{
  "id": "mastercard.consumer-agents.no-block",
  "protocol": "mastercard-agent-pay",
  "layer": "identity-trust",
  "role": "merchant",
  "status": "recommended",
  "title": "Do not block agents only because they lack scheme registration",
  "description": "Mastercard notes consumer-owned agents will not carry scheme credentials and that this is expected.",
  "goal": "Blocking them loses real customers; normal card-not-present controls still apply.",
  "note": "Mastercard's guidance, not a protocol rule.",
  "how_to_implement": {
    "steps": [
      "Apply tiered trust: verified agents, then unverified traffic with 3-D Secure, AVS and CVV.",
      "Do not reject purely on missing Agent Pay, TAP or ACE headers."
    ]
  },
  "resources": [
    {
      "label": "Mastercard Developers: Level 1 agentic commerce",
      "url": "https://developer.mastercard.com/merchant-cloud/documentation/tutorials-and-guides/agentic-commerce-guide/21/",
      "type": "docs",
      "publisher": "Mastercard"
    }
  ],
  "audit": {
    "method": "config_review",
    "automatable": false,
    "human": "Review bot rules and WAF policies for blanket blocks on unsigned agents."
  },
  "how_to_verify": "Review bot rules and WAF policies for blanket blocks on unsigned agents.",
  "artifacts": [],
  "depends_on": [],
  "status_note": "Mastercard's guidance, not a protocol rule.",
  "verified": true,
  "slug": "mastercard-consumer-agents-no-block",
  "category": "identity-trust",
  "url": "https://vreeman.ai/commerce/checklist#mastercard.consumer-agents.no-block",
  "updated": "2026-10-12",
  "sources": [
    {
      "label": "Mastercard Developers: Level 1 agentic commerce",
      "url": "https://developer.mastercard.com/merchant-cloud/documentation/tutorials-and-guides/agentic-commerce-guide/21/",
      "type": "docs",
      "publisher": "Mastercard"
    }
  ],
  "related_slugs": []
}