For twenty-eight years, HTTP status code 402 has sat in the IANA registry as a placeholder — "Payment Required," reserved in RFC 2616 for a future that never arrived. The web routed around it. Cards, tokens, OAuth, and redirect chains filled the gap. Then Coinbase shipped x402 and woke the dead code, pointing it at a new class of client: autonomous software agents that carry budgets and settle transactions with no human in the loop.
That resurrection is the most interesting artifact inside Cathie Wood's recent note, the one where she tells investors to follow the money AI agents spend. The headline is a thesis. The protocol is the evidence. And the evidence, once you read the specification rather than the press release, says something narrower and more uncomfortable than "infrastructure wins."
Wood's argument is straightforward. AI is shifting from answering questions to spending money — booking, subscribing, procuring, settling. When consumption is initiated by an agent instead of a human thumb, the monetization layer moves with it. Attention economics weaken; transaction economics strengthen. Money flows toward the rails that authorize, route, and settle agent payments, and away from the interfaces that monetize human clicks.
The direction is sound. What the note omits is that the rails are not one thing. They are a stack, and every layer is contested by a different coalition. OpenAI and Stripe pushed the Agentic Commerce Protocol, or ACP. Google published the Agent Payments Protocol, AP2, alongside its agent-to-agent work. Anthropic's Model Context Protocol, MCP, quietly became the connective tissue for tool and data access. Coinbase's x402 revived HTTP 402 for machine-native micropayments. Visa and Mastercard shipped their own agent-payment programs. Within roughly eighteen months, the industry moved from asking whether an agent can pay to asking whose standard governs the payment.
History gives a rough template. Mobile did not destroy commerce; it relocated the point of monetization from the desktop portal to the app store and the payment SDK. Agentic payments look like the next relocation, not a demolition. The interfaces that survive will be the ones agents are forced to pass through, and the interfaces agents can route around are the ones at risk.
That transition — from a capability question to a governance question — is the real subject of the note, even though the note never names a single protocol. To see why it matters, read the specifications.
x402 is the cleanest place to start because it is deliberately small. A client requests a resource. The server answers 402 with a machine-readable price and payment terms. The client constructs a signed payment payload, usually a stablecoin transfer authorization. A facilitator verifies and settles it, often batching many authorizations into one on-chain transaction. Then the resource unlocks. No new transport layer is required; the HTTP request itself is the invoice.
That minimalism is both a feature and a liability. x402 defines settlement. It does not define authorization. It says how money moves, not who was permitted to move it, under what ceiling, or with what revocation path. Those questions are left to whatever sits above it.
AP2 attacks the authorization problem head-on. It introduces the mandate: a verifiable credential in which a user or an enterprise grants an agent a bounded permission — this merchant, this category, this ceiling, this expiry. The mandate answers "who authorized this spend," and because it is signed, it answers it after the fact as well. ACP folds similar logic into the checkout flow, letting agents complete purchases through existing merchant infrastructure while Stripe handles tokenization and the network underwrites the risk.
The design difference between these approaches is not cosmetic. x402 optimizes for machine-native, low-friction, on-chain settlement. AP2 and ACP optimize for delegation, revocation, and liability that an established payment network can absorb. They are solving for different failure modes, which is why they have not merged.
The stack also hides a split that matters for anyone mapping winners. Agentic payments are not one market; they are at least two. There is the small, high-frequency tier — API calls, metered subscriptions, per-use data — where stablecoin settlement and protocols like x402 win on cost. And there is the large, low-frequency tier — procurement, travel, enterprise purchasing — where card networks win on fraud protection, insurance, and legal recourse. Conflating the two is the most common error in the current commentary. They have different beneficiaries, different risk profiles, and different standards.
MCP sits underneath both. It is not a payment protocol; it is a context protocol — the mechanism by which agents discover tools and data. But whoever controls context controls the moment of decision, and the moment of decision is where payment intent forms. That gives MCP strategic weight that the note gestures at with the phrase "infrastructure providers" without ever specifying it.
Identity deserves more attention than it gets. A mandate is only as trustworthy as the identity behind it. For an agent to spend safely, three things must be provable: that the agent is the one the user deployed, that it is backed by a party with standing, and that its instructions trace to a legitimate principal. On the enterprise side this becomes a know-your-agent problem that mirrors KYB — who underwrites the agent's credit, who revokes it, who audits its history. No protocol in the current field solves this end to end, and the note never raises it.
I have audited order-matching logic before. In 2017 I spent four months inside the 0x v2 exchange contracts, hunting race conditions in the fill path that could be exploited for front-running. The pattern I keep seeing in agentic payments is the same one. The authorization check and the state change are not atomic. An agent is told its ceiling, then reads external content, then pays. Between those steps, anything the agent consumes can rewrite its intent. That is not a defect in x402 or AP2 individually. It is an architectural seam that no amount of settlement-layer polish closes. I later did the same for Uniswap V2, modeling impermanent loss through solid-state physics equations, and again for ERC-721A, chasing gas inefficiencies that traced back to metadata assumptions. The lesson repeated: the vulnerability was never in the formula. It was in what the formula assumed about the world.
Two years ago I helped build a minimal proof of concept for verifiable AI inference using zero-knowledge proofs — four developers, no interface, only the cryptography. The point was never the demo. It was to prove that a computation could be checked by a stranger. That same primitive is what an agentic payment needs at the authorization step: not trust in the agent, but a proof that the spend matched the mandate. The industry is building the settlement half and postponing the verification half.
Now the unit economics, because this is where the "follow the money" claim gets tested rather than asserted. A micropayment — a per-call API fee, a metered subscription tick — has to settle for fractions of a cent, or the fee eats the payment. Card rails are structurally poor at this: interchange plus network fees make sub-dollar transactions uneconomic. Stablecoin settlement on a low-fee chain changes the arithmetic, which is exactly why x402 denominates in tokens rather than card authorizations. The durable moat in agent payments is not the ability to move money; it is the ability to move money at a price the transaction can bear. Settlement is commodity work. Settlement economics is not.
Notice what is absent from that argument: data availability. I have written at length about modular DA and data availability sampling, and I will say plainly that the DA debate is largely irrelevant here. Agent payment payloads are tiny — a signature, a price, a merchant identifier. The overwhelming majority of agentic transaction flow will never generate enough data to justify a dedicated availability layer. Anyone pitching agent payments as a demand driver for modular DA is solving a problem this workload does not have.
So where does value actually accrue? Follow settlement, not story. The authorization layer — mandates and spend controls — is the most defensible capture point, because that is where liability is defined and where enterprises will pay for auditability. The settlement layer matters too, but only for the flows card networks cannot serve economically. And identity — proving that an agent is who it claims and is backed by whom — is the least glamorous, the hardest to build, and the one the note never mentions.
Here is where the mandate layer's unintended consequences compound. Each protocol solves its own slice and assumes the others are handled elsewhere. x402 assumes authorization. AP2 assumes settlement. MCP assumes both. The result is a stack with clean interfaces and no owner of the seams — and the seams are precisely where failure lives. In my experience auditing composable systems, the exploitable surface is rarely a single contract. It is the assumption each component makes about its neighbor.
The note's blind spot is not optimism. It is omission. It frames agentic payments as a clean value migration — money leaving interfaces, arriving at rails — and never prices the cost of the trust that migration requires. That cost is enormous, and it lands on the very infrastructure the note tells you to buy.
Take prompt injection. In the human web, a successful injection leaks data. In the agentic web, the same technique issues a payment. An agent that reads a page or an email to finish a task cannot reliably separate instructions from data, and malicious instructions hidden in that content can redirect a signed payment toward an attacker. The attack surface shifts from confidentiality to custody. I have argued for years that the interesting failures in this industry are not the ones inside the audited code but the ones inside the assumptions around it. Agentic payments take that principle and attach a wallet to it.
Now the gap no protocol on the market closes: dispute resolution. Cards have chargebacks. Cash has finality and no recourse. Agentic payments have neither a clean chargeback nor a legal owner of a mistaken transaction. When an agent overpays, pays twice, or pays a merchant that never delivers, who absorbs the loss — the user, the agent vendor, or the settlement network? Until that is answered in code and in law, the ceiling on autonomous spend stays lower than the thesis implies.
There is a second unintended consequence. Standard fragmentation is not a temporary inconvenience; it is a tax on adoption. When four protocols each require a different integration, the integrator picks none of them, or picks the one its largest customer already uses. And watch the adoption metrics closely. Every incentive program in this industry has taught the same lesson: subsidize the metric and the metric arrives, then leaves when the subsidy does. Agent-payment transaction counts are about to become the most subsidized number in crypto.
Then there is the counter-move the note does not model. Platforms are not passive. Marketplaces have already experimented with blocking third-party agents from scraping listings, precisely because an agent that compares prices without seeing ads destroys the economics of the page it reads. If the largest platforms wall off their catalogs and deploy their own agents, the "money flows to infrastructure" thesis gets redirected: it flows to whoever owns the catalog, not whoever owns the rail. Control of inventory is a moat the note ignores, and platform lockout is the unintended consequence of assuming they will not use it.
The incumbents can also wait. Card networks, cloud platforms, and large model vendors have the balance sheets to run agent payments at zero margin until a standard settles. A thesis that assumes infrastructure providers capture durable rent has to survive the possibility that the largest of them decide to capture market share instead. That is a strategic choice, not a law of physics.
The next signal worth tracking is not a token price or a partnership headline. It is whether the mandate layer — the signed, revocable, bounded permission that lets an agent spend — converges on one standard or fractures into incompatible camps. If it converges, the infrastructure thesis pays out, and it pays out to whoever owns authorization rather than settlement. If it fractures, the money still flows, but it flows to the players with the balance sheets to outlast the standards war. Which outcome arrives first, and who is holding the invoice when it does?
