On October 6, a protocol called Poppy went live with forty-two design partners. Visa. Mastercard. Stripe. PayPal. Bank of America. Wells Fargo. Schwab. Plaid. Fifteen days later, on October 15, a second protocol called Proof x401 shipped to answer exactly one question: who is standing behind this agent?
Neither announcement carried a governance charter. Neither carried a security audit. Neither carried a revocation path.
I read both twice, then did what I do with any unverified bytecode: I went looking for the exit.
The yield here is convenience. The exit is the mandate. Yield is the bait; exit liquidity is the hook. Forty-two of the largest financial institutions on earth just published an architecture that lets software spend your money on your behalf, and the part that tells you how to take that power back is missing from the document.
This is not a product launch story. It is a rulebook story. Two protocols, zero disclosed transaction volume, zero disclosed governance terms, and a definition of "who may act for a human in a financial system" being drafted in a closed room while the market is down and nobody is looking at anything except liquidation levels.
I have done this before. In late 2017 I spent twelve nights reversing the unverified bytecode of a token called Ethereum Gold for a fund in Sรฃo Paulo. The minting function had an integer overflow. Supply could be inflated without limit. I sent the proof-of-concept to the lead developer on Telegram at 3 a.m. and the patch landed before the allocation cleared. That fund kept $2.5 million because somebody read the code instead of the deck.
The lesson I took from 2017 was not "audits are good." It was narrower and uglier: the gap between what a system claims and what a system does is always located in the same place โ the verification step nobody wants to pay for.
That gap is now being built into the infrastructure of agentic payments, at institutional scale, with your account as the collateral.
In a drawdown you stop asking what a thing can do for you and start asking what it can do to you. So let us do that. Slowly. With the actual architecture.
The Context: what these two protocols actually are
The financial sector spent two years trying to block AI agents. Blocking was always a losing position. An agent that can read a screen can click a button, and a button that can be clicked cannot be un-clicked by policy. Sometime in the last eighteen months the posture flipped from blocking to building. Poppy and Proof x401 are what building looks like when banks do it.
Both sit in the identity and authorization layer. Not settlement. Not consensus. Middleware โ the translator between an AI agent and a financial institution that wants to know who authorized this and for how much.
Poppy, formally the Personal Agent Protocol, handles discovery, session, login, and task delegation. It launched at an event called Sierra Summit with forty-two design partners. Proof x401 extends the HTTP 401 status code โ Unauthorized, the code that means "present your credentials" โ into something new: a request for a verifiable delegation. Not just who are you, but who authorized you, to do what, for how long, up to what amount.
The architecture is a four-node chain, and it is worth laying out precisely because the weakness is structural, not accidental.
Node one is a natural person, verified at IAL2 under NIST SP 800-63A. That means document-backed identity verification. A real human, with a real passport, confirmed by a real identity provider. Node one signs node two: a signed mandate, cryptographically bound, specifying scope, spending limit, expiry, and permitted counterparties. Node two binds to node three, the agent, which presents its credentials to a merchant via OpenID4VP โ the OpenID Foundation standard for verifiable presentations. Node four is the merchant, which performs what the documents call independent verification.
Every link leaves a verifiable artifact. In legal terms this is an authorization letter with a cryptographic signature. It is, on paper, exactly the right shape. It maps to agency law. It produces an audit trail. It makes delegation provable instead of implied.
The standards map around it matters more than the protocol itself. x402 โ proposed by Coinbase, later moved to the Linux Foundation โ uses HTTP 402, Payment Required, to do machine-to-machine on-chain settlement. Google's AP2 carries a different innovation: Verifiable Intent, a cryptographic binding of what the user actually wanted, not merely who the user is. Stripe's ACP with OpenAI focuses on merchant-side commerce settlement. Visa's TAP handles trusted agent identification inside the card network. MCP handles tool invocation. OAuth and OIDC handle session scope. OpenID4VP handles credential presentation.
Notice what Poppy and Proof x401 both do with payments: they exclude them. Both protocols explicitly delegate payment execution to x402. The authorization layer decides who may act. The settlement layer moves the money. Two protocols, two governance bodies, two liability regimes.
Notice also who is not on the forty-two-name list. No Google. No Anthropic. No Meta. No OpenAI. The list is Visa and Mastercard and Stripe and PayPal and Bank of America and Wells Fargo and Schwab and Plaid. This is a financial-side coalition, clean and unmixed. Visa appears on it while simultaneously pushing its own TAP standard โ a dual-track hedge, which is what card networks do when they are not certain which rail survives.
And notice what is absent from every document: a token. No supply schedule, no unlock table, no incentive design, no governance token. That absence is not neutral. It tells you where the money is expected to come from.
The Core: four nodes, one broken link, and five years of on-chain evidence
The value and the weakness of this design live in the same place. Node four. The merchant's independent verification.
If the merchant verifies โ genuinely, at cost, at latency, at engineering expense โ the chain holds. Every delegation is provable. Every agent action traces back to a signed mandate and a real human. If the merchant skips verification, or simplifies it, or routes it through a cached lookup to save forty milliseconds on a checkout flow, the entire chain collapses into self-attestation. The agent says it is authorized. Nobody checks. The cryptography becomes theater.
Here is the problem. The merchant is the party in the chain with the least incentive to verify. The merchant pays the verification cost. The merchant absorbs the latency. The fraud loss lands on the cardholder or the issuing bank. There is no line item on the merchant's P&L that rewards rigor and no line item that punishes laziness, because the loss is externalized by design.
I have watched this exact incentive structure play out for five years on-chain, and the empirical result should be required reading for anyone signing off on this architecture.
In 2021 I ran a floor-sweeping experiment on Bored Ape Yacht Club. Twelve rapid buys during low-liquidity windows, three mid-tier tokens acquired, sold inside forty-eight hours for roughly forty percent. The profit is not the interesting part. The interesting part is the WETH approval sequence I documented in the writeup โ the exact order of approve calls, the transaction failures, the gas burned on reverts.
What that experiment proved, and what the 2020 Uniswap liquidity sprint proved before it, is this: when you give users a mechanism to delegate spending authority with a scope and an expiry, they will set scope to infinite and expiry to never. Not most of them. Effectively all of them. The approve-and-never-revoke pattern is not a UX bug that better interfaces will fix. It is the revealed preference of every participant in the system, because the cost of revocation is paid now and the cost of over-permission is paid later, by someone else, maybe never.
The signed mandate is a better-engineered approval. It has scope, limit, expiry, and counterparty constraints. It is what we should have built in 2020. But it runs on the same humans, and the humans have already voted with five years of on-chain data. If the mandate defaults to anything generous โ and the pressure to default generous will be enormous, because friction kills conversion and conversion is what the merchant cares about โ you have rebuilt the unlimited approval with better marketing.
Code is law until the audit reveals the trap. Neither Poppy nor Proof x401 has published an audit. Neither has confirmed whether x401 is open source. For an identity and authorization protocol, that is not a minor omission. A closed authorization standard cannot be independently reviewed, cannot be formally verified, and cannot be trusted at the layer where trust is the entire product.
Now go one level deeper, to the thing that makes this architecture fragile in a way nobody in the forty-two-name room appears to have addressed.
Node one is IAL2. Document-verified identity. That means every compliant agent transaction resolves back to a KYC'd natural person, confirmed by a centralized identity provider, under a national identity policy. This is the design's core selling point and its core contradiction. The authorization layer for the most permissionless financial rail ever built is anchored, at its root, in a government-issued document checked by a vendor. Web2 identity is domesticating Web3 payment rails, and it is doing so one signed mandate at a time.
That is not a criticism of compliance. It is an observation about dependency. IAL2 verification providers, bank KYC systems, and account aggregation services are the upstream inputs. All three are centralized, all three are regulated, all three can be switched off by policy. A protocol whose security model depends entirely on upstream actors it does not control has a single point of failure that no amount of clever cryptography at nodes two and three can mitigate.
Then there is the seam between the authorization layer and the settlement layer, and this is where I would put my money if I were shorting something.
Poppy decides who may act. Proof x401 proves the delegation. x402 moves the funds. When an agent operates inside a valid mandate โ signature valid, agent valid, merchant verification passed โ but gets steered by a prompt injection into a transfer the user never intended, which protocol owns that loss?
The answer, structurally, is neither. Each protocol can demonstrate that it performed precisely its defined function. x401 verified that a real human authorized an agent with a real mandate. x402 executed a valid transfer. The merchant verified the credentials. Every party holds a verifiable artifact proving its own innocence. The user holds a loss.
Schwab's CEO, Rick Wurster, raised exactly this concern early โ what happens when an agent does something the customer did not intend. The protocols have not solved that question. They have relocated it, from a dispute between a customer and an institution to a dispute between protocol A and protocol B, where both parties are better resourced than the customer and neither has an incentive to accept the loss.
Verifiable credentials make liability traceable. They do not make liability assignable. Traceability is not allocation. Every audit trail in the world does not answer the only question that matters when money is gone: whose balance sheet absorbs it.
And this brings me to the technical blind spot that the entire agentic payments narrative has been quietly ignoring, and which I consider the most important thing in this entire analysis.
Every mechanism described here โ the signed mandate, the OpenID4VP presentation, the merchant verification, the IAL2 anchor โ answers the question "who is authorized." Not one of them answers the question "is the agent, at the moment of execution, still faithful to the intent that was authorized."
Prompt injection does not break authorization. It operates entirely inside it. The signature is genuine. The agent is genuine. The mandate is genuine. The merchant verification passes. And the funds go somewhere the human never approved, because the instruction stream the agent was reading contained an adversarial payload that redirected it. This is not a theoretical attack class. It is the single most common failure mode in deployed agent systems, and in an agentic payment context the consequence is irreversible, because settled funds do not roll back.
This risk is one order of magnitude more severe in agent payments than in agent browsing. A hijacked browsing agent embarrasses you. A hijacked payment agent empties an account.
Google's AP2 is closer to the correct answer than anything in the Poppy stack, because Verifiable Intent binds the user's actual objective into the cryptographic envelope rather than binding only their identity. If x401 solves identity and leaves intent to somebody else, its value is being overstated by everyone quoting the forty-two-partner number.
One more structural note on value capture, because this is where the crypto-native reader should be paying attention. There is no token here. There will probably never be a token that matters, because the business model of a standards-layer protocol is not token appreciation. It is verification fees, API calls, and enterprise licensing โ the Plaid model, the Auth0 model, the Okta model. If a token does appear, it will be a governance token whose holders have no influence over the only decisions that matter: which institutions join, and what the verification rules are. Those decisions get made by the board of the forty-two.
Which means the real money in this architecture is not in the protocol. It is in node four. The largest commercial opportunity created by agentic payments is Agent Identity Verification as a Service โ the execution point where somebody actually checks the credential. That is Plaid's market, Jumio's market, Okta's market, and possibly Cloudflare's market if verification runs at the edge. It is not DeFi's market.
The Contrarian Read: private ordering is not a public good
The framing everyone has accepted is that private ordering is filling a regulatory vacuum. That framing is accurate. It is also the problem, stated as a compliment.
The Warner AI AGENT Act stalled. The DOJ signaled non-interference. In that window, forty-two financial institutions wrote the admission criteria for agentic commerce. Every one of those institutions is a direct competitor of the others. Visa and Mastercard compete. Stripe and PayPal compete. Bank of America and Wells Fargo compete. Competitors do not sit at the same table to write standards out of shared vision. They do it out of shared fear โ the fear that AI platforms route around the card networks entirely, that agents settle in stablecoins over x402, that interchange evaporates because the software never touches a card.
Shared fear builds coalitions faster than shared vision, and dissolves them faster too. When the threat recedes, the alliance loses its adhesive. Watch what happens to the forty-two if stablecoin settlement stalls.
There is a legal dimension here that has been almost entirely ignored, and it is the sharpest thing in this entire story. Under US case law, industry custom is admissible as evidence of the standard of care. Once a verification protocol is widely adopted, courts can cite it as the benchmark for reasonable diligence. The forty-two are not merely writing a technical specification. They are writing the negligence standard that will be applied to everyone who did not participate in drafting it. That is quasi-legislative authority acquired without a vote.
Set against that, the antitrust exposure is real and underpriced. Forty-two competitors agreeing on who may access agentic commerce is structurally identical to the card network admission disputes that have drawn scrutiny before. If the membership terms are open, this reads as industry self-regulation. If they are closed, it reads as a group boycott with a technical whitepaper stapled to it. Nobody has published the membership terms. That silence is the signal.
Then there is the rhetoric, which deserves to be named for what it is. "Shifting from blocking to building" is not an observation. It is a frame. It casts blocking as backward and building as progress, and in doing so it pre-empts the only questions worth asking: building what, with whose money, under whose rules, with what recourse. A headline that answers a question before you ask it is doing work on you.
The bear market read is simpler and colder. Liquidity dries up when the music stops, and what remains when it does is the infrastructure that owns the exits. This authorization layer is not being built because agents are about to transact at scale. It is being built so that when they do, the money flows through the incumbents' pipes and not around them. Poppy is not a public utility. It is a defensive fortification around interchange revenue, dressed in the language of interoperability.
The forty-two design partners are a signal of intent, not of deployment. Libra had twenty-eight founding members. It never shipped. Large coalitions from announcement to production run eighteen to thirty-six months on median, and a meaningful fraction never arrive. Meanwhile the narrative will be fully priced inside twelve.
Sweep the floor, not the FOMO. The floor here is real transaction volume. Everything else is a press release with a logo grid.
The Takeaway: one metric, one question, one asymmetry
The metric is agent-initiated transaction volume, disclosed by card networks or processors in a quarterly filing. Not partner counts. Not summit keynote slides. The first time a payment processor breaks out a line item for agent-originated transactions, the narrative has a floor under it. Until then it does not.
The question is who publishes the revocation path. A delegation system without a documented, low-friction, unilateral revocation mechanism is not a delegation system. It is a standing authorization with a marketing department. Ask every protocol in this space the same thing: show me the revoke function, show me the audit, show me the governance charter, show me the liability clause. Four questions. If any answer is "coming soon," you have your risk assessment.
The asymmetry is the one that should keep every crypto-native builder awake. x402 settles. x401 and Poppy govern. The rule-making layer decides who may act and under what constraints. The settlement layer moves bytes. Technical indispensability is not value chain position. A rail can be essential to every transaction and still capture none of the margin, because the margin lives where the permission is granted, not where the payment clears.
If this architecture hardens as designed, Web3 does not disrupt the payment stack. It becomes the back office of it. Compliant, efficient, and structurally subordinate.
That outcome is not inevitable. It depends on whether the authorization layer's governance stays neutral or gets captured, and that decision is being made right now, in a bear market, in documents nobody has published.
Patience is for traders; timing is for killers. The window to influence this is open for roughly eighteen months. After that, the standard of care is set, the courts have a benchmark, and the revocation path โ if one exists โ will have been written by the people who benefit from it not existing.