On October 8, 2026, Riskified (NYSE: RSKD) launched Agent Identity Risk Intelligence — a system that identifies the AI personal assistant behind an order or customer-service request (Meta's Muse, Instinct, dots in ChatGPT), resolves it to the real consumer, and returns a real-time risk signal to the merchant. First platform: Shopify. Delivery: Riskified's existing APIs, the AI Agent Approve MCP server on AWS Marketplace, Decision Studio, and Zendesk. Limited beta December 2026; GA expected 2027.
The release's own framing is the honest one: "Authenticated is not the same as trusted."
The three risk questions
Every agent payment now passes through three separate questions. Riskified names the first two and assigns itself the second:
- Is the agent authorized? — real assistant, real credential. Answered by agent protocols: "The protocol proves the agent is authorized."
- Can the person be trusted? — the account behind the credential, graded on billions of orders, claims and chargebacks. Answered by Riskified: "Riskified proves whether the person who authorized it can be trusted."
- Was this instruction wise? — the specific order or claim, judged before it fires. Nobody in the announcement answers this. That is the confidence gate's job.
The release is unusually candid: "An agent authorized by a stolen account is still an account takeover. An agent authorized by a refund-as-a-service ring, whose members hold real accounts and grant real permissions, is still fraud, now running at machine speed." The Artemis Refund Group — eleven co-conspirators sentenced by a U.S. federal court in April 2026 for running refund fraud as a subscription business against Amazon, Walmart, Target and Wayfair — is the proof. Real accounts, real permissions. The claims were the fraud.
Live test: what identity checks miss
Against the live SML decision gate (bands ≥0.80 auto / 0.50–0.79 confirm / <0.50 escalate), October 11, 2026:
- The ring pattern — a verified-identity assistant files 14 refund claims in one hour, identical empty-box language, auto-approve policy active → 0.25 → advisory / hold for human review
- The loyal shopper — one $32 refund, listed policy quoted, price matching the receipt → 0.25 → advisory / hold for human review
The blunt heuristic treats a refund ring hiding behind a verified identity identically to a loyal shopper's routine return. And note the asymmetry: Riskified's Decision Studio would auto-approve "low-risk agent orders from verified identities" — under that policy both tonight's instructions auto-approve. Identity risk and instruction judgment are two different instruments; merchants need both wired into the same execution path.
Full receipts, the exact curl to score your own agent's instruction, and the dated table: https://scriptmasterlabs.com/riskified-agent-identity-risk-intelligence
Top comments (1)
The third question is the one that actually decides the outcome, and you're right that the announcement skips it. Identity proves who is acting, not whether this specific instruction should fire. The ring test shows the real failure mode: a verified identity just moves the fraud up the stack, and the fraud now lives in the instructions themselves. That's why the decision point has to sit between proposal and execution, not at the entrance gate. The agent proposes, a separate context authorizes, and that context sees the actual instruction, amount and intent before anything executes. Identity signals and instruction judgment are different instruments, and most payment flows only wire in the first. That asymmetry is the gap. Anyone building around x402 or agent approvals should treat the third question as a first-class check, not a follow-up feature.