Originally published at avalayer.com/writing, Field Notes 001.
Verification is a strange business. What you're selling, when you get down to it, is certainty about other people's promises. So when we built a merchant-side verification layer for AI shopping agents, we made ourselves a rule: implement every protocol to its public-spec depth, validate against live production key material, and wherever we couldn't be certain, say so out loud. This essay is about the one place that rule got interesting.
Some background. Our API accepts a signed request from any AI agent and returns a verdict: trusted or not, with a typed reason. To say that honestly we implemented four protocols, including Visa's Trusted Agent Protocol. Most of that work went the way implementation work should go. The spec says a thing, you build the thing, the tests pass, and cryptography does what cryptography does. Cryptography is the reliable half of this industry. The unreliable half is agreement. A specification is an agreement about reality between people who have never met, and like most such agreements, it holds right up until someone reads it carefully.
Three layers, two of them clean
Visa TAP is a three-layer protocol. The outer layer is an RFC 9421 HTTP message signature binding the agent's identity and intent to a specific merchant and path. The middle layer is a Consumer Recognition Object carried in the body, including a Visa-signed identity token you can verify against Visa's published JWKS at mcp.visa.com. The inner layer is an Agentic Payment Container, also signed.
