Sardine has introduced Know Your Human (KYH), a protocol designed to make human identifiers available to merchants and issuers when a purchase is placed by an AI shopping agent. The identifiers covered include device ID, device fingerprint, IP address, email, and phone number, with KYC and identity verification details included in extended use cases. According to the company, the protocol can be implemented by either agent developers or merchants and is complementary to existing agentic commerce protocols.
Why are shopping agents being declined
The launch addresses a conversion problem specific to agentic commerce. Sardine notes that most agent-led shopping takes place inside cloud browsers. When these sessions reach a merchant’s checkout, they originate from data centre IP addresses, carry user agent strings associated with automation, and behave in ways that fraud systems read as bot activity. Orders placed by legitimate customers through their agents are therefore flagged as high risk and declined.
The company expects the issue to grow as consumer agents gain adoption, pointing to personal shopping apps such as Muse, which already has tens of thousands of app store reviews. For merchants, the risk is revenue lost to false positives when fraud systems cannot distinguish between malicious bots and agents acting for real customers.
How the protocol works
On the agent side, KYH passes the human’s device identifier and IP address to the merchant through a small number of additional HTTP headers. Agents can bind device data to a session in one of two ways. At the same time, they can embed Sardine’s SDK in their own app, which captures the device fingerprint and ties it to a session key, or they can request a Method URL from a merchant that supports the protocol and load it in the background on the customer’s device. At checkout, the merchant uses Sardine to retrieve the associated device and IP signals and verify the human behind the order. Sardine has implemented KYH in its own Personal Agent.
On the merchant side, the protocol supports step-up verification for agentic transactions. When Sardine’s Device Intelligence solution detects that a checkout was completed via an agent such as Muse, Dot or Instinct, the merchant can send the customer an SMS containing a verification link. Opening the link allows Sardine to fingerprint the customer’s browser and connect it to the cloud browser fingerprint used by the agent. Each link can be opened up to three times and expires five minutes after creation, with a new link available for the same session if required.
Implications for disputes and agentic banking
Beyond approval rates, Sardine positions KYH as a means of supporting chargeback responses. Shopping agents typically mask the device and IP signals that merchants rely on as dispute evidence. The company links the protocol to card scheme rules, including the Visa Acquirer Monitoring Program (VAMP), under which fraud reports and disputes both count towards a merchant’s ratio. A chargeback claiming that an agent acted without authorisation can therefore penalise a merchant twice.
Sardine also cites Visa Compelling Evidence 3.0, which allows merchants to win a cardholder dispute if the same device ID, fingerprint, or IP address was used in two previous transactions within 120 to 365 days. Mastercard’s First Party Trust programme similarly requires device and IP data to shift liability away from merchants in first-party fraud disputes.
The company adds that the protocol could be extended to pass KYC and identity verification details to banks and fintechs, supporting agentic banking use cases. Sardine is currently seeking design partners among agent developers and merchants to develop KYH further.
