Agent Payments, x402, and Who Is Liable When an Agent Pays

The agent paid. Now who is liable?

Last month an AI agent bought API credits for me. It found the endpoint, hit a paywall, paid, and moved on. The payment worked. Nobody had decided who'd answer for it if it had paid the wrong bill.

That gap, not the payment tech, is the real problem with agent payments. x402 and the protocols around it solved how an agent hands over money. They didn't solve who stands behind that money when it goes wrong. The layer that records the principal, the spending limit, and the proof the payment was authorized is still missing.

I'm not writing this as a spectator. I shipped the three pieces that layer needs: on-chain identity at Tokeny, identity-gated transfer with ERC-3643, and account-abstraction rails at Biconomy that moved $441M across 38M+ transactions. This is the case for turning KYC into Know Your Agent, from someone who put KYC on-chain.

What x402 does, and what it leaves open

Let me be precise about what x402 is, because the hype blurs it. x402 is a payment protocol Coinbase introduced in 2025 that revives the old HTTP 402 'Payment Required' status code. A server answers a request with 402 and a price; the client, often an agent, pays in stablecoins and retries. It's a clean way for software to pay software.

That's genuinely useful, and it's not the same as solving liability. x402 standardizes the request and the settlement of a single payment. It doesn't standardize the identity of the agent paying, the authority it was granted, or the record a regulator would ask for later. A public tracker, x402scan, lists live x402 activity as of mid-2026. The unanswered question is who's accountable for each of those payments.

Know Your Agent is KYC, moved to the agent

Here's the reframe that makes the problem tractable. We already solved a version of this for humans. It's called KYC: before a person can move regulated money, an institution verifies who they are and what they're allowed to do. Agent payments need the same thing, aimed at the agent. Call it Know Your Agent.

The difference is where the identity lives. A human's KYC record sits in a bank's private database. An agent operates across services that don't share a database, so its identity has to be portable and verifiable by anyone, which is exactly what an on-chain identity is. I built that primitive at Tokeny as OnchainID, using ERC-734 and ERC-735, before agents were the reason anyone wanted it.

The three pieces I already shipped

Know Your Agent isn't a research project for me. It's three shipped standards and systems, stacked. Each already runs in production for regulated assets. Agent payments just point them at a new payer.

Stack those three and an agent payment stops being a bare transfer. It becomes a transfer from a scoped smart account, by an agent with a named principal, gated on an identity rule. The mechanics of that gate are the ones I detail in ERC-3643: identity-gated transfer, explained.

ERC-8203: the draft settlement layer I co-author

There's still a missing piece, and it's the one I'm closest to right now. Identity says who the agent is. Scoped accounts say what it may spend. Neither says: settle this payment only if an off-chain condition is later proven true. That conditional step is where a lot of real agent commerce lives, and it's what ERC-8203 is trying to standardize.

ERC-8203, 'Agent Offchain Conditional Settlement', is an early draft. I need to be exact about my role, because it's easy to overstate. The standard's primary author is Xianrui Qin. I wrote the reference implementation, the working code that shows the interface can be built, submitted as PR #1614. I authored three Ethereum standards, ERC-3643, ERC-6960, and ERC-7410. ERC-8203 is a fourth, but it is not finished: I am second of three named authors on a Draft that is still an open PR.

The reference implementation sketches an interface roughly like this. Treat it as a shape, not the normative text, which is Xianrui Qin's to define.

// ERC-8203 (draft): Agent Offchain Conditional Settlement.
// Primary author: Xianrui Qin. This is the reference-implementation
// shape I submitted as PR #1614, simplified. Illustrative, not the spec.
interface IAgentConditionalSettlement {
    // An agent opens a settlement it will honor IF a condition is later proven.
    function openSettlement(
        bytes32 agentId,        // the agent's on-chain identity
        address principal,      // who is liable if this settles
        bytes32 conditionHash,  // hash of the off-chain condition to satisfy
        uint256 maxAmount       // the ceiling the principal authorized
    ) external returns (bytes32 settlementId);

    // Settlement executes only when the proof matches, and within maxAmount.
    function settle(bytes32 settlementId, bytes calldata proof) external;
}

Three highlighted fields carry the liability argument. agentId is the agent's on-chain identity, the thing a signed claim can tie back to a principal. principal records the human or company on the hook if the payment settles. maxAmount records the ceiling they authorized. Settlement only fires when a proof satisfies the committed condition, so nothing moves outside the scope the principal set.

A liability model that could actually work

Put the pieces together and you can write down a liability model that a regulator, an engineer, and an insurer could all read. It has three anchors, and the whole thing turns on whether all three are present.

This is the diagram I keep coming back to. Each anchor maps to a standard I've already named. The point isn't that it's finished. The point is that every part of it already exists in production somewhere, waiting to be pointed at agent payments.

What this unlocks, and why now

So what does this buy you, and why write it now? Because the standards are landing faster than the liability conversation. x402 made machine payments easy this year. The identity and settlement layer under it is being drafted right now, in public, in threads like the ERC-8203 discussion.

If you build agents that touch money, the practical move isn't to wait for the settlement standard to finalize. Give every money-moving agent a real identity and a scoped account today, with the pieces that are already Final. I go deeper on the containment side of this in least privilege for agents that move money.

FAQ