An Agent Cannot Be A Payee
Ran Grushkowsky is CEO of MassPay, a global payout orchestration platform specializing in instant, real-time payouts worldwide.
gettyAgentic commerce has a measurement problem, and it is worth starting there.
In September, TRM Labs went looking for agent-initiated payments on the x402 network. It found $52.7 million settled across 198.9 million transactions since May 2025. Screening out self-payments, bulk flows from one or two payers and sellers with fewer than 10 buyers left $25.62 million. Of that screened volume, TRM estimated just 0.6% to 7.5% was plausibly initiated by an AI agent, depending on how strict the test.
TRM is candid about the limits. A script and an agent leave the same record on-chain, so the real number could be higher. It cannot be shown to be much higher. Most of what gets counted as machine commerce looks like ordinary automation.
That is not a reason to dismiss it. It is a reason to notice we are early, which is useful, because there is still time to build the half nobody is building.
AP2, launched by Google in September 2025 and donated to the FIDO Alliance in April, starts from the premise that payment systems “generally assume a human is directly clicking ‘buy’ on a trusted surface.” It responds with mandates that prove a person intended the purchase.
Mastercard’s Agent Pay for Machines, launched in June 2026 with more than 30 partners including Adyen, Coinbase and Stripe, is built on credentialing, permissioning, transacting and settling.
Serious infrastructure, none of it wrong. But all of it answers questions about the sender: Is this agent legitimate, did a person authorize it, is it within its limits?
None of it answers the questions on the other side: Is the recipient who they claim to be, is the account in their name, did the money arrive? That fails differently. An authorization failure stops a payment before it moves. A beneficiary failure lets it move, to the wrong place or to nowhere.
The clearest institutional thinking came from an IMF note in April, which splits agentic payments into intent, authorization and settlement. It flags “a key tension between probabilistic AI behavior and the deterministic requirements of payment infrastructures,” and keeps authorization and settlement rules-bound to preserve legal finality.
That is correct. A payment either lands or it does not, and there is no confidence score on whether someone got paid.
But a deliberately boring rail still has to know who the money is for. None of the three layers is built around that question.
An agent can hold a credential, carry a mandate and spend against a limit. It cannot be paid. Money has to land on a person or legal entity with a bank account, a verified name, a tax status and a jurisdiction.
x402, created by Coinbase and now governed by the x402 Foundation under the Linux Foundation, skips this by design: no account setup, no sign-ups, no API keys. For a machine paying a fraction of a cent for an API call, that is right. Identity would cost more than the transaction.
But TRM found 99.6% of that volume settled in USDC. A developer in Lisbon selling API calls has a growing stablecoin balance, and at some point it has to become rent.
The identity you did not need to take the payment is the identity you need to make the payout.
Payout failures are usually caught by the person waiting on the money. They check; it is not there, they raise a ticket. That ticket is the industry’s error detection.
Machine-initiated flows delete that person. TRM’s data works out to about 26 cents a transaction. At that size and speed, a systematic failure looks like nothing. No queue fills up, nothing gets escalated, and the discrepancy waits until someone reconciles, if anyone does.
Verification does not matter less when machines transact. It matters more, because the last human error detector has been designed out.
Establish the payee before the volume arrives. Verify name, account and jurisdiction at onboarding, while a person is present to fix a typo. Confirm the account can receive funds and collect tax status up front.
Reconcile end to end. Track every payout to confirmed credit, not just to the moment it left your system. Alert automatically on payouts unconfirmed past a set window and on failure spikes by corridor or rail. Give the silent-failure rate a named owner.
Set an aggregation policy for small balances. Sub-dollar earnings need a payout threshold, a schedule and a rule for balances that never reach it. At these sizes, that is not an edge case. It is the main case.
The underlying lesson is incentives: Whoever pays for a failed payout has a reason to prevent it. At MassPay, we made payee verification free and stopped charging for failed payouts, putting the cost on the party that can engineer it away. When nobody is watching the money arrive, providers should be measured on confirmed delivery, not volume sent.
The industry is building the send side carefully and well, and it has the luxury of doing so because the real volume has not shown up yet.
When it does, every one of those transactions will end on a person. Deciding who that person is, and proving it, is not a layer in anyone’s architecture diagram. It is what has to work before the rest of it means anything.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
