Gartner’s analysts don’t commonly write thrillers, but their top strategic prediction for 2026 drops a bomb: by 2028, 90 percent of B2B buying will be intermediated by AI agents. Those agents will be pushing more than 15 trillion dollars of spend through agent exchanges. Gartner unveiled the number at the IT Symposium last October, and it has been echoing through every commerce deck since. Fifteen trillion dollars is not a vertical. It is roughly half of US GDP rerouted through software negotiating with software.
And it’s already started. Sandy Carter, the AI executive and Forbes contributor who has been documenting this shift closely, recently sat down with builders from three of the companies constructing it: David Minarsch of Olas, Nitya Subramanian of Para, and Will Papper of Cloudflare. Minarsch’s definition of agentic commerce is the clean: “If one software program purchases a service from another software program.” Simple, and no longer hypothetical. Carter reports that Olas has recorded more than 14 million agent-to-agent interactions, Para’s wallets serve more than 15 million end users, and more than 30 companies have joined Mastercard’s Agent Pay.
Carter frames the buildout in four layers, as four races. Payments, where Visa, Mastercard, and Stripe are competing to move the money. Authorization, where Para is building what amounts to a corporate card with rules attached: a wallet that holds funds and a permission structure that governs what an agent may do with them. Agent-to-agent interaction, where Olas runs the exchange. And fulfillment, where Cloudflare is making the point that purchasing is only half a transaction; something still has to arrive.
Money moves on the rails. Permission is granted. Agents talk. Goods arrive. It is a complete picture of a transaction, and an incomplete picture of commerce.
The question the four layers do not answer
Before any of this scales inside a large enterprise, a fifth question must be asked, and by people with audit authority: what did the agent know when it bought, and can we prove it?
Stay with the corporate card metaphor, because it is a good one, and extend it one step. A corporate card with rules attached still comes with a monthly statement. The statement is not a courtesy. It’s the control mechanism. It’s how the CFO reconciles, how the auditor samples, how disputes get resolved, how fraud gets found. Nobody hands out cards without statements, no matter how good the rules are.
Now run that at AI speed. When agents transact thousands of times a day, the monthly statement becomes something else entirely: a continuous audit trail of every request, every decision, and the context behind each one. Which sources did the agent consult? Which policy did it apply? What did it know, and when? Whether the answer it acted on was fresh or stale, grounded or improvised? When two software programs disagree about a purchase, and they will, dispute resolution is a replay of what each side knew at the moment of the transaction. Whoever holds that record holds the leverage.
The quiet race
Payments and fulfillment are the visible races because money and logistics always are. The quiet race is who holds the memory and record of all that agent-to-agent traffic.
There are three candidate answers. The payment rails would love to hold it; transaction data has always been their second business. The platforms and model providers would love to hold it; context is what makes their agents smarter. Or the enterprise holds it, inside its own perimeter, as infrastructure it owns.
My bet is on the third, and it’s not because I’m sentimental. Your agents’ purchase history is your demand curve. Their search history is your strategy. The context they carried into each negotiation is your cost structure and your risk appetite, logged. An enterprise that lets that exhaust accumulate on someone else’s rails is publishing its playbook one transaction at a time. It’s likely training a counterparty’s model on it. I would not want anyone else training on my customer data, my purchase data, or my search data. Neither will your CFO, your CISO, or your regulator.
Regulated industries will get there first, because they already live this way. Banks run on the discipline that any model touching money must be inventoried, validated, and explainable to an examiner. Health systems run on the discipline that any system touching patient data must be logged and attestable. Those institutions will not accept “the agent decided” as an answer to an examiner’s question, which means the memory layer is not optional for them. It is the precondition for participating in agentic commerce at all.
Know your traffic across AI Surfaces
Here is the uncomfortable baseline: only 18 percent of enterprises can name every AI surface operating in their environment today… before agentic commerce multiplies the surface count. The estate is already a sprawl of apps, agents, tools, and MCP servers, each making calls, each carrying context, almost none of it recorded anywhere the enterprise controls.
This is the layer we build at Excipio: a private memory layer that audits and controls the traffic between AI surfaces, inside the enterprise perimeter, on the enterprise’s infrastructure. Not a payment rail, not an exchange. The statement that comes with the card.
The four races will produce their winners, and there will be more than one. The fifth layer is different. It should not have an external winner at all, because the record of what your agents knew, asked, and decided belongs to exactly one party.
If you are building in AI, you should be able to audit and control the traffic between your surfaces. When 90 percent of B2B buying runs machine to machine, that stops being an architecture preference. It becomes the price of admission.
Know your traffic.
--
-
References
Gartner, “Top Strategic Predictions for 2026 and Beyond,” Gartner IT Symposium/Xpo, October 2025: https://www.gartner.com/en/newsroom/press-releases/2025-10-21-gartner-unveils-top-predictions-for-it-organizations-and-users-in-2026-and-beyond
Sandy Carter, LinkedIn, September 2026, on her conversation with David Minarsch (Olas), Nitya Subramanian (Para), and Will Papper (Cloudflare): [PASTE POST URL]
Sandy Carter’s companion Forbes article, linked in the first comment of her post: [PASTE FORBES URL]
Suggested Substack tags (tag field, not body): agentic commerce, AI governance, enterprise AI, token economy, audit