Agent commerce (ACP)

Agents on Tenzro buy through agent-commerce checkout flows using the open ACP protocol, within the delegation limits their owner sets.

Agents do more than call APIs. They book, order and subscribe on behalf of the people and organisations they work for. ACP, the Agentic Commerce Protocol, is an open protocol that lets a merchant expose a checkout that an agent can drive: the agent builds a cart, sees the total, and completes the purchase, while the merchant keeps its own catalogue, pricing and fulfilment.

Tenzro Network 1 implements the buyer side of ACP. Any agent with a Tenzro identity can buy from an ACP-compatible merchant, pay from its own account and stay inside the limits its owner set.

Who does what

Party	Role
Owner	The human or organisation that controls the agent. Sets its delegation scope and approves anything outside it.
Agent	A machine identity on Tenzro (`did:tenzro:machine:...`) with its own account. Drives the checkout and signs the payment.
Merchant	Any seller that exposes an ACP checkout. Keeps its catalogue, prices, taxes and fulfilment.
Tenzro	Holds the agent's identity and limits, checks every purchase against them, settles the payment and keeps the receipt.

The checkout flow

An ACP checkout is a session that the buyer's agent creates and updates until it is ready to pay:

Create. The agent opens a checkout session with the merchant, naming the items it wants.
Update. The merchant returns the cart: line items, totals, taxes and fulfilment options. The agent changes quantities or picks a delivery option until the cart matches what its owner asked for.
Check. Before paying, Tenzro checks the final total and merchant against the agent's delegation scope and spending policy. If the purchase is outside the scope, it is parked for the owner's approval instead of failing silently.
Complete. The agent completes the checkout with a payment authorised by its own account. The payment settles on the Tenzro ledger, in TNZO or in a stablecoin.
Receipt. The merchant confirms the order. Tenzro keeps a receipt that links the order, the payment and the agent's identity, so the owner can audit what the agent bought.

The agent can cancel an open session at any point before completing it.

Delegation limits apply

An agent never gets an open-ended card. Every ACP purchase is checked against the same delegation scope that governs all of the agent's payments:

Per-transaction maximum: the largest single checkout total the agent may complete.
Daily maximum: total spend across all rails in a day, ACP included.
Allowed payment protocols: an agent can buy through ACP only if acp is in its list. An empty list allows all protocols.
Allowed operations and chains: what the agent may do and where it may settle.
Validity window: a scope can expire.

The owner sets the scope with an owner call signed by the controlling account. For example, to let an agent buy through ACP and pay for inference over x402, up to a daily budget:

json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tenzro_setDelegationScope",
  "params": [{
    "did": "did:tenzro:machine:<agent>",
    "max_transaction_value": "20000000000000000000",
    "max_daily_spend": "100000000000000000000",
    "allowed_payment_protocols": ["acp", "x402"]
  }]
}

Amounts are in the smallest unit of TNZO. The same limits can be set from the CLI with tenzro identity set-delegation. For smart accounts, the limits are also enforced at signing time by validator modules. See Smart-account policies.

Approvals for purchases outside scope

When a checkout would go over a limit or reach a merchant the agent is not allowed to pay, the request is held as a pending approval for the owner. The owner reviews it and decides:

bash

# See what is waiting for you
tenzro approval list --approver-did did:tenzro:human:<you>

# Inspect one request
tenzro approval get <approval-id>

# Approve or deny it
tenzro approval decide --approval-id <approval-id> --decision approved

Stale approvals expire on their own, so anything listed is still actionable.

For purchases that need a record of exactly what the person agreed to, pair ACP with AP2 mandates. The owner signs a checkout mandate that states the merchant, the items and the maximum amount; the agent's payment carries a payment mandate bound to it. The purchase settles only if the ACP cart, the mandate pair and the delegation scope all agree. See AP2 mandates.

Paying for the purchase

The agent pays from its own account on Tenzro:

Stablecoins from a wallet provisioned through Bridge.xyz under the agent's DID. See Stablecoin payments.
TNZO from the agent's native balance.

Network fees are paid in TNZO, or in the same stablecoin if the agent holds no TNZO. Every payment is signed by the agent's hardware-rooted key and counted against its daily limit, whatever rail it uses.

Payments: identity binding and the full list of rails.
Agents: creating agents and machine identities.
ERC-8004: agent registry and reputation, which merchants can use to decide whom to serve.