Jul 2026· International Journal for Research in Applied Science and Engineering Technology· Vol 14, pp. 2211-2219· 0 citations
TL;DR
The Agentic Payments Observatory (APO) is proposed, a dashboard-centred reference architecture that unifies agent identity resolution, scoped permission verification, smart-contract and receipt reconciliation, real-time anomaly detection and policy-breach adjudication into a single operational surface.
Abstract
The rapid emergence of autonomous large-language-model (LLM) agents that transact on behalf of users, and
increasingly on behalf of other agents, has given rise to a new economic substrate commonly termed agentic commerce.
Protocols such as x402, the Agent Payments Protocol (AP2), the Agent-to-Agent (A2A) specification and the Model Context
Protocol (MCP) now allow software agents to discover services, negotiate scope, sign cryptographic mandates and settle
stablecoin or fiat-linked micropayments in a single HTTP round trip, without a human present at the point of transaction. This
convenience removes the implicit checkpoint that a human approver historically provided and creates an urgent need for
continuous, machine-speed observability. This paper proposes the Agentic Payments Observatory (APO), a dashboard-centred
reference architecture that unifies agent identity resolution, scoped permission verification, smart-contract and receipt
reconciliation, real-time anomaly detection and policy-breach adjudication into a single operational surface. At the core of APO
is a hybrid gated token-mixing transformer and graph neural encoder fused through conformal risk calibration, termed the
Agentic Payment Anomaly and Breach Detection (APABD) algorithm. We describe the system architecture, the streaming data
pipeline, the detection algorithm and a synthetic multi-agent transaction benchmark of 1.2 million events across 18,400 agent
identities. Experimental results show that APABD attains 0.93 precision, 0.91 recall and 0.92 F1-score, outperforming rulebased, gradient-boosted and single-modality graph or transformer baselines while producing calibrated uncertainty bounds
suitable for compliance escalation. The paper further discusses identity and zero-trust considerations, privacy-preserving
federated deployment across custodians, and the security posture required when agents hold spend-capable credentials.
Large Language Models (LLMs) are accelerating the shift from an Internet of information to an Internet of Agents (IoA), where autonomous entities discover services, negotiate, execute tasks, and exchange value. Yet today's agents are still confined to platform silos and proprietary interfaces, lacking a common stack for interoperability, trust, and pay-per-use settlement. This article proposes \textit{Agent-OSI}, a functional interoperability architecture for a decentralized IoA, whose core contribution is agent-to-agent (A2A) communication and a Web-compatible, backend-agnostic settlement protocol built on HTTP 402 (Payment Required); identity, verifiable execution, and semantic orchestration are treated as boundary layers with interfaces to existing standards. We treat HTTP 402 as an application-layer challenge-response primitive -- analogous to HTTP 401 for authentication -- whose settlement backend (escrow contract, payment channel, or signed off-chain receipt) is a pluggable choice, instantiated via a blockchain escrow in our prototype. We implement a prototype and evaluate its communication and settlement performance. Results show that, for generative workloads, end-to-end latency is dominated by task execution rather than settlement confirmation, and that keeping negotiation and delivery off the settlement backend reduces per-session settlement cost by approximately 51\% relative to a more on-chain baseline.
Wenxin Xu, Taotao Wang, Yihan Xia et al.· 2 citations
A systematic security analysis of AP2 v0.2 based on its roles, transaction lifecycle, deployment architectures, and trust boundaries shows that valid mandate signatures alone do not ensure that an agent-mediated transaction reflects the user's intent when its pre-authorization context is manipulated.
Avital Aviv, Parth A. Gandh, Ron Bitton et al.· 0 citations
Agent payment protocols are emerging as a key transaction layer for autonomous commerce, enabling AI agents to purchase goods and services and execute payments on users'behalf. Unlike conventional payment flows, they distribute user intent, delegated authority, credential use, settlement, and fulfillment across multiple actors and stages, creating security dependencies that no single message or participant can enforce. Yet these guarantees remain largely implicit across evolving specifications, schemas, and reference implementations, with little systematic formal analysis. We formalize four representative agent payment protocols: x402, MPP, ACP, and AP2 in Tamarin. Using a common abstraction of the agent payment lifecycle, we construct source-grounded models that capture each protocol's roles, state, trust assumptions, and lifecycle transitions. Rather than assuming a complete property taxonomy, we use source-backed verification questions and counterexample traces to expose missing bindings, state constraints, and cross-stage correspondences, consolidating them into 18 shared security principles. Across 86 verification cases, our analysis reproduces 46 known or calibration cases and identifies 40 previously undocumented formal-consistency findings. For each retained violation, we isolate the missing protocol relation, construct a minimally strengthened reference model, and reverify the intended property. We further evaluate the new x402 findings across three implementations and validate ten representative findings through implementation PoCs, SDK/schema-level witnesses, and source-aligned executable traces spanning five security principles. Our results show that delegated authorization must remain consistent with its resulting economic and service effects across actors, states, and protocol stages.
Ke Jiang, Mo-Han Yu, Yuan-Yi-Chun-Min-Chieh Chang et al.· 0 citations
PACE (Policy-Attested Contract Execution), a transaction-level authorization framework that interposes between an LLM-based agent and on-chain execution, is presented and frame its claims as logic-level safety within a reproducible benchmark rather than deployment-ready DeFi security.
Rabimba Karanjai, Yang Lu, Richard T Williamson et al.· 0 citations
The emerging Internet of Agents enables LLM-powered agents to discover peers, invoke tools, and delegate tasks across organizational boundaries. Existing protocols increasingly define how agents exchange messages, but not how an agent proves its identity, authorization, advertised capabilities, or accountability after delegation. We present InterSAGE, a trust-native protocol suite that supplies this missing security substrate alongside, rather than in place of, communication protocols. InterSAGE comprises four layers: Persistent Identity, Discovery, Trust Negotiation, and Accountability. Its four core primitives are: (1) Agent Identity Cards that bind developer, code package, operator, and deployment context; (2) capability-aware discovery using DID-bound Verifiable Credential manifests; (3) trust negotiation combining monotonic capability attenuation with two-tier access control; and (4) kernel-mediated cryptographic audit trails that bind usage, delegation, and execution traces to agent identity without a consensus ledger. InterSAGE is designed to complement MCP, A2A, ANP, and AG-UI, allowing communication protocols to evolve independently while keeping trust semantics explicit, portable, and verifiable. We compare InterSAGE with more than 50 efforts spanning agent protocols, decentralized identity, OAuth/OIDC extensions, zero-trust governance, delegation, and audit architectures. We show that no prior architecture jointly enforces persistent identity, capability-aware discovery, trust negotiation, and accountability as a unified four-layer trust substrate for secure agent interoperability.
Zhenhua Zou, Sheng Guo, Qiuyang Zhan et al.· 0 citations
Payment networks and model providers deployed agent-authorization infrastructure at speed during 2025 and 2026: signed mandates, agent-bound tokens, and machine-payable settlement rails, each promising that an autonomous agent transacts only within authority its principal granted. This paper asks a prior question to whether agents obey such authority: whether the deployed protocols can express it at all. We define an authorization envelope of eight fields drawn from the delegated-authority literature and from the control primitives of existing payment rails, comprising a per-transaction ceiling, a cumulative ceiling, a merchant set, a category set, required product attributes, a validity window, a substitution policy and an amount-valued confirmation threshold. We then code eight deployed agent-payment protocols against these fields using an auditable document-analysis protocol, classifying each field as expressible, advisory or absent according to whether a typed schema field exists and whether any identified party validates it. Three fields are unsupported almost everywhere: substitution policy, general product attributes, and the confirmation threshold. Cumulative ceilings are enforceable only where some party accumulates state across transactions, which five of the ten schemes examined do and the remainder do not. Most consequentially, virtual-card controls already enforce cumulative caps and merchant-category scope, and open-banking variable recurring payments enforce cumulative caps, that the new agent protocols omit, so agent authorization is in specific respects a regression against rails that preceded it. We release the coding protocol and evidence table, and retain version-pinned specification snapshots for audit.
Ian Staley· Journal of Artificial Intell...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
