The FIDO Alliance has launched a new standards initiative aimed at establishing trusted authentication, authorization, and payment frameworks for AI agents, marking a significant expansion of its work beyond passkeys and digital credentials into the emerging infrastructure for agentic AI.
The initiative includes the formation of an Agentic Authentication Technical Working Group and the development of specifications for agent-initiated commerce through FIDO’s Payments Technical Working Group. The work will draw on initial technical contributions from Google’s Agent Payments Protocol (AP2) and Mastercard’s Verifiable Intent framework, both of which are designed to help verify that an AI agent is acting on behalf of a legitimate user and within clearly defined limits.
The announcement formalizes a direction that has been building across the identity sector. Earlier this month, OpenAI joined the FIDO Alliance board, citing the need for secure and private identity frameworks as AI agents begin acting on behalf of users. April has also seen the launch of Mastercard and Google’s Verifiable Intent, which links a consumer’s verified identity, their instructions to an AI agent, and the resulting transaction in a tamper-resistant cryptographic record.
Authentication Models Move Beyond Human Clicks
FIDO said current authentication and authorization systems were built primarily for direct human interaction, not delegated actions carried out by software agents. That creates a gap for service providers, merchants, and financial institutions that need to know who authorized an action, what the agent was allowed to do, and whether the final transaction stayed within those boundaries.
“AI agents are quickly becoming part of how people get things done online, from making purchases to managing everyday tasks,” said Andrew Shikiar, executive director and CEO of the FIDO Alliance. “To scale this safely, people need to trust that these actions are secure, authorized and truly reflect their intent.”
The Agentic Authentication Technical Working Group will focus on how users can securely and privately delegate actions to AI agents while maintaining phishing-resistant authentication. At launch, the group is chaired by members from CVS Health, Google, and OpenAI, and vice-chaired by members from Amazon, Google, and Okta.
Agentic Commerce Gets a Standards Track
In parallel, FIDO’s Payments Technical Working Group, chaired by members from Mastercard and Visa, will work on specifications for agent-initiated commerce. Google has contributed AP2, an open protocol for secure delegation, verifiable authorization, and trusted transaction execution. Mastercard has contributed Verifiable Intent, co-developed with Google, to help users authorize and control actions performed by digital agents.
The work builds on FIDO’s broader shift from passwordless authentication into adjacent trust infrastructure. The alliance recently launched a Digital Credentials Initiative to support interoperable identity wallets and verifiable credentials, while other companies are also exploring how verified identity can be linked to AI agents, including World’s Agent Kit for iris-verified users.
Stavan Parikh, VP and GM of Payments at Google, said contributing AP2 to FIDO would help keep the protocol “open, platform-agnostic, and community-led.” Pablo Fourez, Mastercard’s Chief Digital Officer, said agent-initiated commerce will require user intent to be “explicit, verifiable and trusted.”
FIDO said work has already begun within the new workstreams and that it will provide updates as the standards process progresses.
Sources: Business Wire, Google Cloud, Mastercard
–
By Cass Kennedy
Follow Us