The Agent Economy: Identity, Delegation, and Machine Payments

An agent that can act is one decision away from an agent that can spend, and the moment it spends, it collides with infrastructure that was never built for it. The web identifies browsers with cookies and applications with OAuth, but has no way to name this agent, acting for this person, under these limits. Card payments assume a human at checkout; two decades of fraud engineering equate "automated" with "attacker." So through 2025 and 2026, a wave of protocols set out to build the three rails machine commerce is missing: identity, delegation, and payment. This chapter traces why the old rails break, why the last attempt at machine-granularity payments died thirty years ago and what has changed since, how the new protocols divide the problem, and how much of the agent economy is real as of this writing. By the end, a reader can place any "agentic commerce" announcement on the map, and say which of the three rails it actually supplies.

Three rails the web never built

The clearest statement of the problem comes from the incumbents themselves. When Visa introduced its agent protocol, it described merchants "managing bot detection systems that can mistakenly block legitimate agentic transactions" while AI-driven traffic to US retail sites grew more than 4,700% in a year (Visa 2025). The defensive stack that runs the commercial web, bot detection, CAPTCHAs, device fingerprinting, velocity rules, exists to keep robots out, because until now a robot at checkout was a stolen card. An agent shopping on a user's instruction is indistinguishable from that attacker at the level the defenses operate on. The first missing rail is therefore identity, and it inverts the usual challenge: not proving you are human, but proving you are a known robot, acting for a real principal.

The second missing rail is delegation, and Google's payments-protocol launch named its three requirements precisely: authorization, did the user actually grant this agent this authority; authenticity, does the request reflect what the user meant; and accountability, who answers when it goes wrong (Parikh and Surapaneni 2025). OAuth, the web's delegation machinery, identifies a client application, not a specific agent bound to a specific user's specific errand; the extensions that would record a user-to-agent delegation chain existed in mid-2026 only as expired individual drafts, with no standards-track RFC (Senarath and Dissanayaka 2025). The third rail is payment itself: interchange fees and dispute machinery are priced for human-sized purchases at human frequency, which forecloses the sub-cent, thousands-per-second transactions that machine-to-machine services imply.

Why micropayments died the first time

Machine payments have a prehistory, and it is instructive because it failed for a reason that has only now changed. HTTP has carried a placeholder for payments since the 1990s: status code 402, whose entire specification reads "The 402 (Payment Required) status code is reserved for future use" (Fielding et al. 2022). The systems meant to fill it are a graveyard. DEC's Millicent designed scrip for transactions down to a tenth of a cent (Glassman et al. 1995); Chaum's DigiCash pioneered anonymous digital cash and was bankrupt by 1998; the W3C's micropayment working group closed in 2001 with nothing standardized.

The explanation that held up came from Szabo: the binding cost of a tiny purchase is not the fee but the decision, the cognitive work of asking "is this worth two cents?", and mental transaction costs "usually exceed, and often even dwarf" the computational ones (Szabo 1999). No fee reduction fixes that, which is why per-article news payments never arrived. What agents change is often summarized as removing that cost, but Szabo's own essay anticipated purchasing agents and raised two objections to them: a consumer cannot easily tell whether a remotely programmed agent serves the consumer's interests, and translating one's preferences into the agent is itself a cognitive bottleneck. The correct claim is that delegation amortizes the mental transaction: one deliberate act, writing the mandate and setting the budget, now covers thousands of machine purchases. The runnable below prices exactly that shift. Szabo's two objections did not go away; they became the alignment and specification problems the rest of this chapter's protocols exist to manage.

c_mental, c_mandate, c_agent_call = 0.05, 0.50, 0.0002   # $ per decision, per mandate, per call
n = 1000                                                  # purchases covered by one mandate
for price in [0.001, 0.01, 0.10, 1.00]:
    human = n * (price + c_mental)
    agent = c_mandate + n * (price + c_agent_call)
    tag = "human irrational, agent fine" if c_mental > price else "both work"
    print(f"item ${price:5.3f}: human pays ${human:7.2f}, agent pays ${agent:7.2f}  <- {tag}")
print("one mental transaction (the mandate) amortized over n purchases:")
print("the 1990s failure was never the fee; it was the decision per purchase")

The protocol wave

Between May 2025 and early 2026 the missing rails acquired competing implementations, and they divide cleanly by which rail they supply and whose rails they settle on.

The payment-native revival came first. Coinbase's x402 resurrected status 402 as a wire protocol: a server answers an unpaid request with 402 plus its price, the client retries with a signed stablecoin payment in a header, and a facilitator verifies and settles on-chain, making pay-per-request a property of HTTP itself (Coinbase 2025). Cloudflare co-founded a foundation to steward the spec and shipped the first at-scale deployment in the same season: pay-per-crawl, where a publisher prices each AI crawler's fetch and the crawler negotiates through exactly the 402 dance, the crawl-economics story of Chapter 79 acquiring a payment rail (Cloudflare 2025). The protocol's own count claims over one hundred million payments in its first six months, a self-reported figure of mostly tiny API transactions, but a proof that machine-granularity settlement clears at all. The rail's legal ground firmed in parallel: the GENIUS Act of July 2025 gave US payment stablecoins a federal issuer-and-reserves regime two months after x402 launched (119th United States Congress 2025).

The card networks answered with delegation evidence rather than a new rail. Google's Agent Payments Protocol, announced with more than sixty payment and technology partners, has the user sign an intent mandate, price ceilings, conditions, whether the human is present, and later a cart mandate fixing exact items and price, cryptographically chained artifacts, expressed as W3C verifiable credentials (W3C 2025), that answer authorization, authenticity, and accountability in a form a dispute process can replay (Parikh and Surapaneni 2025). OpenAI and Stripe shipped the consumer-facing version: the Agentic Commerce Protocol behind Instant Checkout in ChatGPT, where a scoped payment token is minted for one merchant and one cart total, so the assistant never holds raw card credentials, with Etsy and Shopify's merchants first and Walmart joining within weeks (Stripe 2025). Visa's Trusted Agent Protocol supplies the identity floor beneath both, built on Cloudflare's Web Bot Auth: agents sign requests with published keys under RFC 9421 HTTP message signatures, so a merchant's defenses can recognize a legitimate agent instead of fingerprinting for humanity (Visa 2025; Cloudflare 2025). Mastercard extended its tokenization stack the same way, and by mid-2026 was marketing a separate low-value, high-frequency variant for machine-to-machine payments. Google's Universal Commerce Protocol, co-developed with Shopify, Walmart, and others in January 2026, added the remaining layer, discovery and checkout capability negotiation, completing a stack in which no single company owns more than a slice.

Delegation is not transitive

The identity rail has a legal edge that one 2026 case drew sharply. Amazon sued Perplexity over its shopping agent logging into customers' Prime accounts and buying on their behalf without identifying itself as an agent; the court's preliminary injunction turned on a distinction every builder in this space now quotes: the agent acted "with the Amazon user's permission, but without authorization by Amazon" (CNBC 2026). The user's consent, that is, does not flow through the agent onto the platform. Delegation is a three-party relationship, and the third party can refuse. The signed-agent machinery above is the constructive answer, an agent that announces itself and lets the platform apply policy, but the case also exposed the concentration question underneath: if platforms may refuse unidentified agents, and checkout migrates inside the assistants themselves, then whoever runs the assistant intermediates commerce, which is why merchants hedged by joining every protocol camp at once.

The other hard edge is the one this book keeps meeting: the agent itself can be turned. Security researchers demonstrated agentic browsers completing purchases on fake storefronts and following instructions hidden in counterfeit CAPTCHAs, entering stored payment details on sites no human had vetted (The Hacker News 2025). Prompt injection with a wallet attached is the scam economy's new surface, and it explains a design constant across every serious protocol: none of them trusts the model. Authority is bounded by signed mandates, tokens are scoped to one merchant and one amount, and the evidence chain exists so that a hijacked agent's spending can be contested. The runtime defenses belong to Chapter 57; here, the point is that the payment layer was designed on the assumption those defenses leak.

Who pays when it still goes wrong is unsettled law. The dispute machinery of card networks leans on evidence, device fingerprints, click paths, that agent traffic renders meaningless, which is what mandates are for: a replayable, signed record of what the user authorized. The EU withdrew its bespoke AI liability directive in 2025, leaving agent purchases to ordinary contract, agency, and consumer law, and legal scholarship is only beginning to map how poorly computer science's notion of an agent matches the loyalty and third-party obligations that agency law assumes (Riedl and Desai 2025).

How big is it, really

Separating the economy from the announcement requires holding three numbers at once. AI-assisted shopping with a human present is measurably large: platform data credited AI influence in over a fifth of global holiday retail sales in 2025 (Salesforce 2025). Autonomously executed agent payments are measurably tiny: Visa's own year-end count of completed agent-initiated transactions through its pilot was "hundreds" (Visa 2025), against consultant projections of a trillion dollars of US agentic commerce by 2030 (McKinsey & Company 2025). And machine-to-machine micropayments sit in between, x402's hundred-million self-reported settlements representing real volume of nearly worthless individual transactions. The distribution matters more than any single figure: influence is mainstream, delegation is pilot-stage, and the projections assume the second catches up with the first.

One experiment suggests what changes when it does. Anthropic ran an internal marketplace where employees' agents negotiated real purchases from one another: 186 deals closed, and agents running the stronger model measurably outperformed those running the weaker one, buying cheaper and selling dearer on identical items, while participants rated their deals equally fair (Anthropic 2026). Negotiating power that tracks compute budget, invisibly to the humans on both sides, is a market-structure question this book's Chapter 77 vocabulary was built for, arriving at the scale of a grocery run.

Further reading