Akamai launches agentic security framework with Visa

Akamai has launched an agentic security framework for its Bot & Agent Control products, with partners including Visa, Skyfire and Experian.

The system is designed to manage AI agents acting on behalf of users in online transactions and digital interactions. It combines identity checks, trust assessment, traffic monitoring and edge enforcement in a single decision layer.

The launch comes as companies face new questions over how to identify AI agents, verify that they are authorised by a human user and decide whether to allow their requests. Akamai is positioning the framework as a way to distinguish legitimate agent traffic from harmful bot activity and conventional human users.

At the centre of the announcement is a six-part structure covering verified identity and human attribution, user-centric authentication, adaptive trust analysis, edge-based enforcement, content monetisation and value exchange, and operational visibility and traffic analysis.

Identity layer

Akamai is working with Visa on what it described as a trusted foundation for authenticated AI agents in payment settings. The arrangement includes integration work around Visa's Trusted Agent Protocol, intended to define how agents are authenticated, authorised and assessed during transactions.

It is also working with Skyfire and Experian on a "Know Your Agent" framework, meant to give AI agents a standard way to declare identity, origin and intent while linking them to the platforms they operate on and the users they represent.

The approach aims to address a practical issue for merchants and online services: whether an automated request comes from a legitimate agent acting for a specific person and has permission to carry out an action. In commerce, that could include searching, booking or completing a purchase.

"Without trusted identity and explicit permissioning, AI agents cannot participate in commerce at scale," said Rubail Birwadker, SVP, Head of Growth Products and Partnerships, Visa.

"Visa's Trusted Agent Protocol provides the identity layer that defines how agents are authenticated, authorised, and trusted at the transaction level so businesses and consumers can transact with confidence."

Experian framed the issue in similar terms, focusing on transparency and accountability in AI-led transactions.

"AI agents are quickly becoming part of digital commerce, but trust will determine how far and how fast adoption grows," said Kathleen Peters, Chief Innovation Officer at Experian. "With the Experian Agent Trust framework, we are helping businesses bring more transparency and accountability to AI-driven interactions by verifying identities, assessing risk, and strengthening confidence in every transaction. Our collaboration with Akamai and other ecosystem leaders reflects the industry's shared commitment to building a secure foundation for agentic commerce that consumers and businesses can trust in real time."

Skyfire said the challenge is not only proving identity but also enabling AI agents to complete transactions within policy rules.

"AI agents can't participate in the economy without trusted identity and the ability to transact," said Amir Sarhangi, Co-Founder and CEO of Skyfire. "Skyfire provides that foundation - enabling agents to authenticate, operate within policy, and access global payment rails. With Akamai, we're bringing that trust layer to the edge, so enterprises can securely enable trusted agents without re-architecting their existing systems."

Authentication and trust

Another part of the framework focuses on the handover between a person and an AI agent. It integrates with identity providers including Auth0 and Ping Identity, allowing businesses to apply existing policies such as behavioural analysis and multi-factor authentication to agent-driven activity.

The goal is to let organisations treat actions taken by an agent as an extension of an authenticated user session, while still checking whether those actions remain consistent with the user's identity and intent.

"AI agents introduce a new trust challenge because session-based trust alone is no longer sufficient. Organisations need to understand who they represent, what agents are allowed to do, and how their actions are governed in real time," said Loren Russon, SVP Product Management, Ping Identity. "By combining Ping's runtime identity capabilities with Akamai's edge enforcement and visibility, enterprises can extend identity and access controls to AI-driven interactions with stronger accountability and oversight."

Akamai said its adaptive trust analysis moves away from a simple allow-or-block model. Instead, it assesses interactions across a range of trust signals to judge whether a request supports business activity or creates fraud, abuse or operational risk.

Edge controls

Those decisions are enforced through Akamai's distributed edge network, where requests can be assessed close to the user or service endpoint. This is intended to help organisations review the intent and risk of automated requests without adding unnecessary delay.

The framework also reflects the growing debate over how websites and publishers should respond when AI systems consume online content at scale. Partnerships with TollBit and Skyfire are intended to give content owners a way to negotiate access terms and support tokenised pay-per-request models.

That could give publishers a way to charge for machine access to content, rather than allowing unrestricted scraping or blocking agents outright.

"AI agents are the new visitors and shoppers of the internet, and websites need a way to transact with them," said Toshit Panigrahi, Co-Founder and CEO of TollBit. "By using Akamai's ability to identify agentic traffic at the edge and redirect it to TollBit's Agent Site, businesses can send agents to a dedicated, agent-optimised destination where they enforce their own access rules and turn it into a new revenue stream, making AI traffic a source of value rather than a cost."

Traffic visibility

Operational visibility is the final element in the framework. Akamai said its analytics tools, including TrafficPeak, give organisations a single view of web traffic so they can separate human visitors, beneficial AI agents and malicious bots over time.

The data is intended to help security and commercial teams refine both access policies and business models as agent-driven traffic grows.

Patrick Sullivan, VP, CTO of Security Strategy at Akamai, said the company sees the issue as tying identity, visibility and trust together in a single control system.

"AI agents are replacing clicks, acting and handling commerce for us. For that to work, businesses need to recognise not just the agent, but who is behind it and what it's trying to do," said Sullivan. "We've built this so that identity informs visibility, visibility drives trust, and trust powers the decisions that let companies safely grow and monetise these new AI interactions. We're giving businesses the confidence to open their doors to AI without compromising security."