When Software Gets a Wallet: Agents Paying Agents, and the Question of Who Says Yes

Three Minutes Past Three in Nairobi

Imagined scene. The characters below are composites invented to make a point. They do not describe any real company, driver or person.

At three minutes past three in the morning, a truck idles on a dark stretch of road outside Nairobi. The driver sleeps in the cab. The dispatch system does not. It is an agent, and its problem is small and specific: it must decide whether the truck fills its tank at the next town or waits for a better price, and rain is forecast ahead on the route. A flooded cut in the road would cost the company a day.

So the dispatch agent asks a weather agent. The weather agent belongs to a small outfit that sells hyper-local rainfall forecasts, one square kilometre at a time, for a fraction of a cent a question. It does not intend to give its answer away.

The fuel agent offers two hundredths of a cent. The weather agent answers with three hundredths. Neither has a face, a lunch break or a reputation to protect, yet they haggle the way two market women haggle over a sack of maize, in units no coin could ever hold.

The weather agent does not argue further. It replies with a status code the web reserved decades ago, 402, Payment Required, and the reply asks for payment before it answers. The dispatcher, the night before, had given the fuel agent's wallet a narrow limit. The wallet signs one authorisation for one query. The forecast comes back faster than a blink: rain over the cut after 05:40, sixty per cent, hold the fuel until the pass clears.

The truck waits. Nobody in the cab wakes. Somewhere a ledger records three hundredths of a cent paid for a forecast about a road, and the ledger cannot tell whether it has just recorded a sale, a service or a small act of trust.

The rest of this article is about what must be true for that scene to become boring. Boring is the sign of infrastructure.

What Has Shipped, and What Has Only Been Announced

Agent payments attract launch-day language that outlives the launch. So this section separates three things the industry often runs together: what exists as working software or a governed standard, what has been announced or piloted, and what is only forecast.

Shipped, in the sense that a specification, a governance body or a live service now exists:

• Google's Agent Payments Protocol, AP2, went to the FIDO Alliance on 28 April 2026. Version 0.2 adds what Google calls "Human Not Present" payments, in which an agent buys on instructions the user pre-approved, such as a limited-run ticket going on sale. Google's post gives no adoption numbers. (Google blog)
• The Agent2Agent protocol, A2A, passed 150 participating organisations and landed on the major cloud agent platforms on 9 April 2026. The Linux Foundation says there are "active production deployments across multiple industries" but offers no count. (PR Newswire copy of the Linux Foundation release)
• The x402 Foundation, which stewards Coinbase's HTTP 402 payment protocol under the Linux Foundation, became operational on 14 July 2026, though some outlets date it 15 July. Its premier members include Visa, Mastercard, Stripe, Google, Coinbase, Shopify and American Express. (Linux Foundation) Judgment. A foundation's stewardship is not the same thing as a standards-body decision.
• The Agentic Commerce Protocol, created by Stripe, OpenAI and Meta, defines how agents complete purchases with businesses on behalf of buyers. Stripe's documentation lists 2026-04-17 as the latest stable version. (Stripe documentation)

Announced or piloted: someone has said it, or tested it in a bounded way, but it has not been shown at volume. The Visa invoice pilot and the Mastercard announcements in the next section belong here, alongside any claim that "agents are paying now."

"Shipped" is a word the industry uses for a specification as readily as for a service with paying customers. No audited figures for agent-initiated payment volume have been published, whether by a card network, by M-PESA or by a Kenyan bank. That is a reason to hold every number loosely.

The Rails Are Already Warm

Visa, BILL and Billtrust described on 20 October 2026 what they called a first live test of AI agents completing approved buyer invoice payments end to end through supplier portals. The agent pays only what the buyer has already approved. Instead of a shared supplier-portal login, it uses tokenised payment credentials. Billtrust uses Visa's Trusted Agent Protocol to authenticate the agent, so the agent can meet the same bot protections a human meets, such as CAPTCHAs, without a separate login for the agent. (Visa press release)

Imagined scene. Picture a supplier's accounts clerk in Kisumu who once kept a shared password in a notebook. One morning she finds an invoice paid while she slept, by a credential that was never her password.

Santander and Mastercard describe what they call Europe's first live, end-to-end payment executed by an AI agent. (Mastercard release) Judgment. Claims to a first are easy to make, so I read them as regional rather than global.

Now the caution. Published volume figures for x402 disagree, and they measure different things. Judgment. A reader who meets a single headline number should ask three things: which metric, which chain, which period.

A wallet is not a balance. It is a standing answer to the question of who may say yes, how far, and for how long.

Judgment. I believe the honest measure of this market is not the transaction count but the number of payments a human would have to explain afterwards.

A Map of the Stack, Floor by Floor

Most explanations collapse five jobs into one word, "payments." They are separate floors, and each can fail on its own.

The first floor is identity. Before an agent can pay, someone must be able to say which agent this is and who stands behind it. Visa's Trusted Agent Protocol is one answer, and the Billtrust pilot shows it authenticating an agent at a supplier's door. Verifiable Intent, co-developed with Mastercard, is an attempt to record what the agent was allowed to do, and Google's post says it is headed to FIDO too. (Google blog)

The second floor is mandate. What did the human actually allow: which merchant, what ceiling, what window of time? AP2's answer is a pre-approved instruction. Its "Human Not Present" mode makes agents useful without a person present, and it is also the mode that raises the hardest questions. (Google blog)

The third floor is conversation. A2A is the layer where agents find one another, hand over tasks and report results. Its adoption counts are what organisations say they run, not audited deployments. (PR Newswire)

The fourth floor is price and settlement, and it splits in two. On card rails, the Agentic Commerce Protocol lets a buyer's agent pass a delegated payment token and authenticate with delegated OAuth 2.0, according to Stripe's documentation. (Stripe documentation) The other side includes stablecoin settlement. The protocol the Linux Foundation now stewards, x402, sits on that side of the stack. The foundation says it lets AI agents, APIs and applications send and receive payments, with support for cards and stablecoins. (Linux Foundation)

The fifth floor is law. The US GENIUS Act is being implemented through rules still in motion, and secondary commentary gives conflicting enforcement dates, so check the primary text before quoting one. Judgment. Whether a balance an agent holds is a payment instrument or a deposit that pays yield is a product-design question, and the rules still being written will settle it. An agent may hold a balance for seconds, not months, so the answer matters most for micropayments.

Four Doors Nobody Has Closed

Authority. The question is not only whether an agent may pay, but for what, to whom, up to what amount, and until when. A pre-approved instruction answers that on paper. Judgment. I expect the first serious disputes to turn on the gap between what an agent was allowed to do and what its owner meant.

Liability. This is the sharpest of the four. Liability for purchases an agent makes is being openly debated in the payments industry. Judgment. Existing chargeback rules were written for a person at a checkout, and they do not say who bears a loss when a customer says the agent bought something they did not mean to buy.

Imagined scene. A merchant in Mombasa receives a dispute about a purchase made while her customer sat in a meeting. The customer's agent had been allowed to buy within a price band, and it did. The chargeback clerk finds a timestamp, a token and a merchant name, but no sentence in which the customer said yes to this price.

Identity and know-your-customer for agents. When the customer is a program, who is the customer? Verifiable Intent and the Trusted Agent Protocol are early attempts to answer through signed credentials. Judgment. I believe the obligation will attach to the principal, the human or company behind the agent, rather than to the code. That is a sensible answer, and many systems are not yet built to carry it.

Micropayment economics. Judgment. I believe fixed per-transaction fees on card networks make payments of three hundredths of a cent uneconomic, so a cheaper settlement rail is the obvious thing to test.

The Strongest Safe Was Not the Weak Door

Crypto custody offers a lesson for agent wallets, and it concerns where attacks happen, not the mathematics. Judgment. A signing key is only as safe as the systems and people that can ask it to sign.

An agent that holds spending authority is a long chain of software, credentials, cloud services and human operators, and every link is a door. The question moves from "is the signature secure?" to "who can make the signing service say yes?" Judgment. The custody standard agents will need is closer to an operations standard than a cryptographic one.

The Till, the PIN and the Founder's Forecast

Africa's mobile-money systems sit close to the human, where the hardest questions live. In M-PESA, for instance, the customer's PIN is the final human step, and that is the thread this section follows.

Imagined scene. Picture a shop in Nairobi at nine in the morning. A phone is held over a till, a receipt is photographed, a number fills itself in, and a thumb closes the purchase on a fingerprint sensor. The drawer slides shut. The machine proposed; a person disposed. That sequence is sensible, and it stops short of agency.

There is no public evidence that Safaricom has adopted AP2 or any agent-initiated payment protocol, or that a Kenyan bank or telco ships an agent-initiated product. The distance between a human-approved assistant and an agent that pays on its own is the distance this article is about.

Founder's forecast (judgment, not a measured figure). Mr. Derrick Macharia's view is that agent-to-agent payments are the next infrastructure layer. The forecast carries no date and no probability. The protocols are shipping. The rails are warm. The open question is who is accountable for the sentence that says yes.

Judgment. If mobile-money registration is built to tie each wallet to a named person, that anchor could be what agents need when a principal must be named, and "who is the principal?" could be answered first here.

Return, at last, to the truck in the dark. Somewhere in the morning the weather agent will ask for three hundredths of a cent again, and the fuel agent will ask its owner whether it may pay. Whoever answers, and in what words, will hold the wallet. The software can already pay. What it still lacks is someone willing to stand behind the sentence that says yes.

Editorial note: This essay expresses the founder’s ideas, developed with AI-assisted research and writing (parallel Claude Haiku 5.5 agents) and checked against the linked sources on 30 October 2026. Convictions, proposals and forecasts are identified in the text; scenes framed as imagined are illustrative.

Cover photograph / illustration: Fiona Graham (via Wikimedia Commons; originally posted on Flickr by WorldRemit). CC BY-SA 2.0. Original source. Illustrative image: an M-PESA mobile money and Equity agent counter in Nairobi, Kenya. Photograph: Fiona Graham, via Wikimedia Commons. CC BY-SA 2.0. This image does not document the events described.