Google's Agent Calls the Store, and Every Protocol Guarantee Falls Off

The same companies that spent two years building cryptographic rails for agent commerce — signed intent, signed carts, verifiable payment mandates, contributed to the FIDO Alliance — have shipped their most visible consumer agent feature over a channel that carries none of it. Google's shopping agent now phones shops to ask what is in stock, and the moment an errand leaves the protocol rail for the phone, caller identity becomes a spoken claim, authorisation disappears entirely, and the only record of what was agreed is a summary the agent wrote about itself.

What actually shipped

Google's agentic shopping features — conversational search, agentic checkout, and an agent that places phone calls to local shops — have been rolling out through summer 2026 and the rollout is still running as of early August. The calling piece is the one worth looking at closely, because it is narrower than the coverage suggests and more consequential than its narrowness implies.

Property	What Google says	Why it matters
Scope	Selected categories in the US — toys, health and beauty, electronics among them	Deliberately small. This is a bounded pilot, not a general-purpose calling agent.
Errand	Ring around local shops to check stock, prices and availability	A real errand, and one that no merchant API answers for most shops.
Disclosure	The agent identifies itself as an automated caller	Voluntary, per-vendor, and the FCC's rule defining what such a disclosure must say was still a proposal in August 2026.
Callee control	Businesses can opt out of receiving the calls	Per-vendor opt-out. There is no cross-operator registry a shop can register with once.
Result	The user gets a summary by text or email, plus local inventory details	The summary is the agent's own account of a conversation nobody else recorded on the user's behalf.

Read that table as a product and it is unremarkable — a useful, carefully scoped assistant feature. Read it as a protocol decision and it is the most interesting thing in agent commerce this year, because of what it sits next to.

The rail that was built, and the rail that gets used

Which rail an errand takes is decided by the merchant's integration budget, not by how much the outcome matters.

Google announced the Agent Payments Protocol in September 2025 with a large launch cohort spanning card networks, processors and enterprise software, built around signed Intent, Cart and Payment Mandates — a chain of cryptographic authorisations that lets an agent transact without the merchant trusting the agent's word about who it represents. In April 2026 Google released v0.2 and contributed the protocol to the FIDO Alliance, and in May the Alliance announced that AP2 and Mastercard's Verifiable Intent had both been contributed to it. Competing designs exist, most retailers integrating in 2026 are doing more than one in parallel, and the public evidence remains largely documentation of design intent rather than proof of volume.

That is a serious body of work aimed squarely at the trust problem: an agent showing up at a merchant is an unknown party claiming to act for someone, and the mandate chain is how it proves the claim. Every guarantee in the stack — who is calling, what they are allowed to do, whether this request already happened, what was agreed — is carried in the request itself.

Then the shopping agent needs to know whether a hardware shop three suburbs over has the part. That shop has no AP2 endpoint. It has no API at all. It has a phone, a person, and a shift that ends at six. So the agent dials, and everything in the paragraph above is left behind at the trunk.

What falls off when the agent picks up the phone

Every row below the first is a downgrade the user never chose and cannot see.

The interesting comparison is not phone-versus-API in the abstract, it is what each channel can promise, guarantee by guarantee. Caller identity on the protocol rail is a signature; on a call it is a sentence the agent speaks, which is exactly as trustworthy as the same sentence spoken by anyone else. Scoped authorisation on the rail is a mandate that says what this agent may commit its principal to; on a call there is no such object, so the scope is whatever the model decides to say next, bounded only by its prompt.

Replay protection is where the gap gets operationally sharp. A structured request carries a nonce or an order ID, so a retry after a timeout is safely deduplicated. A phone call that drops after the shop agreed to set something aside has no identifier at all — the exactly-once machinery you would normally reach for has nothing to grip, and the only mitigations are asking a confirming question before the commitment and keeping a durable local record so a human can reconcile afterwards.

And the receipt: on the rail, both parties end up holding a signed artefact describing what happened. On a call, the user receives the agent's summary of the conversation. It may be perfectly accurate. It is also unfalsifiable by anyone except the shop assistant, who is not keeping records either. A browser agent on a web checkout sits in between — it borrows the user's own session for identity, gets an order ID for free, and can point at an order confirmation page — which is worth noting because it shows the degradation is a gradient, and the phone is at the bottom of it.

Why the phone is permanent, not transitional

The comfortable reading is that this is a stopgap: protocols are early, adoption will spread, and in a few years the agent will hit an endpoint instead of a switchboard. That reading underestimates the shape of the merchant population.

Agent-commerce protocols are being adopted by exactly the businesses you would expect — large retailers, marketplaces, payment providers, anyone with an integration budget and enough agent-originated traffic to justify one. The errand Google chose to demonstrate is the opposite population: independent shops, franchise branches, service counters, the places whose stock is not in any feed and whose staffing does not extend to an integration project. There is no plausible future in which the corner hardware shop implements a mandate protocol, because the cost is not the code — it is having anyone at all whose job includes maintaining an API.

So the phone is not the bottom rung of a ladder everyone is climbing. It is the permanent floor of agent commerce, the channel that covers the enormous tail of merchants that structured rails will never reach, and it is the channel with none of the trust machinery. The industry has spent its standards effort on the population that needs it least — large merchants already have contracts, chargeback rights and legal recourse — and none on the population where an agent's word is the only thing on offer.

There is a second-order effect worth watching. If agent-originated calls become common, the small merchant's phone line stops being a customer channel and starts being an unauthenticated API with a human parser, serving requests from parties it cannot identify at a volume it did not agree to. That is a cost transfer, and nobody has priced it.

The callee has no controls worth the name

None of the three exists as a standard. All three exist on the rail the same companies built for merchants with an API.

Google does the responsible things available to it: the agent says it is automated, and a business can opt out. Both are real and both are structurally insufficient, for the same reason — they are properties of one vendor's product rather than properties of the channel.

Opt-out is the clearest case. A shop that does not want agent calls has to discover, individually, that each operator exists, find that operator's opt-out mechanism, and use it — Google documents one such route as calling a number and leaving a voicemail with the business name. Multiply by every company that ships a calling agent and the burden lands entirely on the party with the least capacity to carry it. What would work is a single registry every operator honours, and that is a standards problem the same consortia are already equipped to solve. They simply have not been asked to.

Disclosure has a similar shape. The FCC's February 2024 declaratory ruling settled that an AI-generated voice is an "artificial or prerecorded voice" under the TCPA, but the TCPA's restrictions are written around residential lines and wireless numbers — a shop's business landline is not the party that framework was built to protect. The FCC's rulemaking to define an AI-generated call and mandate disclosure language was still a proposal as of August 2026. So for calls to businesses, "the agent announces itself" is a voluntary norm being set right now by whoever ships first, and norms set that way are exactly as durable as the competitive pressure that follows them. The EU is further along in one narrow respect: the AI Act's transparency obligations, enforceable since 2 August 2026, require that a person be told they are interacting with an AI system — which is the same principle that made the disclosure question unavoidable for agents generally.

The third question is the one nobody is asking. The shop assistant who said "yeah, we can hold one for you" has entered into something, has no record of it, and will not be able to contest the user's account of it. On the protocol rail that is solved — both sides hold a receipt. On the phone, the party with the recording is the party that placed the call.

If you are building on either end of this

Two audiences, two very different lists.

If your agent places the calls	If your business receives them
Disclose in the first sentence, unprompted, every call. The regulation is unsettled; the norm is being set now and you are setting it.	Decide your policy before the volume arrives, not after. "We answer agent calls for stock questions but not orders" is a fine policy and it needs to exist in writing.
Never let the model assert an outcome inline. Extract a typed result from the transcript with a confidence field, and make downstream code handle low confidence explicitly.	Ask any caller to confirm in writing before anything is reserved or committed. It is the only receipt either side will have.
Keep a durable intent record written before you dial, so a dropped call is reconcilable by a human rather than silently retried.	Log agent calls separately from customer calls. You cannot argue about a cost you have not counted.
Honour opt-outs across your whole operation, immediately, and make the suppression check a precondition on dialling rather than a prompt instruction.	Find and use each operator's opt-out if you want out. It is per-vendor today, and there is no shortcut.
Treat the transcript as adversarial input on the way back in. Whatever the far end said is untrusted text entering your agent's context.	Train staff that a caller claiming to represent a customer is a claim, not a credential — the oldest social-engineering surface there is.

The engineering side of this is covered in more depth in telephony and PSTN integration and outbound voice agents, both of which make the same underlying point from the implementer's chair: the phone is a best-effort, unauthenticated, unacknowledged channel, and anything that needs a guarantee has to obtain it somewhere else.

FAQ

Is Google's calling feature available everywhere?

No. It launched for selected categories in the United States — toys, health and beauty and electronics among them — and related automated-calling features such as appointment booking and wait-time checks are US-only with some state exclusions. The rollout has been running through summer 2026.

Does the agent tell the shop it is an AI?

Yes. Google states the agent identifies itself as an automated caller, and businesses can opt out of receiving the calls. Both are vendor commitments rather than requirements set by a standard, and the FCC rule that would define mandatory disclosure language for AI-generated calls was still a proposal as of August 2026.

Why can't the agent just use AP2 or a similar protocol for these calls?

Because the merchants being called have not implemented one and mostly never will. Agent-payment protocols require a merchant-side integration, which suits large retailers and marketplaces; the long tail of independent shops has no API, no integration budget and no one whose job it would be. That gap is what the phone call is filling.

Do TCPA rules protect a shop from receiving agent calls?

Not straightforwardly. The FCC's February 2024 ruling confirmed that AI-generated voices count as artificial or prerecorded voices under the TCPA, but the statute's restrictions are built around calls to residential lines and wireless numbers. A call to a business landline sits largely outside that framework, which is why the practical control today is each vendor's own opt-out.

What would actually fix this?

Three things that are all standards problems rather than research problems: a signed caller identity a callee can verify, a single cross-operator opt-out registry, and a receipt issued to both parties after an agent call. Every one of them already exists in some form on the structured rail the same companies built for merchants with an API.