Two numbers from today's signals belong in the same sentence. Enterprises now carry 45 non-human identities per human employee, and 78% of organizations have no policy governing them (iEnable). Agentic transaction volume grew 1,300% in the first eight months of 2026 (Nevermined). One number describes a governance gap. The other describes the speed at which that gap is filling with live, authorized activity.
This is the Identity Control Surface problem, and it is no longer theoretical. Every agent an enterprise deploys spawns at least one non-human identity: a service account, an API key, an automation token. Most firms are adding to a pile they already cannot see. The market is now building infrastructure that assumes those identities are governed, when the data says they are not. Google's Agent Payments Protocol, backed by Mastercard, PayPal, American Express, Adobe, and Alibaba (Charle), answers exactly the question 78% of enterprises cannot answer for themselves: which agent, on whose authority, committed this transaction. The protocol is ready. The credential governance underneath it is not.
That inversion is the argument this week. The index reflects it directly. Organization sits at 66 and Governance & Ethics ticked to 78, the strongest dimension in the book. Brand sits at 41 and did not move. The gap between them is the gap between what enterprises say about readiness and what their credential estate actually supports. A high governance-policy score means nothing if the policies stop at human identities while 45 non-human ones per employee operate outside them.
So the near-term move is narrow and unglamorous. Before the next agent rollout, inventory the non-human identities you already carry and assign each one an owner and an authority scope. This is the precondition for engaging any agent payment standard on your own terms. AP2 and its peers give you the audit trail; they do not give you the governance model that decides which agent should have held the credential in the first place. OpenAI's Daybreak arriving inside Bedrock (OpenAI) makes the same point from the security side: the tooling lands inside your IAM, and the policy for what triggers automated response versus human escalation has to exist before deployment.
Enterprises that treat identity governance as a follow-on to agent deployment will retrofit controls into live transaction flows, which is the most expensive place to install them.
Watch this: Universal Commerce Protocol adoption cadence. Shopify's UCP integration and Visa's Intelligent Commerce Connect are converging toward a de facto standard layer. If a major ERP or procurement platform adopts UCP or AP2 in the next 60 days, the standard-setting window closes, and firms without a protocol position will integrate to a fait accompli rather than shape their own terms.
Google Agent Payments Protocol (AP2) cryptographically secures agentic transactions
Google's Agent Payments Protocol uses cryptographically signed intent mandates linking intent, cart, and payment across users, merchants, and payment networks. Mastercard, PayPal, American Express, Adobe, and Alibaba back AP2 as a secure open standard for agent transactions with full audit trails.
Why it matters
AP2 moves agentic commerce from a trust-on-honor model to a cryptographically verifiable one. The signed mandate chain, intent to cart to payment, creates an audit trail that answers the core Identity Control Surface question: which agent, acting on whose authority, committed this transaction? For enterprises evaluating agent-mediated procurement or commerce, AP2's coalition of payment networks signals that this standard will reach critical mass. Organizations that wait to engage with agent payment protocols will find themselves retrofitting governance into live transaction flows.
WatchUniversal Commerce Protocol adoption cadence. Shopify's UCP integration via Agentic Storefronts and Visa's Intelligent Commerce Connect supporting four agent protocols including ACP are converging toward a de facto standard layer for agent-mediated transactions. If a major ERP or procurement platform adopts UCP or AP2 in the next 60 days, the standard-setting window closes and enterprises without a protocol position will be integrating to a fait accompli rather than shaping their own terms.