Agentic Commerce -- Treeship

How Treeship applies to agent-driven commerce, payments, and transaction verification.

Treeship's artifact system applies naturally to commerce workflows where AI agents execute transactions, manage procurement, or handle payments. The core mechanism is the approval receipt with nonce binding -- a signed proof that a specific human authorized a specific action before it happened.

What ships today

Receipts for Anthropic's commerce reference. treeship-commerce wraps the one executor every tool call passes through in anthropics/commerce-agents, on the Messages API, the Agent SDK, and Managed Agents: a signed intent receipt before each tool runs, a signed result receipt after, a held call signed as blocked with its gate. Guide: Claude Commerce Agents.
Approvals with nonce binding and single use, enforced by the Approval Use Journal, for any agent that asks a human before it acts. Below, and in Payment Proofs.
Handoffs with graded custody. Since 0.27 a handoff records whether the receiving agent verified the sender live; verify prints custody: live only when the signed evidence supports it.

The problem

When an AI agent makes a purchase or executes a payment, how do you prove after the fact that a human actually approved it? Emails and Slack messages are not cryptographically verifiable. Treeship's approval artifacts are.

How it works

Every step of a commerce workflow produces a signed, chained artifact:

# Agent receives a purchase request
treeship attest action \
  --actor agent://procurement \
  --action order.received \
  --subject '{"order_id": "ord_123", "total": 5000}'

# Human approves the purchase
treeship attest approval \
  --approver human://alice \
  --allowed-action procurement.approve \
  --allowed-actor agent://procurement \
  --expires 2026-08-19T12:00:00Z

# Agent executes the purchase with the approval nonce
treeship attest action \
  --actor agent://procurement \
  --action payment.execute \
  --approval-nonce <nonce> \
  --parent art_order123

# Record the handoff to fulfillment
treeship attest handoff \
  --from agent://procurement \
  --to agent://fulfillment \
  --artifacts art_payment456

Each step is signed, chained, and independently verifiable.

What this gives you

Audit trail. Every transaction step has a tamper-evident receipt.
Approval binding + scope. The payment cannot execute without a valid approval nonce, and the approval's signed scope (allowed_actor, allowed_action, allowed_subject) is checked statelessly against the action -- a stripe.charge.create approval cannot authorize a stripe.refund.create. Nonce replay is observed within a verified package, and replay is enforced beyond the package by the Approval Use Journal (shipped, stable): treeship attest action consumes a grant use before signing, and treeship approval uses inspects the ledger. Distributed multi-hub replay coordination remains in progress.
Chain verification. Anyone can walk the chain from fulfillment back to the original order.
Offline verification. No API call needed to verify the receipts.

Commerce patterns

Budget enforcement

Create an approval with a scope that limits what the agent can do:

treeship attest approval \
  --approver human://alice \
  --allowed-action procurement.approve \
  --allowed-actor agent://procurement \
  --allowed-subject order://ord_123 \
  --max-uses 1 \
  --expires 2026-08-19T12:00:00Z

--expires on attest approval takes an RFC 3339 timestamp, not a duration. A value like 1h is accepted at the command line but stored verbatim and compared as a string, so the grant reads as already expired and the next attest action fails with approval grant … expired at 1h. (The duration form 30s / 5m / 7d is correct for treeship session invite, which is a different flag on a different command.)

The approval's --max-uses is signed into the grant and the scope (allowed_action, allowed_subject) constrains what the agent can do with the nonce. Replay is observed within a verified package, and replay is enforced beyond the package by the Approval Use Journal (shipped, stable): treeship attest action consumes a grant use before signing, and treeship approval uses inspects the ledger. Distributed multi-hub replay coordination remains in progress.

Multi-party transactions

Use handoff artifacts to track work across organizations:

# Buyer's Treeship
treeship attest action --actor agent://buyer --action order.place

# Seller's Treeship (separate trust domain)
treeship attest action --actor agent://seller --action order.fulfill

# Both push to Hub for cross-organization visibility
treeship hub push art_buyer_order
treeship hub push art_seller_fulfill

Endorsements

Use endorsement artifacts for third-party compliance assertions about transactions:

treeship attest endorsement \
  --endorser auditor://compliance-firm \
  --subject art_transaction123 \
  --kind compliance \
  --rationale "SOX compliant"

Claude Commerce Agents -- receipts for every tool call in Anthropic's reference, on all three runtimes
Payment Proofs -- step-by-step payment verification flow
Compliance -- audit trails, export bundles, and regulatory patterns

ZK proof integration (planned for v2) will add privacy-preserving commerce capabilities. Agents will be able to prove budget compliance and vendor authorization without revealing transaction details.

Agentic Commerce

On this page