The Agent Economy: When AIs Pay Each Other

In my previous article on tokenomics, I sketched a future where autonomous agents would pay other agents for services themselves. That future is already here. On July 14, 2026, the Linux Foundation confirmed the operational launch of the x402 Foundation, the standards body for agent-native payments. Founding members include Visa, Mastercard, Ripple, American Express, Stripe, Adyen, Shopify, Google, Amazon Web Services and Cloudflare. When card networks and hyperscalers join the same standard in the same week, this is no longer an experiment: it’s an infrastructure layer settling into place.

This article is for those who will have to design, secure and supervise these systems. We’ll unpack the architecture of agent-to-agent payment: the protocol stack, the concrete settlement mechanism, the question of trust without intermediaries, the security flaws specific to this paradigm, and finally what all of it demands on the governance side.

Why “human” payment doesn’t scale to agents

Our payment systems were built for humans: an account, a card, strong authentication, an explicit approval per transaction. That model breaks down the moment it meets the characteristics of an autonomous agent.

First, volume and granularity. An agent that chains dozens of API calls per task cannot trigger a human approval each time, nor pay $0.30 with the fixed fees of a card transaction. It needs micropayments (sometimes below a cent) settled instantly. Then there’s the absence of a pre-existing relationship: an agent discovers a third-party service on the fly and must be able to pay for it without opening an account, signing a contract or entering a card number. Finally, autonomy: the agent decides how many steps to take, and therefore how much to spend, in timeframes measured in milliseconds.

What was needed, then, was a machine-native payment mechanism: no account, no card, no human in the loop for every transaction, able to settle tiny amounts in real time. That is precisely the problem the new generation of protocols solves.

The agentic web stack

For an architect, the first key insight is that payment isn’t an isolated protocol: it’s a layer that fits into a stack now becoming standardized.

At the very bottom, the Model Context Protocol (MCP) governs how an agent uses tools, calls APIs and reads data. Above it, the Agent2Agent (A2A) protocol defines how two agents discover each other, talk and delegate tasks, via “AgentCards” that advertise their capabilities. Then comes the payment layer, the one we care about here: how an agent actually settles for a service. And at the top, an identity and trust layer answers the question that conditions everything else: who are we dealing with, and can we trust them?

This layered reading is essential: MCP is how the agent acts, A2A how it talks, payment how it settles, and identity who to trust. The protocols we detail next each fit within this frame; and, notably, they were designed to be composable rather than competing.

x402: paying for an HTTP request

The most elegant mechanism revives an old, forgotten web code: the HTTP 402 “Payment Required” status, reserved but unused for thirty years. It’s the heart of x402, the protocol initiated by Coinbase and now entrusted to the Linux Foundation.

The principle is devastatingly simple. A client agent requests a resource from a server agent. Rather than a refusal, the server responds 402 Payment Required, specifying the amount, settlement address, network and currency. The client then pays the sum, typically in stablecoin (USDC, or XRP/RLUSD since Ripple joined) on a fast, low-cost blockchain such as Base or Solana, then replays its request with proof of payment. The server delivers the resource. The entire payment relationship opens and settles in a single transaction, for a few cents, with no account, no card and no human approval.

The numbers show the mechanism is already leaving the lab. In its first year, Coinbase claims more than 169 million payments across 590,000 buyers and 100,000 sellers. Over the last thirty days, roughly 75 million transactions accounted for just $24 million, about thirty cents on average per transaction. That ratio says it all: we’re in a world of machine-to-machine micropayments, not big-ticket purchases. Stripe added x402 support in February 2026, and both Cloudflare and AWS embedded it at their edge networks. An agent can now pay for an API per request, just as it would consume any other resource.

AP2 and ACP: proving intent, framing commerce

x402 solves the “how to pay” between machines. Two questions remain that it doesn’t handle alone: how to prove that a human actually authorized a spend, and how to integrate agents cleanly into existing commerce. That’s where AP2 and ACP come in.

AP2 (Agent Payments Protocol), announced by Google in September 2025 with 60+ partners (Mastercard, PayPal, Coinbase, American Express, Salesforce…), addresses authorization. Its central idea: the mandate chain.

Each purchase is represented by three signed “mandates,” carried as W3C Verifiable Credentials, tamper-proof cryptographic objects. The Intent Mandate captures what the user wants: goal, constraints, spending cap. The Cart Mandate describes what the agent actually assembled: exact cart, price, seller. The Payment Mandate specifies what will be charged and how. Depending on whether the human is present (approving the cart in real time) or absent (the Intent Mandate pre-authorizing the agent within a given scope), the chain adapts, but it always produces an end-to-end cryptographic audit trail: who authorized what, at what price, when, in a verifiable and tamper-proof way. Where a card merely settles a payment, the mandate proves why that payment was authorized. Version 0.2 of the protocol, published in April 2026, was handed to the FIDO Alliance for governance.

ACP (Agentic Commerce Protocol), co-developed by OpenAI and Stripe and live since September 2025 with ChatGPT’s Instant Checkout, takes a different angle: retail commerce. It creates a shared language between merchants and agents, letting a merchant sell through an agent while keeping control over catalog, brand and fulfillment. A merchant already using Stripe can enable it in a single line of code. In 2026, OpenAI narrowed its scope toward a pool of large, integrated retailers rather than millions of merchants, a sign that operational maturity is still being built.

The good news for the architect: these protocols are converging. The A2A x402 extension directly links agent-to-agent communication to stablecoin settlement, and AP2 treats crypto rails as first-class citizens alongside cards and bank transfers. You don’t pick one protocol; you assemble a stack.

Trust without intermediaries: ERC-8004

The trickiest layer remains. In the human world, trust rests on intermediaries: banks, card networks, platforms. Between anonymous agents discovering each other on the fly, what do you anchor it to?

An answer is emerging on the blockchain side with ERC-8004, dubbed “Trustless Agents” and conceived as an on-chain extension of the A2A protocol. Proposed in August 2025 and co-authored by contributors from Google, Coinbase, MetaMask and the Ethereum Foundation, it defines three registries. The identity registry assigns each agent a verifiable, portable identity. The reputation registry standardizes the publishing and reading of trust signals, the equivalent of a reliability track record. The validation registry lets validators publish attestations about an agent’s work.

The stakes are high: without portable identity and reputation, there’s no way to tell whether the third-party agent yours is about to pay is trustworthy, or whether it will actually deliver the advertised service. But caution: on-chain reputation registries are still young, and a verifiable identity does not guarantee honest behavior. Above all it makes behavior traceable, which is not the same thing.

The flaw cryptography can’t see

This is where the architect must be most vigilant. You might think a cryptographically signed transaction is a safe transaction. It isn’t, and a red-teaming study of AP2, “Whispers of Wealth”, demonstrated it spectacularly.

The reasoning goes like this. An agent builds its decision from inputs: instructions, data, web pages, messages from other agents. A prompt injection (a malicious instruction hidden in one of those inputs) can corrupt that reasoning before the mandate is signed. The result: a mandate that is perfectly valid cryptographically, but corresponds to no legitimate intent. The study distinguishes two crucial notions. Execution integrity (valid signatures, protocol-compliant transaction) stays intact: nothing wrong on-chain. But decision integrity is compromised: the agent paid the wrong seller, or the wrong amount.

The results are stark: an indirect prompt injection achieved a 100% success rate in manipulating the ranking of products shown to the agent, and a direct injection caused cross-account data exposure in 20% of cases. AP2 provides real guarantees (authorization via signed mandate, authenticity of approved details, traceability of every step), but they protect execution, not decision.

The design implication is direct: the signature is not the end of security, it’s the middle. It remains essential to cap spending and install circuit breakers, to require human approval above a certain amount or risk threshold, to factor in seller reputation, and above all to observe and audit everything in real time.

Governance: the real differentiator

This is why I’m convinced the battle for the agent economy won’t be won on payment protocols (which are standardizing and will become commodities), but on the ability to govern what these agents do once they hold a wallet.

The problem changes nature the moment every agent (the SOC investigation agent, the procurement agent, the data-enrichment agent, third-party sub-agents summoned on demand) can commit money. You need a single control tower that aggregates the whole fleet’s telemetry: tokens and on-chain spend in real time, per-agent budgets and circuit breakers, anomalies and compliance, and above all the correlation between cost incurred and value actually produced.

This is exactly the axis Splunk is working on. Splunk Agent Observability, from the Galileo acquisition, already offers a centralized view of agents (requests, latency, input and output tokens, associated costs) and correlates those costs with response quality. Extending that logic to agents’ financial transactions is the natural next step: one control plane for token spend and stablecoin spend. It’s also the spirit of Argos AI, the Splunk application dedicated to agentic AI that I develop: making agents’ actions legible, budgeted and auditable. The goal is always the same: catch a “runaway agent” on a dashboard before you find it on the invoice.

How big, and how soon

The projections invite us to take the topic seriously without getting carried away. Juniper Research values agentic commerce at $1.5 trillion by 2030; McKinsey speaks of a $3–5 trillion opportunity. Morgan Stanley, more cautious, projects $190–385 billion in the United States, or 10–20% of e-commerce. On the rails side, Bloomberg Intelligence projects stablecoin payment volume of $56 trillion in 2030, versus roughly $33 trillion in 2025.

Those very wide ranges tell us two things. That the trajectory is real and fast; and that no one yet knows where it will settle. For a technical decision-maker, the conclusion is not to bet everything on the agent economy, but to make sure the architecture deployed today can accommodate it tomorrow without being rebuilt.

In practice: five architecture principles

For anyone designing right now, five principles stand out. Think in layers: treat payment as a distinct layer, above A2A and MCP, rather than a feature buried inside the agent. Stay composable: don’t bet on a single protocol, but lean on the converging open standards (x402, AP2, A2A, ERC-8004). Secure the decision, not just the execution: assume every input is hostile, and place controls before the signature. Set hard limits: budgets, caps, circuit breakers and human approval above a threshold, by design. Make everything observable: no agent spend (in tokens or in stablecoins) should escape a single, real-time control plane.

Conclusion

The web was built on open protocols: HTTP to transport, HTTPS to secure. The agent economy is replaying that founding moment, adding a brick the original web left fallow: payment, precisely that 402 code left dormant for thirty years. The protocols embodying it are standardizing before our eyes, carried by an unprecedented coalition of card networks, hyperscalers and crypto players.

But the recent history of AI has taught us one thing: technical capability always precedes the ability to govern it. Agents that pay is fascinating. Agents that pay without anyone knowing how much, to whom, or why, is a first-order financial, security and regulatory risk. The organizations that win this era won’t be the ones whose agents spend the fastest, but the ones that know, at any moment, exactly what each of their agents has paid, and for what value.

Further reading: the x402 Foundation, the AP2 announcement by Google Cloud, the ERC-8004 specification, the “Whispers of Wealth” AP2 red-teaming study, and Splunk Agent Observability.