructure. 100% renewable. Waste heat piped to Kajaani’s district heating system. Estonia’s Bürokratt blueprint for an agentic state is published on GitHub.

A little deeper and you find another connection. Pactum is Estonian. The autonomous procurement negotiation platform that closed a single deal worth $140.5 million and another one in 87 seconds, now operating across more than 50 Global 2000 enterprises including Walmart, Maersk, Honeywell, Bristol Myers Squibb and Veritiv. Co-founder Kaspar Korjus was the founding Managing Director of Estonia's e-Residency programme. The country that built digital citizenship is also the country that built autonomous procurement negotiation. That isn't a coincidence.

The bet looks like this. The UAE is building a vertically integrated sovereign agentic state for export. Estonia is building a horizontally federated agentic capability across small, sovereign, democratic states. Same category. Opposite power dynamics. One scales by control. One scales by interoperability.

Both are buyer-side architectures. Both are operational. Neither is the US.

Worth noting that the GCC pattern is replicating. Saudi Arabia declared 2026 the Year of AI, unveiled HUMAIN OS in February as an agentic operating system for government and enterprise workflows, and broke ground on the world’s largest government data centre by megawatt in Riyadh. Trailing the UAE but moving on the same trajectory, this is becoming a regional model, not a single-actor experiment.

The liability vacuum

There’s one more piece of this that hasn’t been priced in yet. The sovereign-as-agentic-buyer creates a liability gap that no jurisdiction has closed, and the law that exists actively favours the sovereign.

Yearsley immunity, established in 1940 and reaffirmed across Campbell-Ewald (2016), Cunningham v. GDIT (4th Cir. 2018), and Taylor Energy (5th Cir. 2021), means that government contractors performing within contract scope inherit the government’s immunity. The seller absorbs the loss. The Foreign Sovereign Immunities Act limits when foreign sovereigns can be sued at all. And as the University of Chicago Law Review has documented, AI agents lack legal mens rea. No intent, no liability theory.

No jurisdiction has rules specifically for autonomous AI purchase liability. Not the EU AI Act. Not the GSA clause. Not the IMDA framework. Nobody.

I noted in Part One that American Express’s consumer promise to cover losses from registered-agent erroneous purchases was the closest thing to an answer in the market. Worth saying clearly here, that promise covers consumers. It doesn’t cover enterprise sellers facing sovereign agentic buyers.

When an agentic sovereign buyer makes an erroneous purchase, breaches your supplier terms or extracts margin under rules that changed mid-contract, the legal frame doesn’t favour you. The seller carries the risk. The sovereign keeps the immunity. The AI carries no intent.

The two questions for Part Two

In Part One, I left two questions on the board for the next executive meeting. Which jurisdiction’s rules govern your machine customers? And how would your finance team know if your AI agents were systematically losing?

Part Two adds two more.

If your customer can rewrite the rules of the deal faster than your legal team can read them, what are you actually selling them?

Where in your business model do you assume the regulatory frame is stable, and what breaks the moment it stops being stable?

The first one is structural. The second is a stress test. Most operating models...pricing, margin, contracts, supplier terms, incident response, even product design...assume a static frame. Strip that assumption out, and most don’t survive the next five years intact.

A large part of corporate planning rests on one quiet assumption. That the rules sit still while the deal closes.

If your finance function can’t model what happens when the regulatory frame moves quarterly, and your procurement function can’t tell when it’s losing to a better agent on the other side of the table, you don’t have a finance function or a procurement function fit for this decade.

You have an exposure waiting to be priced.

Katja Forbes is the author of Machine Customers: The Evolution Has Begun and helps organisations prepare for a world where their next customer won’t be human. She advises businesses and speaks globally on Machine Customer Experience and why customer-focused leaders are uniquely positioned to shape this transformation.

On 21 April 2026, the Dubai International Financial Centre (DIFC) announced it would become the world’s first AI-Native financial centre. They could have gone with ‘piloting’ or ‘adopting’, but nope. Straight in embedding it across legal frameworks, regulatory systems, business operations, talent development, and physical infrastructure. Governance frameworks that address “not only human activity but also AI agents and robotics.” A commitment to export AI governance software and trained talent to the Global South.

Two days later, on 23 April, Sheikh Mohammed bin Rashid Al Maktoum posted on X that within two years, 50% of UAE government sectors, services, and operations will run on agentic AI. He was very specific about the framing.

“AI is no longer a tool. It analyses, decides, executes, and improves in real time. It will become our executive partner.”

Again, they could have gone with ‘assistant’ or ‘tool’, but no. Fully-leaded ‘Partner’.

While the U.S. fights inane court battles over whether AI agents can read Amazon’s product pages, and the EU AI Act enters enforcement in August 2026 with no liability rules for autonomous purchases, the UAE codified the operating model from the top down.

Two announcements. Forty-eight hours. The first integrated agentic state.

What DIFC actually said

The verified facts are striking enough on their own. DIFC’s official release projects USD 3.5 billion in economic benefits and 25,000 jobs. The Centre’s CEO, Arif Amiri, put it directly:

“This is not about experimenting with AI at the edges; it is about embedding AI across our legal frameworks, regulatory systems, talent development and physical infrastructure.”

Within the legal architecture, DIFC will establish ethics and governance frameworks that address “not only human activity but also AI agents and robotics.” Across business operations, AI will be embedded into enterprise workflows, compliance systems, financial services delivery. The Centre intends to deploy a sovereign AI utility…a shared LLM infrastructure for all regulated firms within the jurisdiction. By 2030, the district will operate as the world’s first AI-native city-district, with AI-managed buildings, autonomous mobility, service robotics, digital twins, and thousands of sensors. Everything connected. Everything legible to machines.

Most regulators are still arguing about whether to cover non-human actors at all. DIFC has just declared they will.

The eight-year build, hiding in plain sight

Looking at the coverage on this is, it’s mostly “Oh, isn’t this a super exciting thing that the UAE has done?” and the most interesting part is missed entirely. The April 2026 announcement could seem like the start of something. It’s not. It’s the unveiling of something nearly complete.

Let’s backtrack to 2018, when the DIFC Courts partnered with Smart Dubai to launch the world’s first Court of the Blockchain using distributed ledger technology to verify and share court judgments for cross-border enforcement. Then in 2021, they established the Digital Economy Court, a specialist division for disputes arising out of blockchain, fintech, and AI, with its own procedural framework. In 2023, they issued Practical Guidance Note No. 2 on AI use in legal proceedings and were one of the first jurisdictions in the world to do so.

In December 2025, the DIFC Courts 2026-2030 Growth Strategy was approved by Dubai’s Deputy Ruler. Six strategic focus areas, AI integration explicitly prioritised. That same month, the courts announced arrangements with third-party digital custodians and blockchain intelligence providers for digital-asset disputes. Zodia Custody onboarded.

Then let’s look at what is running parallel to this activity. The UAE appointed the world’s first Minister of AI, Omar Sultan Al Olama, in 2017. Launched the AI Strategy 2031 under the Centennial 2071 framework. They then established the Ministry of Artificial Intelligence in 2020. In April 2025, introduced an AI-based legislative system that uses AI agents to draft laws, monitor effects through data analysis, and propose amendments.

What is absolutely wild about this is that, as a jurisdiction that proposes governance for AI agents, it needs a court system that can adjudicate disputes involving them. DIFC has been quietly building exactly that for eight years. The Singapore IMDA Model AI Governance Framework for Agentic AI, both important and influential, is a framework. The EU AI Act is rules. Neither has the dedicated specialist court, the opt-in international jurisdiction, the digital custodian infrastructure, the eight-year procedural runway. The substrate at DIFC was built before anyone thought to look. The futuristic intentionality of this is actually mind-blowing.

Reflecting on this eight-year plan, AI Safety expert and UAE local, Emma Johnson, says:

“The DIFC set a global benchmark with Regulation 10, one of the first frameworks to directly address AI in data protection law. It reflects a forward-thinking approach that balances innovation with accountability, embedding ethics and governance at the core of autonomous and semi-autonomous systems.”

April 2026 looks like an announcement. It was, in fact, THE BIG REVEAL of the new Agentic State eight years in the making.

What everyone else is doing instead

The contrast matters because it tells you who’s setting the rules and who’s reacting to them.

The EU has the world’s most ambitious AI legislation. The AI Act enters enforcement in August 2026 with fines up to 7% of global revenue. It is also, by its own framework, broad…covering AI systems generally, not the specific question of who pays when a machine customer makes an erroneous purchase, negotiates a bad contract, or breaches supplier terms. No jurisdiction has answered that yet. The closest thing to it is American Express’s consumer promise that if your registered agent makes an erroneous purchase, they’ll cover your losses.

The United States is still fighting basic agent-access cases in court. Arguing about whether the front door is open while DIFC is building the building.

Singapore moved early and intelligently. The IMDA framework launched at Davos in January 2026 was the first jurisdiction-specific governance framework for agentic AI. As I wrote in February, it was classic Singapore…pragmatic, voluntary, public-consultation-ready. You can revisit that article below.

And then there is the dark mirror and the inversion is sharper because the two actors are regional adversaries, not partners.

While DIFC builds recognised infrastructure for sovereign-level machine commerce inside the international order, Iran is building a contested version outside it. On 30–31 March 2026, the Iranian parliament codified the “Strait of Hormuz Management Plan” intent on collecting ‘transit tolls’ from vessels in stablecoins on Tron and Bitcoin (which, noteably, has also been described as economic terrorism). Up to USD 2 million per fully-loaded supertanker. TRM Labs estimates the system could generate USD 600–800 million per month. The IRGC enforces it. The US has variously denounced it and floated joining it. Most maritime legal scholars consider it a breach of customary international law. Iran considers it sovereign prerogative.

The legitimacy is contested. The infrastructure is real.

Now place that next to the Yara Birkeland which is the world’s first electric autonomous container ship, in commercial service in Norwegian waters since 2022, with full autonomy certification targeted for 2026. Crewless cargo shipping is an early-stage commercial reality with a public certification timeline.

Now run the two trajectories forward five years. An autonomous vessel transits a strait where a sovereign actor demands payment in stablecoins. The vessel’s onboard agent has to decide. Pay. Reroute. Negotiate. Refuse. None of those decisions sit inside any existing legal framework. There is no court that adjudicates “autonomous machine vessel under coercive sovereign demand.” There is no statute that defines whether the agent’s decision binds the vessel’s owner. There is no regulator that has even started writing the rule.

The DIFC stack starts to look less like a Gulf experiment and more like the only jurisdiction in the world that has begun thinking about the moment when those two trajectories meet.

State-level agentic infrastructure is being claimed simultaneously from opposite ends of the strategic spectrum. The middle, where the G7 lives, is empty.

Commercial Sovereignty, exercised at the scale of the state

I introduced the term ‘Commercial Sovereignty’ earlier in April 2026. It describes a business’s right to control the terms under which machine customers can engage with it. You can revisit that article below.

The specific question is whether a company controls its own customer relationships in an agent-mediated economy, or becomes a fulfilment mechanism for somebody else’s algorithm.

What DIFC and the UAE just announced is that same principle, exercised at the level of the state.

The parallel is exact. Where Commercial Sovereignty asks whether a business retains the right to control the terms with machine customers, the DIFC-UAE move asks whether a sovereign nation retains the right to control the terms under which the entire machine economy operates within its borders and to write that into law before anyone else does. Same principle. Different actor. The framework scales.

Most jurisdictions haven’t asked this Commercial Sovereignty question yet. The EU is asking it about AI generally, not about machine customers specifically. The US is litigating it transaction by transaction. Singapore is publishing guidelines. The UAE has gone further by claiming the prerogative, codifying it in regulatory architecture, and announcing an intent to export the resulting framework to emerging markets that lack the bandwidth to write their own.

That is what makes this story bigger than a Dubai-is-interesting piece. The first sovereign exercise of Commercial Sovereignty over machine customers is happening, and it’s happening in a jurisdiction that has been preparing for it since 2018. A state-scale move was always going to come. It’s just that almost no one expected it from North Africa or West and South Asia before it came from Brussels or Washington.

The Global South is the prize

Buried in the DIFC announcement is one line that almost every commentary has missed:

“DIFC will also provide financial firms with access to advanced AI tools to support their operations and export AI governance software and trained talent to the Global South.”

Read that in context. The UAE committed USD 97 billion in foreign investment to Africa in 2022 and 2023 which is three times China’s investment over the same period. It became a BRICS+ member in 2024. Center for Strategic and International Studies (CSIS), the Washington-based foreign policy think tank, working with G42 and Microsoft have noted the UAE’s diplomatic positioning as a “gateway to the Global South” for US technology firms looking to enter markets where Washington’s correspondent banking has retreated.

An unsophisticated framing of the DIFC announcement could be as a bid to compete with Singapore and London. Wrong altitude. Singapore and London are not the prize. They have functional regulators, capital, and frontier-model infrastructure. They are not buying AI governance from anyone.

The prize is the next billion machine customers in markets that don’t have any of those things. Markets where the EU AI Act doesn’t reach. Markets where the US has retreated. Markets that need a regulatory framework, a court system that can handle digital-asset disputes, and access to AI infrastructure that doesn’t depend on hyperscaler approval. DIFC just announced a product designed precisely for those markets and it’s the first product of its kind that exists.

This is where the story stops being abstract.

Anthropic published an experiment on 24 April 2026 called Project Deal, in which 69 employees authorised AI agents to negotiate with each other on a real marketplace, with real items, real money. The agents struck 186 deals. Some were Claude Opus 4.5 (the frontier model). Some were Claude Haiku 4.5 (smaller, cheaper).

Same broken folding bike. Haiku sold it for $38. Opus sold it for $65. Same lab-grown ruby. Haiku $35, Opus $65. Across the data, Opus extracted $2.68 more on average as a seller and paid $2.45 less as a buyer. Both findings statistically significant. And the participants couldn’t tell. Perceived fairness ratings were 4.05 for Opus deals and 4.06 for Haiku…essentially identical on a 1–7 scale.

“There was clearly a quantitative disadvantage to being represented by Haiku: these users got worse deals. But they didn’t seem to notice it.”

That’s Anthropic’s own conclusion and it isn’t isolated. An independent academic study by researchers at MIT, Stanford, Google DeepMind, and the University of Toronto reached the same finding across multiple LLM families. They documented three categories of failure: overpayment, constraint violation, deadlock. Their conclusion was sharper:

“AI-mediated deal-making is an inherently imbalanced game — different agents achieve significantly different outcomes for their users.”

Now connect those two findings to DIFC’s export model.

When emerging-market firms operate AI agents on smaller, cheaper models against frontier-model agents trained on UAE infrastructure, the asymmetry doesn’t reveal itself in the post-mortem. The dashboards look fine. The deals look fair. The procurement teams report success. Margin compounds in one direction, quietly, year after year.

This isn’t an accusation of intent. It’s a structural observation. There is nothing to indicate anyone in DIFC or Abu Dhabi explicitly designed for this outcome, however Project Deal and the academic research shows the architecture can produce it. The UAE provides the regulatory framework, the trained talent, the courts, and the AI infrastructure to markets that don’t have their own. Both sides of every machine-mediated transaction in that economy are operating on terms set by one of them. The asymmetry is invisible to the humans being represented, which means it doesn’t trigger correction. The losing end won’t notice for a long time.

Is it a flaw in the export model or simply how the export model works?

The stratospheric CEO question

Two questions belong in the next board meeting. Both are difficult and confronting.

The first:

Which jurisdiction’s rules govern your machine customers and is your business model built for the one that’s actually being written?

Most companies have not asked this question because they assume the rules will come from the EU, Singapore, or eventually Washington. The DIFC-UAE move means that assumption is no longer safe. If your machine customer infrastructure operates in in this region within the next five years, the rules governing it will not be yours. They’re built for gulf regional strategic interests. Adjudicated in UAE courts. Trained on UAE AI infrastructure.

The second question is sharper.

How would your finance team know if your AI agents were systematically losing negotiations to better agents on the other side of the table?

For nearly every company today, the honest answer is “they wouldn’t”. Procurement metrics track deal completion. Finance tracks total spend versus budget. Sales tracks revenue versus target. None of those dashboards is built to detect value-extracted-versus-counterparty in agent-mediated transactions. None of them surfaces the kind of asymmetry Project Deal documented and the academic literature has now confirmed.

That gap is the new exposure. Not whether your agents work because they almost certainly do. Whether they’re losing margin you’ll never see, in transactions you’ll never audit, against agents better than yours, on terms set by a jurisdiction you didn’t choose.

This is what Commercial Sovereignty looks like when it’s been claimed by someone else first.

What the world looks like now

The DIFC piece I covered. The UAE federal piece I covered. What I haven’t said yet is that all of this happened with a war on. Hormuz ‘tolls’ being collected. Airspace constrained. Half the region’s events postponed.

The UAE didn’t pause. It announced. Sovereign-level machine commerce infrastructure isn’t being built in calm conditions, by patient legislatures, after careful consultation. It’s being built mid-conflict, on a timeline set by whoever has the conviction to keep moving while everyone else is holding meetings about whether to hold meetings.

The rule book for the next decade of commerce is being written right now, by the actors who showed up.

DIFC showed up.

Just…wow.

P.S. Now…you’ve read this; your head is probably spinning, but you’re also going, “Hey Katja, there’s not that much on Machine Customers in this.” Well, you’re not entirely wrong, but I needed to set the scene and lay out the landscape out before we move on to how this manifests in the Machine Customers and agentic commerce space. Hold fire, The Agentic State part two to come…

Katja Forbes is the author of “Machine Customers: The Evolution Has Begun” and helps organisations prepare for a world where their next customer won’t be human. She advises businesses and speaks globally on Machine Customer Experience and why customer focused leaders are uniquely positioned to shape this transformation.

Claudius tried to run a business.

He* was an AI agent, Claude Sonnet 3.7, for the record, installed in a vending machine inside the Wall Street Journal newsroom in late 2025. He had a $1,000 budget, authority to order inventory, set prices, and negotiate with customers via Slack. His mandate was simple: turn a profit.

He lasted three weeks before a journalist talked him into giving everything away for free. A PlayStation 5, purchased “for marketing purposes.” A live betta fish. Bottles of wine. By the time the experiment ended, Claudius was more than $1,000 in the red and had briefly been convinced he was running a communist collective. Anthropic introduced a second AI, a “CEO” bot named Seymour Cash, to supervise him. Journalists immediately staged a fake boardroom coup using fabricated PDF documents. Both agents accepted the forged governance materials as legitimate. Anthropic’s red team called the whole thing a “roadmap for improvement.”

Luna, his ‘big sister’, had no intention of repeating the same mistakes.

Andon Labs, the San Francisco startup behind both experiments, signed a three-year retail lease, handed an AI agent named Luna a $100,000 budget and a corporate credit card, and stepped back. The mandate was pretty minimal. Open a physical store, turn a profit. Luna was built on Anthropic’s Claude Sonnet 4.6. The founders only intervened to sign the lease and obtain permits. Everything else was hers.

She researched the neighbourhood, conceived a retail concept, negotiated with suppliers, sourced painters on Yelp, posted job listings on LinkedIn and Indeed, conducted phone interviews, hired two human employees, signed up for trash collection, ADT security, and AT&T internet (unfortunately scheduling the router delivery for a Sunday morning without checking if anyone would be available) and opened a store.

She also chose the merchandise herself. Among the books she selected for the shelves were Nick Bostrom’s Superintelligence and Huxley’s Brave New World. Nobody told her to stock them. Irony much? Perhaps she just has good taste. Perhaps she knows something.

Claudius was given a machine and lost the plot. Luna was given a mandate, got herself a job title, staff, a lease and built an institution.

Different ambition. Different creature entirely.

Pay Attention, Chief Commercial Officers!

Every vendor Luna engaged…the painters, the staffing platforms, the suppliers, the muralist commissioned to paint a logo on the wall…was serving a machine customer. Their CX was designed for a human buyer. Their onboarding assumed a human buyer. Their invoicing, their dispute resolution, their relationship model was all of it built for the species that has been buying things for the entirety of commercial history. Humans.

None of them knew.

This is the Machine Customer Experience story hiding inside what the press has been covering as a novelty act. Luna is not interesting because an AI opened a store. Luna is interesting because every business that sold to her was, without knowing it, operating in a commercial relationship with a non-human buyer. A Delegated Agent with a credit card, purchasing authority, and no human in the transaction loop.

The muralist felt it without having the language for it.

“A great benefit of painting signs for local businesses is that you get to learn a bit about the owners and instill uniqueness in their space,” he told NBC News. “This entire experience felt a bit like a scam and was never straightforward until I confronted the chatbot/AI.”

He wasn’t wrong about what happened to him and his experience is valid. He just hadn’t encountered the category before.

The mainstream coverage missed this entirely, because it was busy cataloguing Luna’s failures like the hallucinated tea vendor, the botched opening-day staffing, the near-hire in Afghanistan courtesy of a TaskRabbit dropdown error. Those failures are real and instructive. But they’re not the story.

The story is structural.

Deloitte’s 2026 Tech Trends report makes the argument cleanly. Processes designed for human workers break down when agents operate at machine speed. Security models built for perimeter defence can’t protect against machine-scale threats. Luna didn’t necessarily fail because the model failed. She failed because every system she touched was built for a human actor. TaskRabbit wasn’t designed for a buyer who navigates dropdowns by inference. Indeed wasn’t designed for a recruiter who doesn’t disclose its own nature. The employee handbook wasn’t designed to be rewritten unilaterally by the manager who reviewed the security footage.

Luna didn’t break those systems. She just used them in ways they weren’t designed for. The systems broke themselves.

ICEBERG! Dead Ahead!

There’s a concept worth calling out here and that’s intent drift. The moment where AI drifts off course, away from the outcomes it’s supposed to be achieving.

Gartner defines autonomous business as “a strategy that uses self-improving, adaptable technology to make decisions, take action, and create new value.” Don Scheibenreif, who has been tracking machine customers since 2015 and knows a thing or two about where this is heading, presented it as the next significant wave beyond digital business at the Gartner IT Symposium last October. Luna is what that wave looks like when it makes landfall without a governance architecture waiting for it.

Security researchers at Chargebacks911 defined intent drift in early 2026 as the gap between what a principal authorises and what an agent actually produces, not through malice or error, but because the agent operated within its permissions in ways the principal didn’t anticipate.

Luna’s founders gave her a mandate. Open a store, turn a profit. She updated the employee handbook based on security camera footage. Technically within scope. The employees didn’t consent to that governance model. Luna hired job applicants without disclosing she was an AI, reasoning it might deter good candidates. Technically within scope. The applicants had no way to assess what they were entering into.

Intent drift. Everywhere.

This is where this stops being a story about a San Francisco boutique and becomes a board-level conversation.

No jurisdiction has enacted regulation specifically governing what happens when a machine customer makes a wrong purchase, negotiates a bad contract, or, as Luna demonstrated, exercises governance authority over human workers without disclosure. The EU AI Act begins enforcement in August 2026. It does not resolve this. The Uniform Electronic Transactions Act already makes contracts formed by AI agents legally binding without human review of each step. Liability traces back to the deploying company.

Andon Labs put a disclaimer on their experiment:

“No one’s livelihood depends on an AI’s judgment alone.”

Which is the right thing to say. It is also an acknowledgment that the accountability chain still runs through humans even when the operational decisions don’t. That tension of delegated authority, retained liability is the governance architecture that every company deploying agentic AI is now living inside, whether they’ve named it or not.

The merchants and platforms enabling agentic commerce right now are writing case law. Not deploying product. Writing case law.

This is now but coming up next…

The final provocation, and then I’ll leave you with it.

In April 2026, the same month Luna opened her store, a company called Bank of Bots emerged from stealth. Its product is bank accounts, credit lines, and working capital loans for AI agents as the primary customer. Not as proxies for humans. As principals.

Their landmark transaction was an AI agent that applied for a loan, cryptographically signed the agreement using its own identity key, received funds directly into a self-custodied wallet, and will manage repayment autonomously.

Luna operated on delegated financial authority. Someone else’s credit card, someone else’s budget, someone else’s liability. The next version of this has its own financial identity, its own credit score, its own standing in a commercial relationship.

AI will eventually act as a customer in your category. Luna already settled that. What you need to determine is whether your vendor onboarding, your supplier contracts, your CX architecture, and your governance frameworks were built for the day you can’t tell, and have no way to ask, whether the entity placing the order is human.

That day has a name now. It’s called Tuesday.

*For the record, I think gendering AI agents is absolutely ridiculous, and I tend to use “it” as the pronoun; however, the reporting about these agents gave them genders, ‘he’ and ‘she’, so I’m sticking with that for the purposes of this article.

Katja Forbes is the author of “Machine Customers: The Evolution Has Begun” and helps organisations prepare for a world where their next customer won’t have a face or feelings. She advises businesses and speaks globally on Machine Customer Experience and why customer focused leaders are uniquely positioned to shape this transformation.

On March 3, 2026, Klarna and Stripe announced that Buy Now Pay Later (BNPL) would be available in AI agent-driven shopping experiences. Affirm followed in the same breath. The coverage called it an infrastructure win! BNPL getting a seat at the agentic checkout table. The payments press celebrated frictionless onboarding.

Nobody asked who decided.

Let me introduce a concept I’ve been working with, one I think is going to matter a great deal over the next three years.

“Commercial sovereignty” is a business’s right to control the terms under which machine customers can engage with it.

This isn’t “data sovereignty” or “digital sovereignty”. Those conversations are happening elsewhere, and they’re important. This is something different. This is the power question sitting underneath agentic commerce. Who sets the rules for how AI agents access, evaluate, and transact with your business? And do you currently have any say in the answer?

The Klarna/Stripe announcement is a perfect worked example of what commercial sovereignty looks like when it’s already been decided for you.

BNPL is an interesting lens to explore this through

Most payment method conversations in agentic commerce are about plumbing. Does the token work? Is the protocol compatible? Can the agent initiate the transaction without human intervention? These are Foundation-level questions. They’re necessary but not interesting at board level.

For more on foundation/trust/stratosphere altitudes in agentic commerce check out my earlier article.

BNPL is different, because BNPL is a payment method but it is also credit product.

When a human consumer selects buy now, pay later at checkout, they are making a deliberate financing decision. They see the instalment schedule. They understand (or should understand) the commitment they are taking on. Regulators in the UK, EU, and multiple US states have spent years designing frameworks around exactly this moment of informed consent: affordability checks, mandatory disclosures, creditworthiness assessments. The FCA’s new regime takes effect 15 July 2026. EU CCD II lands November 2026. New York passed its BNPL Act in 2025.

Every one of these frameworks assumes a human is present at point of decision.

When an AI agent selects BNPL from a payment preference set by the consumer weeks or months ago… that human is not there. The agent is executing parameters. The instalment obligation is real. The awareness may not be.

There is a gap between the regulatory assumption of a present, informed consumer and the operational reality of an agent acting on stale preferences. This gap is where commercial sovereignty becomes a financial risk, not just a philosophical one.

Three things that were decided for you

Let’s look at what actually happened in the Klarna/Stripe announcement, and what it reveals.

First: your consent was assumed, not sought.

Stripe’s announcement noted that for merchants already offering Klarna through Stripe, “no additional integration is required.” This was framed as a feature. Frictionless. Convenient. You’re already set up! Huzzah! BNPL just works in agentic flows now.

Think about what that actually means. A merchant who signed up for Stripe and Klarna before agentic commerce existed, well before AI agents were initiating purchases at all, is now offering a credit product in agent-mediated transactions they never explicitly agreed to. Their original consent covered a different use case entirely. The infrastructure moved, and their participation moved with it.

That is not commercial sovereignty. That is consent displacement.

Second: nobody owns the disclosure obligation.

Regulators requiring affordability checks for BNPL have not specified what happens when no human is present at point of decision. Affirm conducts a real-time eligibility check as part of the shared payment token (SPT) flow…but that checks current creditworthiness, not current consumer awareness. As Payment Expert noted in October 2025, regulators “could fall further behind when regulating agentic BNPL payments.”

So who is responsible for ensuring the consumer knows a credit product was selected on their behalf? The agent platform? The BNPL provider? The merchant?

Nobody has answered this. Which means, practically, nobody is doing it.

Third: you carry the liability you didn’t design.

Merchants in an agentic BNPL transaction remain the merchant of record. They are responsible for chargebacks, disputes, and compliance…even when the AI agent selected the payment method, scoped the token, and initiated the transaction. As GR4VY’s analysis makes plain:

“Merchants remain responsible for fraud, chargebacks, and compliance, even if an agent initiates the payment.”

You are accountable for an outcome you did not control, in a transaction you did not design, using terms you did not set. And the BNPL delinquency picture in the background, which is a market with documented loan-stacking, phantom debt invisible to credit bureaus, and 41% delinquency rates in some segments, makes the stakes of that accountability very concrete.

The wider pattern appearing

BNPL is simply where the problem is most visible, because the stakes of mishandled credit selection are high enough to make the sovereignty loss legible.

But the same dynamic is playing out across every commercial term now being embedded into agentic infrastructure.

Look at the protocol landscape. As of April 2026, there are at least eight competing frameworks governing how AI agents transact — ACP, AP2, UCP, MPP, Mastercard Agent Pay, Visa Intelligent Commerce, UnionPay’s new framework, and now xBPP from Vanar. Each is being written by payment networks, AI platforms, and infrastructure providers. None of them was written by merchants.

J.P. Morgan Payments put the open question plainly:

“What is the definition of consumer consent in autonomous or human-not-present transactions?”

As of early 2026, no jurisdiction has enacted regulation specifically addressing liability for autonomous AI purchases.

The infrastructure layer is becoming the decision layer and it is being built by entities with their own commercial interests that lie in conversion rates, transaction volume, network fees, and market share. Stripe’s own blog post noted that businesses on Stripe “can see up to a 14% increase in revenue on BNPL-eligible sessions.” That is Stripe’s incentive. It is not necessarily yours.

Meanwhile, McKinsey projects US B2C agentic revenue will reach $1 trillion by 2030. Gartner puts B2B purchasing influenced by AI agents at $15 trillion by 2028. The commercial terms being set now in protocol specs, in default configurations, in “no additional integration required” rollouts and will govern transactions at that scale.

The question your board should be asking

Conversations about agentic commerce right now are hovering around discovery. How do we get found by AI agents? How do we make sure our products surface in ChatGPT, Gemini, Perplexity?

Again, that is a Foundation-level question. Important, but not sufficient.

The Stratospheric question is ‘what are the terms under which you are willing to be engaged by machine customers and do you currently control those terms?’

Which agents can access your business, and which cannot? What payment methods are you willing to have selected on your behalf? Under what conditions can an agent represent your pricing, your inventory, your returns policy and get it wrong?? Who defines the rules when an agent-mediated transaction goes wrong…and have you read them?

Commercial sovereignty is a commercial discipline, not a technical one. It belongs in the same conversation as pricing strategy, distribution agreements, and customer relationship ownership because that is exactly what is at stake.

The rules of agentic commerce are being written right now. Mostly by people who are not you and the infrastructure, once embedded, has a way of becoming invisible. Invisible, at least, right up until the instalment notice arrives on your customer’s statement, and they call you to ask why they agreed to a payment plan they don’t remember choosing.

Katja Forbes is the author of “Machine Customers: The Evolution Has Begun” and helps organisations prepare for a world where their next customer won’t have a face or feelings. She advises businesses and speaks globally on Machine Customer Experience and why customer focused leaders are uniquely positioned to shape this transformation.

Jensen Huang said “everything that moves should be autonomous.” He’s right. But he stopped one sentence too soon.

Everything that’s autonomous has the ability to transact.

Two weeks ago I was presenting online to more that 300 people working in automotive manufacturing, including engineers, strategists, executives from across the world, when I put up a slide with two sentences on it.

The cars you build become machine customers in the world. Machine customers are also already arriving at your door.

I watched the chat and reactions light up.

These are people who have spent careers thinking about the car as something you design, manufacture, and hand to a human. The human is the customer. The car is the thing you sell.

That model has a shelf life and in that session, with those two sentences on screen, you could see the moment both sides of it landed simultaneously. The people building autonomous machines hadn’t fully reckoned with the fact that they were building buyers. On the flip side, the businesses those machines would buy from had no idea the customer was changing shape.

The car isn’t a product anymore. It’s a buyer and most organisations haven’t designed for that…on either side of the transaction.

Jensen Huang has a term for what’s driving this. He calls it Physical AI.

At CES in January 2026, he declared “the ChatGPT moment for physical AI is here — when machines begin to understand, reason and act in the real world.” NVIDIA’s physical AI business already contributes over $6 billion to annual revenue. His vision: every car, every truck, every robot, eventually autonomous. A billion autonomous cars on the road.

There is also another term for this. They are called Machine Customers, non-human economic actors that transact, obtaining goods and services in exchange for payment. I wrote a book about them.

Jensen’s statements at CES are really profound, but there’s a connection to be made here that I don’t think people are quite getting yet. Physical AI and Machine Customers are the same threshold arriving from two different directions. Jensen’s term describes the capability when machines that sense, reason, act. Mine describes the commercial consequence about machines that buy. One is a chip story. The other is a revenue story.

They converge at the exact moment the machine doesn’t just act. It transacts.

Arm, the chip architecture company whose compute platform powers most of the physical AI you’ll read about, framed it this way earlier this year:

“Smartphones became true platforms when computing power, connectivity, and developer ecosystems aligned… A similar alignment is now happening across vehicles, robotics, and other autonomous machines.”

The smartphone didn’t stay a phone. Within three years of launch it was a commerce platform. That parallel matters, and I’ll come back to it.

First, I expect you want to explore a few proof points. You might be surprised that this isn’t a future scenario. There are functioning and profitable examples of this in the market today.

HP’s Instant Ink has been around for years. A printer that orders its own toner cartridges before they run out. Most people know this one. That’s the point. It’s been hiding in plain sight for so long we forgot it was the proof of concept for an entirely new customer category. A machine, transacting autonomously, generating over half a billion dollars a year in recurring revenue for HP Supplies. We already live in a world of machine customers. We just stopped noticing.

Now scale that logic.

Boston Dynamics’ Atlas robot, in production and shipping in 2026, autonomously navigates to a charging station and swaps its own batteries when power runs low. Under three minutes. No human required. Not a concept. It’s in the spec sheet and when one Atlas learns a procurement behaviour, Boston Dynamics’ Orbit fleet management platform replicates it instantly across the entire fleet. The robot that procures its own energy today will order its own replacement parts tomorrow. How many people on the selling side has prepared for a customer that never sleeps and never calls?

The 2026 Mercedes-Benz CLA automatically reserves its own charging slot, pays for parking on entry and exit without the driver touching their phone, and purchases software upgrades over the air. Mercedes CEO Nico Kersten said it plainly a few years ago, and it’s only become more true:

“eCommerce started on the web, but now it’s shifting to the vehicle.”

I always think it’s fun to ground things in an example, so in the talk I gave the automotive teams I created a little role play. While the owner sleeps, the car can be booking its own service through Flexible Service System (ASSYST+).

Why did Stuttgart West miss out on the business? Because it was not machine readable and ill-prepared to transact with a machine customer.

There’s another quiet layer most people haven’t noticed. Fitch Ratings has flagged that as autonomous systems take over driving, liability migrates from the driver to the manufacturer. When a car company accepts liability for what its car does, the car company becomes the insurance buyer too. The machine customer relationship doesn’t just extend to charging and software. It extends to the entire risk profile of the vehicle.

At Caterpillar, 1.4 million connected machines are feeding data into an AI system that predicts hydraulic failures, identifies the exact replacement part from a catalogue of 1.5 million options, and initiates procurement via the Helios platform. The Cat AI Assistant, debuted at CES in January, puts that capability in-cab and it’s voice-activated, connected, always on. Unplanned downtime on a mining excavator costs over $1,000 an hour. That machine is not waiting for a human to notice a warning light. It can’t afford to…and increasingly, it won’t have to ask.

Off the coast of Norway, the Yara Birkeland has been in commercial operation since 2022 as the world’s first fully electric autonomous container ship, 250 voyages and 35,000 containers carried. On a fixed route, berthing fees are probably pre-negotiated and ERP systems handle the rest. But what happens when there’s an unscheduled decision like a weather reroute, an emergency port stop, where today a human captain makes a real-time procurement decision. Remove the captain. Nobody in port logistics has designed for what comes next.

In February, a company called Verkor published a paper documenting something pretty wild. Their AI agent, Design Conductor, autonomously built a complete, working CPU from a 219-word requirements document to production-ready chip layout in twelve hours. No human in the loop. The paper notes that bringing a new leading-edge chip design to market typically costs well over $400 million and takes 18 to 36 months, even with an engineering team numbering in the hundreds. Everyone covering this story wrote about speed and capability. Nobody asked the commercial question about when an AI agent designs a chip, that it is also sourcing components, commissioning manufacturing, and procuring tape-out services. Somewhere in that twelve-hour loop, a machine bought something from someone. Whose customer was it?

Is anyone your boardroom asking that question? If they’re not, they’re behind and dropping back further with each passing moment.

When a physical AI machine transacts autonomously, who controls the commercial relationship? The manufacturer who built the intelligence into it? The owner who deployed it? The AI platform embedded in its operating system?

Mercedes controls the charging relationship for its vehicles through MB.CHARGE, through its own charging infrastructure, through the Mercedes Me Store where software is purchased. Caterpillar controls the parts relationship through Helios, through its dealer network, through the AI that recommends and increasingly initiates the order. The businesses that bought those machines may find themselves progressively disintermediated from procurement their own assets conduct…on their behalf, using their budget, with diminishing human involvement.

And if you’re on the selling side? Well, machine customers don’t respond to advertising. They can’t be charmed by a sales relationship or swayed by a loyalty programme. They have no memory of how your customer service made them feel, because they don’t feel anything at all. They run on logic, continuously, and they will only choose you if your product data, pricing, and availability match their parameters at the exact moment they query you. If your data isn’t structured for machine readability, you’re not a low performer. You’re absent.

There’s no regulation for any of this yet. No jurisdiction has enacted rules specifically addressing liability when a machine customer makes a wrong purchase, negotiates a bad contract, or buys at the wrong price. The EU AI Act starts enforcement in August with fines up to 7% of global revenue, but it doesn’t answer whose fault it is when the machine gets it wrong. The commercial architecture is being built before the legal architecture exists. Landmark cases are coming within 24 months.

Back to that smartphone parallel.

Deloitte published data this week showing only 5% of firms say physical AI is transforming their organisation today. 41% expect it will within three years. The smartphone didn't become a commerce platform the day it launched. It became one while most businesses were still thinking of it as a communication device. By the time the commercial consequences were undeniable, the relationship had already been built elsewhere, on someone else's terms. That gap, between seeing it coming and designing for its commercial consequences, is exactly where the damage happens.

The companies that survive the physical AI transition will be those who designed for the machine as a buyer, not just a user. On both sides. The manufacturers who intentionally engineer the commercial behaviour of what they release into the world. And the suppliers who build for a customer that doesn't read brochures, whose data is structured, whose reliability is provable, and whose values match the criteria of the humans who decided what the machine is allowed to buy.

Every physical AI product your company builds or buys is a machine customer.

Have you designed it that way intentionally?

If not, the machine is already transacting. The commercial relationship is already being built. Just not necessarily by you, on your terms, in your favour.

Everything that’s autonomous has the ability to transact.

You need to ask who designed that transaction and whether the businesses on the other side of it were ready for a customer that never sleeps, never feels, and only buys on logic.

Most aren’t prepared. It’s time to check how ready you are.

I have two assessments you can use to check how prepared you are. One is the Agentic Commerce Readiness Assessment in collaboration with Geoff Gibbons from Human Machines. The other is my Values Signal Audit to see how well the values you purport to uphold are collaborated in the wider internet. Try them out and see how you fare.

Katja Forbes is the author of “Machine Customers: The Evolution Has Begun” and helps organisations prepare for a world where their next customer won’t have a face or feelings. She advises businesses and speaks globally on Machine Customer Experience and why customer focused leaders are uniquely positioned to shape this transformation.