New architecture uses crypto hashes to secure autonomous shopping agents

A new research paper by Dimitrios S. Sfiris introduces a decision-centered reference architecture designed to make autonomous shopping agents — AI systems that can prepare checkout, generate transaction language, and act under delegated payment authority — trustworthy. The architecture is protocol-agnostic and built around a canonical decision envelope that includes protected dependency hashes, result hashes, and authentication via Ed25519 or HMAC. It also introduces a seven-axis generated-claim gate, live-request rebinding, execution-time dependency revalidation, and eleven semantic invariants that enforce rules such as stale-decision prevention and surface-bound status consistency.

The architecture was evaluated using an open-source JavaScript implementation across eight deterministic ecommerce scenarios and five controlled ablations. Results showed that all initially valid actions were permitted, but once a protected state changed, none could proceed without a fresh decision. A hostile-accessor case remained blocked. The suite passed 66/66 tests, schema validation, and committed examples. However, the paper notes that the findings do not establish rule completeness, production security, performance, legal compliance, or independent replication. For developers building agentic commerce systems, this blueprint provides a rigorous foundation for preventing unauthorized transactions and ensuring auditability.