The agentic web gets execution rights, from payments to app actions

One of the characteristics of the agentic web is an increasing ability for AI agents to execute actions on the web on our behalf. This is a key part of the shift from a web of pages to a web of capabilities — but it also introduces significant security, governance and financial risks.

This week’s market signals converge around that shift toward execution rights: Visa and Mastercard are developing infrastructure for automated payments, Apple is making app capabilities callable by its system intelligence, OpenAI is investing in persistent agent execution, and Google is packaging organisational knowledge for agents to use.

Market Signals

📡 Visa and Mastercard compete to be agentic rails for payments

On 10 June, both of the leading payment networks unveiled rival frameworks for letting AI agents pay on a user's behalf.

Visa partnered with OpenAI "to enable secure Visa payments within agentic commerce." The announcement highlighted "developer-focused experiences powered by Codex," along with other "more automated and conversational workflows." There was also a heavy emphasis on authorization and security:

"Transactions will operate within clearly defined user permissions, policies and controls, such as spending limits, merchant categories or required approvals. Transactions will use tokenized Visa credentials and real-time authorization and fraud monitoring..."

Meanwhile, on the same day, Mastercard announced Agent Pay for Machines (AP4M), which brings Mastercard's services "to machine-driven commerce, helping AI innovators enable secure, reliable payments as software begins to transact on its own."

Cloudflare, Stripe and Coinbase are among the initial partners, and the functionality sounds similar to the Visa announcement — except there are several blockchain companies involved. According to Coindesk:

"The company said the system can authenticate agents, enforce spending rules and settle payments across multiple payment methods, including stablecoins. [...] Mastercard said permissions and credentials associated with AI agents will initially be recorded on the Polygon, Solana and Base blockchains."

Both the Visa and Mastercard announcements indicate that agentic commerce — giving agents the ability to spend real money — is arriving fast.

📡 Apple makes apps callable by system intelligence

As noted over the past few weeks, it's developer conference season and this time it was Apple's turn. As with Google and Microsoft, there was a heavy AI theme with Apple's WWDC. Apple’s approach is to embed intelligence across its operating systems and make more app content and actions available to Siri and Apple Intelligence.

As Nate B Jones put it in his commentary, "Apple is trying to turn AI from something you rent in the cloud into something built into the computer you bought."

As always with Apple, the web wasn't front and center in its announcements. But there was one key agentic web-adjacent upgrade: App Intents. This framework now aims to "make content and actions discoverable by Apple Intelligence and support system experiences like Siri, Spotlight, Shortcuts, and widgets."

The App Intents framework itself isn't new — it goes back to 2022, when it was Siri-focused — but Apple has now expanded it into an action layer for Apple Intelligence. As Jones described it, App Intents in 2026 is "how an app tells Apple Intelligence, 'Here's what I have. Here's what the user can do with it, and here are the actions you are allowed to take.'"

This reminds me of WebMCP, which is how websites and web apps can expose their functionality to an AI system. While App Intents is a native Apple framework rather than a web protocol, the architectural pattern is similar: applications expose structured capabilities that an AI system can discover and invoke.

📡 OpenAI moves Codex toward persistent cloud execution

OpenAI’s planned acquisition of Ona, a "platform for background agents," points to the next phase of Codex, its AI coding agent: secure, persistent execution that can continue independently of a user’s local session. It's a signal that agent execution is moving from bounded interactive sessions toward long-running cloud services.

The announcement also highlights the infrastructure required to make long-running agents viable in business settings: controlled access to credentials and internal systems, activity logging, review processes and customer-defined security boundaries.

Anthropic outlined a similar architectural direction with Managed Agents back in April, described as its "hosted service for long-horizon agent work," so this isn't a new development. But it's notable that OpenAI is now buying infrastructure to make persistent execution a core part of Codex.

(Is this "agentic web"? Given that all these OpenAI and Anthropic agents will be visiting and using websites or apps, I'd say yes!)

📡 Google proposes a portable knowledge format for agents

Google has announced a new spec called the Open Knowledge Format (OKF), which aims to represent knowledge "as a directory of Markdown files with YAML frontmatter." The goal is primarily to enable internal company knowledge to be packaged in a way that is accessible to agents, without the need for a proprietary SDK or translation layer.

It's purposely positioned as a starting point — v0.1, according to the announcement. "The format will evolve as more producers and consumers emerge and as we collectively learn what knowledge representations agents actually need in practice," says Google.

While not strictly a market signal about agent execution, OKF is helping build the foundation for that. After all, giving agents execution rights is not simply a matter of connecting them to tools. They also need enough organisational context to understand what an action means, which data and definitions apply, and what operational constraints they must observe.

Watchlist

👀 Zscaler's agent broker

Security company Zscaler announced an "AI Broker" last week that aims to govern agent communications passing through MCP and A2A, while applying access controls and tracking how agents interact with company data. Clearly, this fits our theme this week of agent execution — and putting enterprise-level controls around that.

Also it's another example, like Arcade (which just got funded to the tune of $60 million), of infrastructure that sits between agents and the systems they act upon.

Thanks for reading Agentic Web News — my independent analysis of the companies, standards and ideas shaping the next phase of the web. Alongside weekly market signals, I am publishing interviews with the early builders defining this space.

If this issue helped clarify where the agentic web is heading, please forward it to someone who should be tracking this trend.

To receive future editions, subscribe by email. It's currently free, but you can also become a founding supporter of AWN, to help it become financially viable.

I also advise companies on agentic web strategy, Agent Experience, AI visibility, and agent-facing product strategy. Learn more at ricmac.org.