Agent Commercialization Enters Deep Waters, Ant Launches APASS to Strengthen Trust Infrastructure

On September 11, at the 2026 Inclusion · Bund AI Payment Forum, Ant Group launched APASS, a trust infrastructure for commercial activities of Agents.

Based on the KYA (Know Your Agent) concept, APASS establishes two trust chains—identity and behavior—through its trusted identity products for Agents and risk control services for Agents. It provides capabilities such as identity registration, continuous verification, intent security, and trusted evidence, addressing questions like "Who is the Agent, who does it represent, what is it authorized to do, and is its behavior trustworthy," thereby providing a trust foundation for Agents to call services, handle business, and participate in payments.

As Agents move from being "tools" to "actors," a new commercial trust infrastructure is becoming an essential part of the AI-driven economy.

Agents Are Becoming New Participants in the Business World

Previously, AI mainly helped people generate content, obtain information, and assist in decision-making; now, Agents are further executing tasks on behalf of people.

They can search for products, book tickets, shop, and even complete payments on behalf of users. They can also represent companies in procurement, marketing, customer service, and business collaboration. As more commercial activities are autonomously completed by Agents, the participants in commercial activities are changing—transactions previously initiated and executed by people are now beginning to involve Agents acting on behalf of people.

Gartner predicts that by 2028, 90% of B2B procurement will be completed by AI agents as intermediaries, driving over $15 trillion in B2B spending through AI agent platforms.

This also raises a new issue that did not exist before: when AI starts doing business on behalf of people, who should the business world trust?

The traditional internet trust system is primarily built around "people - accounts - platforms," confirming transaction parties through real-name authentication, account systems, and risk control mechanisms. However, Agents are neither traditional humans nor passive software executing commands—they can perceive, make decisions, call tools, and act autonomously.

Therefore, once Agents enter the real commercial world, they must not only solve "can they do it," but also "can they be trusted to do it."

Figure caption: Chen Shupeng, AI payment security officer of Ant Group

"Agents are becoming the 'new population' of the business world. When they start calling services and participating in transactions, the industry must answer both 'who is involved in the transaction' and 'why the transaction is happening.'” said Chen Shupeng, head of AI payment security at Ant Group. “APASS helps participants confirm who the cooperating Agent is, who it represents, what authorization it has, and whether it is currently trustworthy, and provides traceability evidence in case of issues."

From "Who Are You" to "Who Do You Represent and What Can You Do"

A change brought by Agents is that one-time identity verification is no longer sufficient.

An Agent may be created by an individual but run on a third-party platform; it may represent an individual or a company; it may receive one-time authorization or continuously call services. At the same time, its operating environment, task objectives, and actual behavior may also change at any time.

Therefore, the Agent era requires not just confirming an ID, but a continuous trust mechanism throughout the entire action process.

APASS revolves around four core capabilities—trusted identity, continuous verification, intent security, and trusted evidence—to integrate identity confirmation and behavioral risk management throughout the entire process of Agents participating in commercial activities.

In terms of identity, APASS uses a three-layer model of static identity, runtime identity, and responsible entity identity, combined with a six-dimensional continuous verification mechanism, to identify Agents, confirm their operational status, and link them to the responsible entities behind them.

In terms of behavior, APASS verifies identity and authorization before a transaction, identifies abnormal behavior and intent deviation during the transaction, implements dynamic risk control, and retains key evidence after the transaction to provide a basis for auditing and accountability tracing.

In other words, APASS aims to extend the traditional "ID verification" into continuous verification of an Agent's identity, authorization, intent, and behavior.

Behind this is a larger industry shift: computing power enables AI to operate, models make AI smarter, but trust mechanisms determine whether AI can truly enter the real commercial world.

Over 1 Million Agents Connected, 50+ Institutions Building an Ecosystem

According to the event, APASS has currently connected over 1 million Agents, with 110,000 activated, covering 442 intelligent agent service providers, supporting different types of Agents such as independent assistants, productivity tools, hardware terminals, and merchant services.

Developers can complete the integration through three steps, embedding trusted capabilities into service calls, business processing, and payments. APASS uniformly adapts to different entities and technical paths, reducing developers’ repeated investments in identity access and security capability integration.

At the same time, more than 50 institutions, including Alibaba, Li Auto, Ant Group, Damaicai, Lenovo, OPPO, Qwen, Step, Xiaomi, Ctrip, China Bank Card Testing Center, Zhipei, Zhipu Credit, China Academy of Information and Communications Technology, and China Mobile Financial Technology, have joined the IIFAA Intelligent Agent Trust Ecosystem Construction Plan, jointly promoting the development and implementation of related alliance standards.

In terms of international protocol connections, Alipay+ AMP, Mastercard's Verifiable Intent, and Visa's Intelligent Agent Trust Protocol have established a KYA interoperability framework, supporting Agent identity verification and trust collaboration in cross-border commercial scenarios.

From ensuring transaction trust in digital economy via Alipay services, to supporting Agents in commercial activities via APASS, Ant is extending its long-term accumulated identity, security, risk control, and payment capabilities into the Agent scenario.

Previously, Alipay solved how people and merchants establish transaction trust; in the future, what APASS explores is how people and Agents, Agents and merchants, and even Agents and Agents establish action trust.