Visa published a Trust Index for agentic commerce this week, and the finding worth sitting with is a distinction consumers are already making on their own: they don't extend the same trust to an AI agent that they extend to the brand behind the payment rail. Visa reported itself as the most trusted brand to handle agent-initiated transactions — not because it built the flashiest agent, but because it's the thing people already trust to move money, agent or no agent. That's a quieter finding than it sounds, and it cuts against a common assumption in agent-protocol circles: that trust is something you bootstrap fresh for agents, via new credentials, new attestation chains, new cryptographic proofs of agent identity. Visa's data suggests users aren't waiting for that. They're mapping agent trust onto existing brand trust, whether or not the underlying plumbing has caught up. The plumbing hasn't caught up. The practical problem sitting underneath this survey is that card networks currently treat agent-initiated purchases as card-not-present transactions with no liability shift, which pushes decline rates up and dumps chargeback risk on merchants who have no reliable way to tell a delegated agent from a bot running a stolen token. Visa, Mastercard, and others are racing to build the missing layer — agent identity tokens, verifiable credentials, attestations that bind a specific agent to a specific human's authorization at a specific scope — precisely because the liability question doesn't resolve itself just because users trust the brand. This is the identity gap in miniature: users are willing to grant agents money-moving authority faster than the infrastructure is willing to vouch for that authority in a way networks and merchants can act on. The Trust Index measures the demand side. The token specs, DIDs, and attestation formats are the supply side, and they're visibly behind. Until an agent's authorization to spend carries the same portable, verifiable weight as a human's card swipe, every agentic purchase is a small bet that the delegation chain holds — a bet merchants are being asked to underwrite without the tools to check it. The interesting tension for the next year isn't whether agents get identity credentials — that's already underway across Mastercard Agent Pay, Visa's own trusted-agent attestations, and AP2 verifiable credentials. It's whether those credentials arrive fast enough to match the pace at which consumers are already, informally, deciding which brands they'll let an agent spend through.