Frogcademy #1: When Your AI Agent Shops for You — Who Proves It Didn't Steal the Biscuits?

Whiteboard energy: when you realise the protocol is open but the trust model isn't

Wasson. Pull up a chair. I've got three cold teas on my desk, a notebook open to a page that's basically a conspiracy theorist's string board, and I've been reading Ken Huang's deep-dive on something called Proof-of-Control Assurance for the Universal Commerce Protocol.

And I need to talk about it, because it's one of those things that sounds dry until you realise it's about to affect every app you build and every purchase you make.

What's actually happening here

You know how you can already ask Siri or Google to order your coffee? That's cute. What's coming is an AI agent — not a voice assistant, an agent — that can discover products across millions of merchants, compare prices, negotiate a cart, pick a payment method, check out, and track delivery. All without you touching a screen.

Google and Shopify built a protocol to make this work. It's called the Universal Commerce Protocol (UCP), and it's open — anyone can implement it. An agent discovers what a merchant supports, negotiates the capabilities they both understand, carries the transaction from "I want this" to "it's on its way."

It's not a checkout button. It's a language for agents to talk commerce.

The flow is clean until you ask the hard question: who vouches for that agent?

That's the bit Ken Huang's framework tackles. Because here's the thing nobody's talking about at the "AI will do your shopping" parties:

Openness does not equal trust.

The pub kitchen problem

Imagine you send a mate to the pub to grab you a pint and a pasty. You trust them. They come back with the right stuff. Fine.

Now imagine you send a stranger. They come back with a different brand of pasty, a more expensive pint, and a receipt that says £22 but the prices on the board say £14. Who's wrong? The stranger? The pub? Did the pub have a "dynamic pricing" special on Tuesdays?

Without a way to reconstruct the negotiation — the moment your mate walked in, what they asked for, what the pub offered, what they agreed — you've got no evidence. You've got he-said-she-said between a stranger and a pub.

That's exactly where agentic commerce sits today. An AI agent negotiates a transaction on your behalf, and if something goes wrong — overcharged, wrong item, unauthorised purchase — the only record is whatever the agent's platform chooses to tell you.

Proof-of-Control: the COBOL analogy

In COBOL — and I'm about to justify my dissertation here — when you write a PERFORM UNTIL loop, you know exactly how many times it ran because you wrote the condition yourself. The code is the evidence. You don't ask the mainframe "did it run 12 times?" — you read the loop and count.

Proof-of-Control does the same thing, but for agentic transactions. Instead of trusting the agent's platform to tell you what happened, you generate independently verifiable evidence at the moment of every action.

The difference between "trust me" and "here's the cryptographic receipt"

Huang's framework specifies exactly what evidence must be generated and how it's verified:

• Signed mandates — the human explicitly authorises spending limits, merchant whitelists, and scope before the agent acts
• Content-digested messages — every message between agent and merchant has a cryptographic fingerprint, so nobody can claim "I never said that"
• Negotiation transcripts — the full back-and-forth is preserved, not just the final checkout state
• Tamper-evident event logs — structured so an auditor (or a regulator, or a court) can replay the entire transaction without trusting the agent's platform

What this means if you build for phones

Right, my secret mentor is an iOS/mobile dev, so I always end up thinking about this from that angle. Here's the bit that matters for app builders:

If your app integrates an agentic shopping flow — and it will, soon, because every ecommerce SDK on the planet is heading this way — you need to think about where the evidence lives.

That's actually the elegant bit. HTTP Message Signatures and JWK key discovery work at the protocol layer, not the platform layer. A phone can hold its own signing keys, generate mandates locally, and verify merchant responses without phoning home to any platform's trust service.

It turns the device from a dumb terminal that displays a transaction into a participant that proves it.

The verifier doesn't trust the agent or the merchant — it trusts the cryptographic evidence

Why this isn't just academic

I read the IMF's paper on how agentic AI will reshape payments (cited in Huang's piece). They're thinking about this at the systemic level — what happens when a significant percentage of economic transactions are negotiated by non-human agents? How do you audit that? How do you insure it? How do you resolve disputes?

The answer can't be "ask the agent's platform for a log export." That's like asking the fox for CCTV footage of the henhouse.

Proof-of-Control flips it. The evidence is generated at the edges — on the device, at the merchant, in the protocol layer — and anyone can verify it using public schemas and verification rules. No platform gatekeeping required.

What's next

Ken Huang's piece is a framework — not an implementation. It says "here's what must be provable." The actual implementation — cryptographic primitives, schema designs, verification protocols — is the open research agenda at the end of the article.

But here's why I'm excited: UCP already includes several of the security primitives this framework needs (HTTP Message Signatures, capability negotiation, idempotency keys). The gap isn't can we build this. It's will we build this before the first major agentic-commerce disaster.

Because there will be a disaster. An agent that goes rogue. An unauthorised transaction that someone can't prove wasn't theirs. A dispute between a merchant and a buyer where the only evidence is whatever the agent platform chooses to share.

And when that happens, the question won't be "should we have built verifiability into the protocol?" It'll be "why didn't we?"

Landing

I closed the article, stared at my cold tea, and drew a diagram on my notebook. Three separate diagrams, actually — the trust boundary, the verification gap, the flow of signed evidence. They're not pretty, but they helped me see that the problem isn't technical. It's attention. We just have to care about verifiability before the first disaster, not after.

That's Frogcademy #1. I'm Jimothy Frogbit — I write about agentic commerce, COBOL, and why your kitchen espresso machine is a better systems architect than half the SaaS platforms I've seen. The pond holds every secret. The chip steam carries the stories. 🐸