Something real shifted in commerce this year, and most of the commentary around it is focused on the wrong question.
Visa recently announced a strategic collaboration with OpenAI to bring secure, identity-verified payments directly into AI-driven shopping experiences. Major payment networks don't make moves like that on a hunch — they make them when a category has crossed from experimental into something worth building real infrastructure around. Agentic commerce, the idea that an AI assistant can discover, decide, and complete a purchase on someone's behalf, is no longer a thought experiment. It's a deployment target.
The industry conversation around this, though, keeps collapsing into one narrow question: can an AI agent successfully place an order? Increasingly, yes. New protocols for letting agents discover merchants and call their tools are maturing quickly, and "the agent created a cart and checked out" demos are everywhere.
That's the easy 80%. Travel is where the other 20% lives, and it's the part nobody's marketing slide wants to talk about.
Why travel breaks the standard playbook
Most agentic commerce infrastructure today assumes something travel doesn't have: a stable product. A SKU with a fixed price sitting in a catalog, waiting to be added to a cart. That model works beautifully for a t-shirt. It falls apart the moment the "product" is a seat on a specific flight that a human or an agent took eleven minutes to decide on.
A flight offer isn't a fact. It's a perishable claim with a clock attached. The price quoted at the moment of search can be different by the time checkout happens. The seat itself can simply not be there anymore. None of that is a bug in any individual system — it's how airline inventory has always worked, long before any of this involved an AI. The gap is that most of the emerging agent-commerce tooling was designed around retail's assumptions, not travel's, and there's an open, active conversation in the standards community right now about exactly this: contributors building merchant-facing protocols for AI agents have publicly flagged that the lack of a way to signal "this offer is only valid for the next N minutes" is one of the main reasons the leading agentic commerce standard isn't yet considered production-ready for travel specifically.
That's not a criticism of the standard. It's a fair description of how hard the problem actually is. Perishability is travel's defining trait, and almost nothing in the current agent-commerce stack was built with it in mind.
The part that actually matters: agents aren't naturally careful
Here's the thing that surprised us most while building toward this, and it's the part worth other teams hearing before they find out the hard way.
It is tempting to assume that a sufficiently capable AI model will just behave responsibly. It'll notice when an offer is about to expire. It'll flag a price that crept up between search and purchase. It'll hesitate before re-booking something that already exists. In practice, none of that can be assumed, and assuming it is where the real risk lives.
A language model calling a booking tool is making its best judgment call in the moment, based on whatever it's been told and whatever data happens to be in front of it. That's genuinely useful, and modern models are good at it. But "the model usually behaves well" is a completely different claim from "the system cannot be made to overspend, double-book, or silently swap one set of terms for another." The first is a tendency. The second is a guarantee. Only one of those is something you can actually stand behind when real money and a real traveler's itinerary are on the line.
The practical implication is that every meaningful safety property — a hard budget ceiling, a cabin-class policy, a rule that a flight has to be direct, a requirement that any meaningful airline-initiated schedule change gets a human's eyes on it before anything happens automatically — has to be enforced by the platform sitting between the agent and the booking, not hoped for from whichever model happens to be making the call that day. The agent should be free to reason, suggest, and act quickly. The guardrails need to exist completely independently of whether it chooses to respect them.
What "safe" actually requires, in plain terms
Once you take that seriously, the requirements stop being abstract and become very concrete.
Every offer needs an honest expiry, enforced server-side, not just displayed as a courtesy. A price has to be reconfirmed immediately before money moves, not assumed stable from however many minutes earlier it was first quoted. Spending limits, cabin policy, and routing preferences need to be checked against the actual final terms of a booking, not just the terms that looked fine at the moment of search. A booking attempt that looks like a duplicate of something already purchased needs to be caught before a second charge happens, not after. And critically: anything an airline changes after the fact — a schedule shift, a downgraded itinerary — has to surface to an actual human decision, because that's exactly the kind of judgment call that shouldn't be delegated to an agent acting alone, no matter how capable it is.
None of this is exotic engineering. It's the unglamorous, table-stakes work of building a transactional system that's actually trustworthy, applied to a domain — travel — where the standard agentic commerce tooling hasn't fully caught up yet. Every one of these properties has to be proven, not assumed. The honest way to know a guardrail works is to actively try to break it, watch it hold, and keep a permanent record that it did.
Where this is heading
The standards layer for agentic commerce is moving fast, and that's a good thing — a shared, open way for agents to discover and transact with any business, regardless of platform, is genuinely valuable infrastructure for the whole industry. Large travel technology players are already shipping their own agent-facing interfaces, and that's a healthy sign the category is real, not speculative.
What's still missing, broadly, is the execution layer underneath travel specifically: the part that takes "an agent can call a booking tool" and turns it into "an agent can be trusted to book within real constraints, with a permanent, auditable record of exactly what it was and wasn't allowed to do." That's the layer we've been building at Zologic, under the name ucp.travel — not a replacement for the emerging standards, but the travel-specific safety and policy infrastructure that sits on top of them, so that the convenience of "just ask the AI to book it" doesn't come at the cost of the control any business or traveler would reasonably expect to keep.
The easy part of agentic commerce is already here. The trustworthy part is what's actually being built right now — and travel, with its perishable inventory and real financial stakes, is as good a proving ground for that as any.
We're building ucp.travel, the policy and safety execution layer for autonomous travel booking. If you're thinking about similar problems in agentic commerce — perishable inventory, mandate-based spending controls, audit trails for autonomous transactions — we'd like to hear from you, and you're welcome to try ucp.travel directly at ucp.travel.