Confirming Identity of AI Shopping Agents

AI shopping agents browse, compare, and buy on behalf of consumers, often without identifying themselves. Storefronts cannot tell a legitimate agent from a scraper, a credential-stuffing bot, or an impostor posing as a trusted assistant. PointGuard AI uses cryptographic agent identity so retailers can authenticate agents, apply the right policy to each, and revoke access when an agent misbehaves.

Storefronts cannot distinguish trusted agents from impostors.

• Agents rarely present verifiable credentials.
• Bots can spoof well-known AI assistants.
• Blocking all agents loses legitimate sales.
• There is no way to revoke a single misbehaving agent.

Agent Identity & Access Security issues and verifies agent identities and enforces access by trust level.

1. Issue verifiable identities. Register partner and first-party agents with DID-based identities backed by Ed25519 signatures.

2. Authenticate every request. Verify agent signatures before granting access to catalog, cart, and account functions.

3. Apply policy by trust level. Give verified agents scoped access and route unverified traffic to restricted paths.

4. Revoke instantly. Revoke any agent identity the moment abuse is detected, without affecting others.

• OWASP Top 10 for LLMs: LLM06 Excessive Agency and LLM10 Unbounded Consumption, covering agents with unchecked access and abusive automated traffic.
• OWASP Top 10 for Agentic Applications: ASI03 Identity and Privilege Abuse and ASI07 Insecure Inter-Agent Communication, addressing spoofed identities and unverified communication between agents.
• NIST AI RMF: GOVERN sets agent trust policy; MAP identifies agent traffic; MEASURE tracks abuse; MANAGE enforces revocation.