Agentic
payments.

HTTP has always had a status code reserved for this: 402 Payment Required, dormant since the 1990s. x402 finally uses it. An agent requests a resource; the server replies 402 with payment terms (amount, address, token). The agent pays — typically a tiny stablecoin transfer — and retries the request carrying proof of payment. This time it gets 200 and the resource.

No checkout page, no human. Payment becomes just another part of the protocol — which is exactly what an autonomous agent needs. But a checkout an agent can drive is also a checkout a hijacked agent can drive. That's why x402 is only half the story; the other half is the authority the agent carries into it.

You don't hand the agent your wallet — you hand it a mandate: a signed authorization that scopes what it may spend. Just as an OAuth token grants "read your email but not send," a payment mandate grants "spend up to $20 a transaction, $50 total, only at these merchants, until Friday." Protocols like AP2 standardize these mandates so any agent and any merchant can speak the same authorization language.

The agent acts freely inside the mandate and is refused outside it. Authority is delegated, bounded, and revocable — the model never holds unlimited spending power.

The mandate is only as good as the check. Before every payment, the payment layer verifies three things against the mandate: is the amount within the per-transaction ceiling, does it keep cumulative spend under the total budget, and is the merchant in scope? All three must pass, or the payment is refused before any money moves.

This is least privilege applied to money: the agent's spending power is the narrowest set of payments that still lets it do its job. Everything else is denied by default.

Crucially, the check runs in the payment layer, not the prompt. You're not asking the model to respect a budget in its reasoning — you're making the budget a precondition it physically cannot bypass, the same way a sandbox enforces file access regardless of what code wants to do.

Here's the threat the caps exist for. A prompt-injected or looping agent decides to make a hundred payments — draining an account is exactly the kind of damage autonomy makes possible. With the mandate check in front of every payment, it can't. Cumulative spend climbs to the cap and then every further payment is refused; the loop spins but the money stops.

The runnable enforcer below makes this concrete: point a "runaway" agent at a $50 mandate, watch it try to spend $200, and watch it get stopped cold at the ceiling. The final spend is bounded by max_total no matter how many times it tries.

Several protocols are converging on this shape, and it's early enough that they overlap. Broadly: x402 handles the machine-native settlement (the 402 flow and payment proof), AP2-style mandates handle the scoped authorization, and processor-led and wallet-led efforts add identity, dispute handling, and fiat bridges. Expect consolidation, but the primitives — a checkout an agent can drive, and a signed scope on what it may spend — are stable regardless of which brand wins.

The reported traction is real: the category has already moved into nine figures of transaction volume with major processors adopting agent-payment rails. For an engineer the takeaway isn't which protocol to bet on today; it's that "my agent needs to pay for something" now has real answers — and each one needs the mandate discipline above bolted on.

Agentic payments are a genuinely new capability surface, and capability surfaces are where agents get dangerous. The good news is that this one has a clean control story: delegated, bounded, revocable authority checked before execution — the same least-privilege pattern that governs an agent's tool access and file system. If you're designing the backend, the mandate-verification and settlement flow is a system-design problem in its own right; see the payment system and digital wallet designs for the human-rails version this builds on.

The mental shift is the same one that made agents safe to give tools at all: never rely on the model to behave, bound what "behaving badly" can even cost. A mandate is a spending sandbox, and like every good sandbox, it works precisely because it doesn't trust the thing inside it.