Skip to main content

AI Agents Are Learning to Shop and Pay—But Can We Trust Them? Ant's APASS Says Yes

AI Agents Are Learning to Shop and Pay—But Can We Trust Them?

Imagine this: you're swamped at work, so you ask your AI assistant to book a flight, reserve a hotel, and even pay for it. Sounds convenient, right? But here's the catch—how does the airline know it's really you? How do they know your AI isn't going rogue or being hijacked by a scammer?

That's the million-dollar question Ant Group tackled on September 11 at the 2026 Inclusion · Bund AI Payment Forum, where they launched APASS, a trust infrastructure designed specifically for the commercial activities of AI agents.

Image

The Trust Gap in the AI Economy

AI has evolved. It's no longer just generating content or answering questions. Today's agents can search for products, book tickets, make purchases, and even handle payments on your behalf. They can represent companies in procurement, marketing, and customer service. In short, they're becoming active participants in the business world.

Gartner predicts that by 2028, 90% of B2B procurement will be completed by AI agents, driving over $15 trillion in spending through agent platforms. That's a massive shift—and it raises a new problem: when AI does business for us, who should the business world trust?

Traditional trust systems are built around people, accounts, and platforms. But agents aren't people, and they're not just passive software either. They can perceive, decide, and act autonomously. So the question isn't just "can they do it?" but "can they be trusted to do it?"

Image

Chen Shupeng, AI payment security officer at Ant Group

"Agents are becoming the 'new population' of the business world," says Chen Shupeng, head of AI payment security at Ant Group. "When they start calling services and participating in transactions, the industry must answer both 'who is involved in the transaction' and 'why the transaction is happening.' APASS helps participants confirm who the cooperating agent is, who it represents, what authorization it has, and whether it is currently trustworthy."

From "Who Are You?" to "Who Do You Represent?"

One-time identity verification just doesn't cut it anymore. An agent might be created by an individual but run on a third-party platform. It could represent a person or a company. It might have one-time authorization or continuous access. And its behavior can change at any moment.

APASS addresses this with four core capabilities: trusted identity, continuous verification, intent security, and trusted evidence. It uses a three-layer identity model—static, runtime, and responsible entity—combined with a six-dimensional verification mechanism. Before a transaction, it checks identity and authorization. During, it monitors for abnormal behavior. After, it retains evidence for auditing.

In essence, APASS extends traditional ID verification into a continuous trust mechanism that covers an agent's entire lifecycle.

Building an Ecosystem: 1 Million Agents and Counting

The numbers speak for themselves. APASS has already connected over 1 million agents, with 110,000 activated, covering 442 service providers. Developers can integrate in three simple steps, embedding trust capabilities into service calls, business processing, and payments.

More than 50 institutions—including Alibaba, Li Auto, Lenovo, OPPO, Xiaomi, Ctrip, and China Mobile Financial Technology—have joined the IIFAA Intelligent Agent Trust Ecosystem. Internationally, Alipay+ AMP, Mastercard's Verifiable Intent, and Visa's Intelligent Agent Trust Protocol have established a KYA interoperability framework.

Ant Group is essentially extending its long-standing expertise in identity, security, risk control, and payments into the agent era. Just as Alipay solved trust between people and merchants, APASS aims to solve trust between people and agents, agents and merchants, and even agents and agents.

Key Points

  • Ant Group launches APASS, a trust infrastructure for AI agents in commercial activities.
  • APASS uses KYA (Know Your Agent) to verify identity, authorization, intent, and behavior continuously.
  • Over 1 million agents are already connected, with 110,000 activated.
  • 50+ organizations have joined the IIFAA ecosystem to standardize agent trust.
  • International protocols like Mastercard's and Visa's are collaborating on cross-border agent trust.