Ant Group Unveils APASS Trust Infrastructure as Agent Commerce Expands

According to a report by Leiphone, APASS combines agent trusted identity products with agent risk control services, covering identity registration, continuous verification, intent security and trusted attestation. It is organized around four questions: who an agent is, whom it represents, what it is permitted to do, and whether its behavior can be trusted.

"Agents are becoming the 'new population' of the business world," said Chen Shupeng, Ant Group's head of AI payment security. "When they begin to call services and take part in transactions, the industry must answer not only 'who is transacting' but 'why the transaction is happening.'" Chen said APASS helps parties confirm which agent is collaborating with them, whom it represents, what authorization it holds and whether it is currently trustworthy, and provides evidence for tracing problems after they occur.

AI agents are moving from generating content and supporting decisions to executing tasks on behalf of users, including searching for goods, booking tickets, shopping and completing payments, as well as procurement, marketing, customer service and business collaboration for companies. Gartner forecasts that by 2028, 90 percent of B2B procurement will be intermediated by AI agents, pushing more than 15 trillion dollars in B2B spending through agent transaction platforms. Traditional internet trust systems were built around the person-account-platform relationship, using real-name authentication, account systems and risk controls to confirm the transacting party. Agents are neither people in the conventional sense nor merely passive software executing instructions, since they can perceive, decide, call tools and act autonomously.

APASS addresses that gap on two levels. At the identity level, it uses a three-layer model covering static identity, runtime identity and responsible-party identity, combined with a six-dimension continuous verification mechanism to identify an agent, confirm its operating state and link it to the responsible party behind it. At the behavior level, it verifies identity and authorization before a transaction, detects behavioral anomalies and intent deviation during a transaction and applies dynamic risk controls, and retains key evidence afterward for auditing and accountability. The aim is to extend the conventional practice of checking an ID into continuous confirmation of an agent's identity, authorization, intent and behavior.

Figures disclosed at the forum state that APASS has connected more than 1 million agents, 110,000 of which are activated, covering 442 agent service providers. It supports independent assistant, productivity, hardware terminal and merchant service agent types. Developers can complete integration in three steps to embed trusted capabilities into service calls, business processing and payments, with APASS adapting to different entities and technical paths to reduce duplicated work on identity access and security integration.

More than 50 institutions have joined the IIFAA agent trusted ecosystem co-building plan, including Alibaba, Li Auto, Ant Group, Damai, Lenovo, OPPO, Qwen, StepFun, Xiaomi, Trip.com, the Bank Card Test Center, Zhipu, Zhima Credit, the China Academy of Information and Communications Technology and China Mobile Jinke, to advance the drafting and implementation of alliance standards. On international protocols, Alipay+ AMP, Mastercard Verifiable Intent and the Visa trusted agent protocol form a KYA interoperability framework supporting agent identity verification and trust collaboration in cross-border commercial scenarios.

Ant Group is extending its long-accumulated identity, security, risk control and payment capabilities into the agent sector. Alipay addressed how trust is established between people and merchants; APASS explores how trust is established between people and agents, between agents and merchants, and between agents themselves.