Authentication is not authorization.
3-D Secure was built to answer one question: is the cardholder really there. It answers with a challenge. It was never built to decide whether the transaction should happen. In agentic commerce there is no cardholder to challenge. The buyer is an agent acting under a mandate, and proving a human is present says nothing about whether that agent was authorized to make this purchase.
Two different questions, answered in two different ways.
3-D Secure and FederatedIQ are not competitors for the same job. One authenticates a person. The other authorizes the transaction. Confusing them is why checkout still leans on a challenge that agents cannot answer.
Is it really you?
- ·Proves a cardholder is present at checkout.
- ·Adds friction to the buyer. A challenge is a tax on good customers.
- ·Has no cardholder to challenge when the buyer is an agent.
- ·Says nothing about whether the action fits the buyer's mandate or live state.
Should this transaction proceed?
- ·Decides the action against the actor's standing, live state, and the mandate.
- ·Returns allow, deny, or escalate with a signed record anyone can verify.
- ·Governs an agent as naturally as a person. The mandate is the unit, not the challenge.
- ·No step-up on the happy path. A person is asked only when confidence is genuinely low.
Agents buy now. The challenge is the wrong instrument.
A one-time code sent to a phone assumes a human is standing at the checkout. Agentic commerce breaks that assumption. The buyer is software acting for a person, under a granted mandate, at machine speed and machine volume.
The question moves with it. Not is it really you, but should this transaction exist: is this the right entity, is the actor in standing, does it fit the mandate and the running total, is it still valid against live state. None of those are questions a challenge can answer.
So the decision moves to before the action, and onto the agent and its mandate. That is authorization, and it is what a challenge was never built to do.
Deep where you control it. Broad through the credential.
The decision can run at the merchant, at the bank, or ride inside the payment credential. Depth follows who participates, and the credential is what carries agent-level judgment to every merchant at once.
3-D Secure keeps a role as the bridge where a merchant cannot integrate: it carries richer context to the issuer on rails already in place. It is a bridge, not the destination. A challenge cannot govern an agent, and enrichment cannot add judgment the message was never designed to hold.
Every network will ship an agent credential. The question is who governs the transaction.
Agentic-commerce tokens are the rails arriving to carry an agent and its mandate. That is category validation, not competition. A credential can carry the claim. Deciding whether the transaction should proceed, across every merchant and every authority, is a different layer. That layer is authorization, and it is the one FederatedIQ owns.