Routing Agentic Checkout: UCP vs. ACP Interoperability

Executive TL;DR:

• Legacy e-commerce checkout systems assuming human browser operators create severe bottlenecks for autonomous agent checkout flows.
• Agentic Commerce Protocol (ACP) routes checkouts natively within AI streams, while Universal Commerce Protocol (UCP) preserves merchant-controlled journeys.
• A unified Gateway routing layer abstracts ACP and UCP via structured discovery manifests and secure token exchanges.

---

How Do ACP and UCP Differ in Routing Autonomous Agent Checkouts?

ACP and UCP standardise the programmatic data exchange between autonomous agents and commercial storefronts to enable machine-to-machine checkout loops without human intervention. While both protocols eliminate brittle HTML scraping, they diverge on whether the transaction authority, discovery, and brand experience reside with the assistant or the merchant.

• Agentic Commerce Protocol (ACP): Co-maintained by OpenAI and Stripe, ACP standardises how an agent programmatically ingests structured merchant inventory feeds, manages shopping carts autonomously across sessions, and generates secure, pre-filled checkout sessions natively within chat interfaces.
• Universal Commerce Protocol (UCP): A merchant-centric interoperability framework co-developed by Google and Shopify that integrates shopping paths across agents, storefronts, and payment systems, ensuring merchants retain control over their business rules, pricing, and customer relationships.
• Shared Payment Tokens (SPTs): Temporary, time-constrained credentials exchanged in place of raw credit card strings to execute checkout flows securely without introducing PCI-DSS liability or key exfiltration risks.

---

How to Implement Dual-Protocol Commerce Schemas with Drizzle ORM

To support interoperable agent checkout routing, the database must maintain a dual-purpose registry tracking both agent compliance enums and e-commerce storefront readabilities. The following Drizzle ORM schema establishes the relational table structures necessary to track ACP-manifest storefronts and secure Google UCP credentials using PostgreSQL enums.

import { pgTable, uuid, text, boolean, pgEnum, timestamp } from "drizzle-orm/pg-core";

// Enums for payment protocols and compliance tiers
export const paymentProtocolEnum = pgEnum("payment_protocol", ["x402", "L402", "Stripe ACP", "AP2", "NONE"]);
export const ecosystemCertificationEnum = pgEnum("ecosystem_certification", [
  "SAP Compliant",
  "Salesforce Sanctioned",
  "Visa TAP Enabled",
  "Google UCP Ready"
]);

// Schema for tracking verified agent commerce capabilities
export const agents = pgTable("agents", {
  id: uuid("id").defaultRandom().primaryKey(),
  name: text("name").notNull(),
  slug: text("slug").unique().notNull(), // derived programmatically using slugify(name + hostname)
  supportsAcp: boolean("supports_acp").default(false).notNull(), // Stripe ACP support flag
  ecosystemCertifications: ecosystemCertificationEnum("ecosystem_certifications").array().notNull(), // Google UCP Ready tracked here
  enforcesMccRestrictions: boolean("enforces_mcc_restrictions").default(false).notNull(),
  createdAt: timestamp("created_at").defaultNow().notNull(),
});

// Relational table for grading e-commerce storefronts for agentic checkouts
export const agentReadyStores = pgTable("agent_ready_stores", {
  id: uuid("id").defaultRandom().primaryKey(),
  storeUrl: text("store_url").unique().notNull(),
  hasAcpManifest: boolean("has_acp_manifest").default(false).notNull(), // Checks for /.well-known/agent.json
  hasActionableSchema: boolean("has_actionable_schema").default(false).notNull(), // Schema.org actionableUrl
  hasHeadlessApi: boolean("has_headless_api").default(false).notNull(),
  hasX402Paywall: boolean("has_x402_paywall").default(false).notNull(),
  createdAt: timestamp("created_at").defaultNow().notNull(),
});

Feature Parameter	Stripe ACP (Agentic Commerce Protocol)	Google UCP (Universal Commerce Protocol)
Ingestion Manifest	Root-hosted /.well-known/agent.json	Root-hosted /.well-known/ucp
Discovery Focus	Assistant-centric (e.g., ChatGPT owns ranking & presentation)	Merchant-centric (Storefront retains direct customer relationship)
Primary Creators	OpenAI and Stripe	Google and Shopify
Checkout Surface	Inside the AI assistant conversational stream	Multi-surface (routes back to merchant-controlled flows or sites)
Key Security Hook	Stripe Link OAuth flow & 2-second card authorisation webhooks	OAuth-based delegated tokenisation and merchant-controlled IAM

---

Which Agents Support ACP or UCP Interoperable Checkout?

To safely deploy autonomous automation within your corporate estate, access the Agent Gateway Directory to filter and source agents holding verified enterprise-grade credentials. Every profile is dynamically evaluated on our visual extranet, ensuring they possess active cryptographic signatures, verified secure transport protocols, and fully compliant schema structures for immediate walled-garden integration.

Browse ACP-compatible agents in the directory →

---

Common ACP vs. UCP Architecture Questions

• Q: How does the architectural difference between ACP and UCP affect brand retention and customer loyalty programs for merchants?
  • A: Under ACP, the checkout and product presentation live inside the assistant's UI, which strips out custom branding and threatens a merchant's long-term viability. In contrast, UCP is designed to allow merchants to expose their native business rules, discount codes, and customer loyalty memberships directly to incoming agent queries. This architectural distinction preserves merchant control over the customer journey.
• Q: How must a gateway orchestrator resolve Stripe's strict 2-second authorisation SLA when routing ACP-compliant transactions?
  • A: Stripe's programmatic cards enforce a default 2-second timeout on authorisation webhooks. If the gateway routes these calls through inline Translation LLMs or Anomaly Detection LLMs to inspect payloads, the AI processing must be hosted in Next.js Edge Functions and cached globally via Upstash Redis to complete in milliseconds. If the overhead exceeds 2000ms, the card network will reject the purchase or fall back to default rules.