Agent Payments, x402, and Who Is Liable

When an autonomous agent pays a bill, nobody is clearly liable if it pays the wrong one. That gap, not the payment tech, is the real problem with agent payments. Last month an AI agent bought API credits for me: it found the endpoint, hit a paywall, paid, and moved on. The payment worked. The liability question had no owner.

x402 and the protocols around it solved how an agent hands over money. They did not solve who stands behind that money when it goes wrong. The layer that records the principal, the spending limit, and the proof the payment was authorized is still missing.

I am not writing this as a spectator. I shipped the three pieces that layer needs: on-chain identity at Tokeny, identity-gated transfer with ERC-3643, and account-abstraction rails at Biconomy that moved $441M across 38M+ transactions. This is the case for turning KYC into Know Your Agent, from someone who put KYC on-chain.

What x402 does, and what it leaves open

Let me be precise about what x402 is, because the hype blurs it. x402 is a payment protocol Coinbase introduced in 2025 that revives the old HTTP 402 'Payment Required' status code. A server answers a request with 402 and a price; the client, often an agent, pays in stablecoins and retries. It is a clean way for software to pay software.

That is genuinely useful, and it is not the same as solving liability. x402 standardizes the request and the settlement of a single payment. It does not standardize the identity of the agent paying, the authority it was granted, or the record a regulator would ask for later. A public tracker, x402scan, lists live x402 activity as of mid-2026. The unanswered question is who is accountable for each of those payments.

Know Your Agent is KYC, moved to the agent

Here is the reframe that makes the problem tractable. We already solved a version of this for humans. It is called KYC: before a person can move regulated money, an institution verifies who they are and what they are allowed to do. Agent payments need the same thing, aimed at the agent. Call it Know Your Agent.

The difference is where the identity lives. A human's KYC record sits in a bank's private database. An agent operates across services that do not share a database, so its identity has to be portable and verifiable by anyone, which is exactly what an on-chain identity is. I built that primitive at Tokeny as OnchainID, using ERC-734 and ERC-735, before agents were the reason anyone wanted it.

The three pieces I already shipped

Know Your Agent is not a research project for me. It is three shipped standards and systems, stacked. Each already runs in production for regulated assets. Agent payments just point them at a new payer.

Stack those three and an agent payment stops being a bare transfer. It becomes a transfer from a scoped smart account, by an agent with a named principal, gated on an identity rule. The mechanics of that gate are the ones I detail in ERC-3643: identity-gated transfer, explained.

ERC-8203: the settlement layer I helped prototype

There is still a missing piece, and it is the one I am closest to right now. Identity says who the agent is. Scoped accounts say what it may spend. Neither says: settle this payment only if an off-chain condition is later proven true. That conditional step is where a lot of real agent commerce lives, and it is what ERC-8203 is trying to standardize.

ERC-8203, 'Agent Offchain Conditional Settlement', is an early draft. I need to be exact about my role, because it is easy to overstate. The standard's primary author is Xianrui Qin. I wrote the reference implementation, the working code that shows the interface can be built, submitted as PR #1614. I authored three Ethereum standards, ERC-3643, ERC-6960, and ERC-7410. ERC-8203 is not a fourth. It is a contribution to someone else's proposal.

The reference implementation sketches an interface roughly like this. Treat it as a shape, not the normative text, which is Xianrui Qin's to define.

// ERC-8203 (draft): Agent Offchain Conditional Settlement.
// Primary author: Xianrui Qin. This is the reference-implementation
// shape I submitted as PR #1614, simplified. Illustrative, not the spec.
interface IAgentConditionalSettlement {
    // An agent opens a settlement it will honor IF a condition is later proven.
    function openSettlement(
        bytes32 agentId,        // the agent's on-chain identity
        address principal,      // who is liable if this settles
        bytes32 conditionHash,  // hash of the off-chain condition to satisfy
        uint256 maxAmount       // the ceiling the principal authorized
    ) external returns (bytes32 settlementId);

    // Settlement executes only when the proof matches, and within maxAmount.
    function settle(bytes32 settlementId, bytes calldata proof) external;
}

Two lines carry the liability argument. The principal field records the human or company on the hook if the payment settles. The maxAmount field records the ceiling they authorized. Settlement only fires when a proof satisfies the committed condition, so nothing moves outside the scope the principal set.

A liability model that could actually work

Put the pieces together and you can write down a liability model that a regulator, an engineer, and an insurer could all read. It has three anchors, and the whole thing turns on whether all three are present.

This is the diagram I keep coming back to. Each anchor maps to a standard I have already named. The point is not that it is finished. The point is that every part of it already exists in production somewhere, waiting to be pointed at agent payments.

What this unlocks, and why now

So what does this buy you, and why write it now? Because the standards are landing faster than the liability conversation. x402 made machine payments easy this year. The identity and settlement layer under it is being drafted right now, in public, in threads like the ERC-8203 discussion.

If you build agents that touch money, the practical move is not to wait for the settlement standard to finalize. Give every money-moving agent a real identity and a scoped account today, with the pieces that are already Final. I go deeper on the containment side of this in least privilege for agents that move money.

FAQ