Agentic Commerce Attribution: The Click Is Gone

TL;DR When an AI agent assembles a shopping cart for a customer, the click your reporting depends on never happens. The session belongs to the agent, the decision happened inside a model you cannot see, and the order lands in your data with no referrer worth the name. That is the agentic commerce attribution problem, and it is already live in Polish retail. Below: what changed, what the commerce standards define, what they leave out, and what you can measure instead.

One clarification first, because two different things are called “agents” this year. This article sits inside our guide to how the rest of the AI stack in advertising fits together, and it concerns agents on the demand side: software that shops for a consumer. Agents that buy media on an advertiser’s behalf are a separate problem with a separate failure mode, and we covered agents that buy media rather than groceries on its own.

What is agentic commerce attribution?

Agentic commerce attribution is the problem of assigning credit for a purchase when an AI agent, not a person, performed the browsing, comparison and cart assembly. The human still approves and pays, but the path from first exposure to basket runs through a model, so the referrer, session and click-path signals that attribution relies on are missing.

Attribution has survived signal loss before. What makes agentic commerce attribution different is that the buyer never visited the site at all.

Where did agentic commerce attribution become a live problem?

On 12 October 2026, Polish outlet Spider’s Web reported that Żabka had opened AI-assisted shopping in beta across its Jush quick-commerce service and the delio online supermarket. A customer connects a compatible AI tool to their account, describes a need – a recipe, a photo of the fridge, a dietary constraint – and the agent searches the catalogue, checks promotions and builds a cart.

Three details matter more than the launch itself.

It runs on Model Context Protocol as a remote server. Nothing is installed on the customer’s device. The retailer exposes a defined set of functions and the agent calls them like any other tool.

The agent does not complete the purchase. Spider’s Web is explicit: the technology neither places nor pays for the order. The customer reviews the cart and finalises it in the app. For agentic commerce attribution this boundary is the most useful fact in the whole story.

It is a grocery retailer, not a marketplace. A retailer decided a machine may read its catalogue and promotions on a customer’s behalf.

Why does agentic commerce attribution start at the cart, not the click?

In a conventional flow a person clicks, lands, browses, adds and buys, and every step leaves a timestamp you can join to media. In an agent-assembled flow a person states an intent once, and the next thing your systems see is a finished basket submitted through an API.

The cart is the first artefact both parties can see. Everything before it happened somewhere you have no access to: which products the model considered, what it rejected, whether it ever met your promotion, whether your brand was named by the customer or chosen by the agent. The cart is also the last point where a human intervenes.

So the unit of measurement moves. Agentic commerce attribution is not “which touchpoint preceded the click” but “which inputs shaped the basket, and which of those did we pay for”. Different questions, different instrumentation.

What does the agent actually tell you about itself?

Less than you would hope, and the protocol documentation is clear about why. This is where agentic commerce attribution stops being a reporting problem and becomes an architecture problem. The MCP specification release candidate dated 2026-07-28 describes a deliberately stateless core: the session handshake and session header were removed so any server instance can serve any request. Conversation state lives in explicit handles the model passes back as ordinary arguments, the specification’s own example is a basket_id.

Client identity is thinner still. A field called clientInfo carries a name and version, telling you that something calling itself a given tool made the request. The specification does not present this as authentication. Authorization is handled separately, through hardening aligned with OAuth 2.0 and OpenID Connect, issuer validation, credential binding, client registration, which establishes that a request is permitted, not that a human was persuaded by an ad. For agentic commerce attribution that distinction is the whole game: permission is not provenance, and no amount of protocol compliance turns one into the other.

Read it as an engineer rather than a marketer and the conclusion is useful. The agent is a well-behaved API client with a declared name. It is not a browser, it carries no campaign parameters by default, and it was never designed to tell you where it came from. Any agentic commerce attribution model that holds up is built on top of that fact rather than around it.

Where does the agentic commerce attribution gap open?

Two figures from a guest column by global media executive Evgeny Popov, published by AdExchanger on 28 May 2026, size this better than any projection.

On latency: an agent deciding every four milliseconds faces more than 21 million missed decision windows under a one-day reporting delay. Stretch that to a week and the system “has made more than 150 million choices before the data arrives”.

On credit: two households buy the same product. One was persuaded by roughly $12 of working media. The other was attributed $48 of media that arrived after the decision was already made. Standard reporting records two identical conversions. Popov calls it measurement arbitrage, and the phrase is fair.

Agent-assembled carts push both failures the same way. Latency grows because the decision happens where you observe it only afterwards. Misattribution grows because the last observable event is an API call that any downstream model will treat as the cause. That is the agentic commerce attribution gap in one sentence: the system keeps paying for influence that arrived late.

What do the commerce standards define, and what do they leave out?

Read the specifications rather than the commentary. The Agentic Commerce Protocol, maintained by OpenAI and Stripe and described in its own repository as in beta, defines an interaction model connecting buyers, their agents and businesses. It ships a checkout API specification and a delegate payment specification, passes secure payment tokens through agents, and lets agent developers enable transactions without becoming the merchant of record.

What the repository does not describe is attribution or order tracking. Not as a gap to be filled later, simply outside scope. The standard answers “how does an agent complete a purchase safely”. It does not answer “who gets credit”, which means agentic commerce attribution is not a problem the ecosystem will solve on your behalf. Payment rails standardise. Credit assignment does not, because credit assignment is a commercial dispute, not a technical one.

Signal	Conventional web session	Agent-assembled cart	What you can still do
Identity	Cookie, login, or hashed email at checkout	Account the agent was authorised against; the tool’s declared name	Join on the account, not the session. The customer linked it deliberately
Intent	Search terms, filters, category path	A natural-language brief you never receive	Infer from basket composition and substitution patterns
Timing	Ordered timestamps from impression to purchase	One API call after the decision was taken	Stop treating the last event as the cause; model it instead
Channel	Referrer and campaign parameters	Nothing by default; the protocol was not built to carry it	Treat agent traffic as its own channel, not as direct
Conversion	Order confirmation in a browser you tagged	Cart handed over, then approved by a human elsewhere	Record cart assembly and approval as two separate events

What can you measure instead of the click?

Four things survive, and every one depends on data you collect yourself. Without a data set that does not depend on anyone else’s identifier, agentic commerce attribution is not merely hard, it is impossible, because each remaining signal is keyed to your own account records.

1. Agent traffic as a declared channel

Tag a cart assembled by an agent as such at creation, with the declared client name stored beside it. You get no campaign, but you get a population you can compare against everything else.

2. The gap between assembly and approval

Because the agent hands over rather than completes, you hold two timestamps: basket built, human accepted. The distribution of that gap, and the edits inside it, is a behavioural signal nobody had before.

3. Basket composition as an intent proxy

You never see the brief, but you see the result. Which products appear together, which substitutions were made, whether a promoted line was included or skipped — that answers “did our offer reach the decision” more honestly than a view-through ever did.

4. Incrementality, measured deliberately

When the path is unobservable, the only trustworthy answer comes from withholding exposure and comparing outcomes. Geo holdouts and randomised tests do not care whether a click occurred. They are slower and costlier than reading a dashboard, which is why most teams avoid them until the dashboard stops working.

How do you prepare a stack for agentic commerce attribution?

A sequence, ordered by what costs least to reverse.

Audit what an agent would see. Expose catalogue, availability and promotions in structured form and read it back as a machine would. If promotion logic lives only in the front end, an agent never meets it.

Give agent traffic its own identity in reporting. A field written at ingestion, not a filter applied later. Retrofitting is how teams end up with a year of agent orders filed under direct.

Separate the two conversion events. Cart assembly and human approval are different facts. Collapsing them into one order record destroys the only new signal this channel gives you.

Decide the authorisation model before the volume arrives. Which functions an agent may call, under whose consent, and how consent is withdrawn. The protocols give mechanics; the policy is yours.

Budget for incrementality testing. Once agent-assisted orders are a meaningful share of revenue, deterministic agentic commerce attribution for that share is not coming back.

What does this change for retailers and publishers?

For retailers the trade is visibility for reach. Letting an agent read your catalogue puts you in consideration sets you would otherwise miss and costs you the browsing data you used to monetise. Żabka’s boundary – agent builds, human pays – is a sound first position because it keeps the final step, and the payment relationship, inside the retailer’s own app.

For publishers the question is sharper, because agentic commerce attribution breaks on their side of the trade too. If a growing share of purchase decisions is taken inside a model rather than on a page, impressions on that page are priced against an outcome they can no longer be connected to. The infrastructure barely changes, the same plumbing these acronyms refer to, DSPs, SSPs and ad servers, carries the same bids. What changes is the confidence behind the number at the end of the chain.

FAQ

Where this leaves you

The click never persuaded anyone. It was a convenient proxy that happened to be cheap to record, and agentic commerce attribution removes the convenience without removing the question. Teams that handle this well will be the ones already uncomfortable with last-click arithmetic, because the work is the same work: measure the outcome, model the contribution, stop paying for influence that arrived after the decision.

If you are building instrumentation for a channel standard tools do not report on, how we build measurement for channels nobody else can see is on our services page.