Visa Trusted Agent Protocol
The Visa Trusted Agent Protocol is a specification for letting a merchant recognise that an approved agent with commerce intent is the thing visiting its site, rather than a crawler or something worse. It carries a signed agent-recognition header and a way for the merchant to ask the agent for what it needs. It answers who is asking, not what a resource costs.
The published material frames the problem as recognition. Its stated concern is that as agentic commerce becomes more prevalent, merchants or their site-protection providers could confuse agent interactions with bots such as web crawlers, or with bad actors — so the protocol covers how a merchant recognises an approved agent with commerce intent, and how the merchant makes requests back to that agent, for payment or for further information.
The recognition mechanism is not new machinery. The specifications state that the agent recognition signature is based on the HTTP message signatures defined by RFC 9421 and aligned with Web Bot Auth, requiring the Signature-Input and Signature fields to be present, with consumer recognition data carried in the body and linked to the message signature.
Its relationship to the HTTP payment rails is that it sits beside them rather than competing. A rail like x402 answers what a resource costs and how to pay for it; this answers whether the party asking is a recognised agent, for two named interactions — browsing, and a payment interaction where the agent supplies what is needed to buy. Recognition is a question a payment challenge does not ask.
→ probe402 measures the HTTP payment rails rather than agent-recognition, and what it sends and reads at each check is set out in the method.
Sources
Related RFC 9421 · Web Bot Auth · agentic commerce · agent