Controls map: spending caps, consent, revocation and 14 other controls across eight agent payment protocols

112 cells across 8 protocols: 32 native, 44 partial, 18 external, 18 none. “External” means the protocol names another party or standard for the control (a card network, a PSP, a wallet). It is not a judgment that the control is weak.

Controls map

NativeThe protocol specifies the control itself.
PartialThe protocol covers part of the control or makes it optional.
ExternalThe protocol relies on another layer (a network, PSP, wallet or standard) for the control.
NoneNothing in the protocol or its named dependencies provides the control.

The table scrolls sideways and down inside its frame. The last column is where an independent controls layer fits.

Controls by protocol. Select a cell to read its note and sources. Highlighting dims cells at other support levels.
Control	ERC-8004	x402	Visa TAP	OpenAI ACP	UCP	Stripe MPP	AP2	Mastercard Agent Pay	Where an independent controls layer fits
Agent identity verification Can the counterparty verify which agent (software and operator) is acting?									Derived from the cells: Native in Visa TAP, UCP, Mastercard Agent Pay. For ERC-8004, x402, OpenAI ACP, Stripe MPP, AP2 the control comes from outside the protocol.
Agent registration (know your agent) Must the agent be registered, reviewed or listed before it can transact?									Derived from the cells: Native in Mastercard Agent Pay. For ERC-8004, x402, Visa TAP, OpenAI ACP, UCP, Stripe MPP, AP2 the control comes from outside the protocol.
User consent capture Is the user's authorization captured in a signed, inspectable artifact?									Derived from the cells: Native in AP2, Mastercard Agent Pay. For ERC-8004, x402, Visa TAP, OpenAI ACP, UCP, Stripe MPP the control comes from outside the protocol.
Spending caps Can a maximum amount or budget be bound to the authorization?									Derived from the cells: Native in OpenAI ACP, AP2, Mastercard Agent Pay. For ERC-8004, x402, Visa TAP, UCP, Stripe MPP the control comes from outside the protocol.
Merchant or payee scoping Can the authorization be limited to named merchants or payees?									Derived from the cells: Native in x402, OpenAI ACP, Stripe MPP, AP2, Mastercard Agent Pay. For ERC-8004, Visa TAP, UCP the control comes from outside the protocol.
Time windows and expiry Do authorizations, tokens or signatures expire by design?									Derived from the cells: Native in x402, Visa TAP, OpenAI ACP, UCP, AP2, Mastercard Agent Pay. For ERC-8004, Stripe MPP the control comes from outside the protocol.
Revocation Can the user or operator cancel an authorization before it is used?									Derived from the cells: Native in UCP. For ERC-8004, x402, Visa TAP, OpenAI ACP, Stripe MPP, AP2, Mastercard Agent Pay the control comes from outside the protocol.
Step-up authentication Can the flow escalate to the human for a stronger check?									Derived from the cells: Native in OpenAI ACP. For ERC-8004, x402, Visa TAP, UCP, Stripe MPP, AP2, Mastercard Agent Pay the control comes from outside the protocol.
Replay protection Are nonces, single-use proofs or time windows enforced against replay?									Derived from the cells: Native in x402, UCP, Stripe MPP, Mastercard Agent Pay. For ERC-8004, Visa TAP, OpenAI ACP, AP2 the control comes from outside the protocol.
Receipts and evidence Does the flow produce signed receipts or evidence usable later?									Derived from the cells: Native in x402, Stripe MPP, AP2. For ERC-8004, Visa TAP, OpenAI ACP, UCP, Mastercard Agent Pay the control comes from outside the protocol.
Dispute support Are chargebacks, refunds or disputes part of the protocol?									Derived from the cells: No covered protocol is native here (5 partial, 2 external, 1 none), so this control has to come from outside the protocols.
Reputation Is there a public or shared record of counterparty behavior?									Derived from the cells: Native in ERC-8004. For x402, Visa TAP, OpenAI ACP, UCP, Stripe MPP, AP2, Mastercard Agent Pay the control comes from outside the protocol.
Monitoring signals What can a monitor observe to detect abuse while it happens?									Derived from the cells: Native in UCP, Mastercard Agent Pay. For ERC-8004, x402, Visa TAP, OpenAI ACP, Stripe MPP, AP2 the control comes from outside the protocol.
Kill switch Can an operator stop an agent's ability to transact at once?									Derived from the cells: No covered protocol is native here (2 partial, 4 external, 2 none), so this control has to come from outside the protocols.

Select a cell to read the note and sources behind it.

Controls with no native implementation in any covered protocol: Dispute support, Kill switch. These are the clearest openings for an independent controls layer.

Where an independent controls layer can act

Each protocol page lists the points in its flow where a separate policy engine, wallet guard or monitoring service can see and stop a payment. Here they are side by side, in flow order.

Before authorization

ERC-8004: Decide which agents may be hired
getSummary with a curated reviewer list, endpoint probes, /.well-known domain proof, minimum feedback from paying clients. ^{Source [1, 4]}
x402: Decide whether to pay at all: allowlists, budgets, asset and network policy.
Client policies and hooks (onPaymentRequired, onBeforePaymentCreation) and spendControls in the SDK. ^{Source [12, 23]}
Visa TAP: Approve the purchase instruction.
VIC passkey approval of the Payment Instruction before the agent fetches credentials. ^{Source [31]}
OpenAI ACP: Decide whether the agent may buy and how much
Policy on the agent platform that sets max_amount to the confirmed total and blocks categories or merchants. ^{Source [40, 44]}
UCP: Decide whether the agent may buy from this business at all.
Allowlist businesses and capability namespaces at the platform; check the intersection and the advertised handlers before create. ^{Source [50]}
Stripe MPP: Decide whether to pay: recipient allowlists, price ceilings, method preference.
Accept-Payment ordering plus a policy check on the decoded challenge; mppx extensions run before signing. ^{Source [63, 99]}
AP2: Narrow the open mandate: merchants, line items, amount range, budget, short exp.
Trusted Surface templates and policy that refuse wide constraints. ^{Source [77, 79]}
Mastercard Agent Pay: Agent registration and token scoping
Certify agents and set merchant, amount and time limits when the token is provisioned. ^{Source [86, 88]}

At signing

ERC-8004: Confirm the payee
Read getAgentWallet just before signing a payment and refuse if the token moved since the wallet was bound. ^{Source [1, 2]}
x402: Limit what a signature can do.
Short validBefore windows, low upto ceilings, wallet-level signing policies and key isolation. ^{Source [15, 16]}
Visa TAP: Choose the tag and what to cover.
The agent platform can add @method, @query and Content-Digest beyond the minimum and refuse to send consumer data to merchants the user did not pick. ^{Source [30]}
OpenAI ACP: Issue the delegated token
The PSP validates the allowance, risk signals and the request signature before returning a vault token. ^{Source [44, 100]}
UCP: Bind consent to the exact checkout.
Show the latest checkout in a trusted UI immediately before complete, or negotiate the AP2 extension so the checkout mandate covers the merchant-signed checkout. ^{Source [52, 53]}
Stripe MPP: Bound the worst case.
Small session deposits, SPT usage limits, Tempo access key limits, short expires. ^{Source [66, 67, 68]}
AP2: Decide whether the agent may close an open mandate for this checkout.
A deterministic signer that evaluates constraints itself and refuses overlapping presentations. ^{Source [77, 83]}
Mastercard Agent Pay: User mandate
The user signs Verifiable Intent L2 with constraints; a policy engine can review constraints before the user signs. ^{Source [94]}

At the edge

ERC-8004: Check the endpoint is the agent
Match the serving domain against the registration file and its /.well-known file. ^{Source [1]}
x402: Check requests before they reach the seller.
Payment middleware, CDN gateways such as Cloudflare's, and RFC 9421 agent identity in cloudflare:402. ^{Source [9, 101]}
Visa TAP: Verify agent identity and freshness.
CDN checks tag, window, nonce, key and signature, then applies bot policy. ^{Source [30, 102]}
OpenAI ACP: Accept or reject the agent at the merchant API
Bearer key checks, detached signature and timestamp checks, egress IP allowlisting, idempotency enforcement. ^{Source [38, 40]}
UCP: Filter unknown or abusive platforms.
Verify signatures, enforce pre-approved platform registries, cache and rate-limit profile fetches, and apply SSRF guards at the business edge. ^{Source [50, 51]}
Stripe MPP: Recognize and rate-limit agents.
Web Bot Auth or TAP attestation through mppx; Retry-After; 403 for policy denials after valid payment. ^{Source [63, 64]}
Mastercard Agent Pay: Agent request verification
Verify RFC 9421 signatures, nonce and window at the CDN or merchant; block unknown keys. ^{Source [86, 87]}

At settlement

x402: Screen and deduplicate before money moves.
Facilitator KYT and OFAC screening, onBeforeSettle hooks, atomic deduplication across settle workers. ^{Source [23, 24, 103]}
Visa TAP: Authorize the card payment.
Issuer and network risk decisions on the agent-specific token; Visa feeds TAP telemetry into its risk models. ^{Source [31, 36]}
OpenAI ACP: Charge the token
The merchant PSP enforces merchant_id, checkout_session_id, max_amount, currency, single use and expires_at. ^{Source [44]}
UCP: Apply payment risk checks.
PSP fraud screening and 3DS2 through the authentication extension's actions. ^{Source [59]}
Stripe MPP: Screen and reconcile.
Stripe fraud tools for Stripe-settled payments; TIP-20 policy registry allow and block lists on Tempo. ^{Source [74, 104]}
AP2: Refuse or scope the payment credential.
Credential Provider and network checks, token invalidation, budget tracking. ^{Source [77, 83]}
Mastercard Agent Pay: Network checks at authorization
Token limits, DTVC validation, Verifiable Intent constraints and cumulative budget at the network; issuer final decision. ^{Source [91, 105]}

After the fact

ERC-8004: Record outcomes
Upload feedback with proofOfPayment and call giveFeedback; monitor Transfer, URIUpdated, MetadataSet and proxy upgrades. ^{Source [1, 106]}
x402: Recover and learn.
auth-capture refunds, third-party x402r, transaction-hash receipts, contract events and x402scan monitoring. ^{Source [19, 25, 28]}
Visa TAP: Evidence and disputes.
VIC confirmations, merchant logs of verification results and ordinary card dispute rules. ^{Source [34, 35]}
OpenAI ACP: Review orders and disputes
Order webhooks with adjustments, intent traces on cancels, and platform confirmation logs. ^{Source [48, 49]}
UCP: Reconcile and detect anomalies.
Verify signed order webhooks, reconcile with GET /orders/{id}, and track adjustments. ^{Source [60, 61]}
Stripe MPP: Audit and close.
Store receipts, reconcile with chain data or the Stripe Dashboard, force-close idle channels. ^{Source [63, 67, 73]}
AP2: Prove what was approved.
Store the open, closed and receipt tuple and run the dispute verification steps. ^{Source [75, 77]}
Mastercard Agent Pay: Disputes and monitoring
Chargebacks under standard rules, intent records and Verifiable Intent chains as evidence, probability score for monitoring. ^{Source [89, 93]}

Support levels: Native, Partial, External, None. Protocols without a controls section are not listed.

Sources

ERC-8004: Trustless Agents (specification source, ERCS/erc-8004.md) (external link)Ethereum ERCs repository. Specification, primary source. Published 2026-01-25. Accessed 2026-10-11.
IdentityRegistryUpgradeable.sol (external link)erc-8004 (GitHub organization). Repository, primary source. Accessed 2026-10-11.
ERC-8226: Regulated Agent Mandate (external link)Ethereum Improvement Proposals (eips.ethereum.org). Standard, primary source. Published 2026-04-12. Accessed 2026-10-11.
ReputationRegistryUpgradeable.sol (external link)erc-8004 (GitHub organization). Repository, primary source. Accessed 2026-10-11.
Agent Reputation Guide (best practices) (external link)erc-8004 (GitHub organization). Documentation, primary source. Published 2026-01-25. Accessed 2026-10-11.
MinimalUUPSMainnet.sol (placeholder implementation for vanity proxies) (external link)erc-8004 (GitHub organization). Repository, primary source. Accessed 2026-10-11.
Extension: sign-in-with-x (external link)x402 Foundation. Specification, primary source. Published 2026-02-02. Accessed 2026-10-10.
Extension: auth-hints (external link)x402 Foundation. Specification, primary source. Accessed 2026-10-10.
Scheme: batch-settlement on cloudflare:402 (external link)x402 Foundation. Specification, primary source. Published 2026-04-15. Accessed 2026-10-10.
ERC-8004: Trustless Agents (external link)Ethereum ERCs. Standard, primary source. Accessed 2026-10-10.
Extension: http-message-signatures (external link)x402 Foundation. Specification, primary source. Published 2026-04-15. Accessed 2026-10-10.
x402Client.ts (SpendControls, DEFAULT_MAX_AMOUNT_PER_PAYMENT) (external link)x402 Foundation. Repository, primary source. Accessed 2026-10-11.
x402 repository (README, specs, SDKs, contracts) (external link)x402 Foundation. Repository, primary source. Accessed 2026-10-10.
A2A x402 extension specification v0.2 (external link)Google Agentic Commerce. Specification, primary source. Accessed 2026-10-10.
x402 Protocol Specification v2 (external link)x402 Foundation. Specification, primary source. Published 2025-12-09. Accessed 2026-10-10.
Scheme: upto on EVM (external link)x402 Foundation. Specification, primary source. Accessed 2026-10-10.
Scheme: exact on EVM (external link)x402 Foundation. Specification, primary source. Published 2025-02-23. Accessed 2026-10-10.
Scheme: exact on Lightning (lnbtc) (external link)x402 Foundation. Specification, primary source. Published 2026-09-23. Accessed 2026-10-10.
Scheme: auth-capture (external link)x402 Foundation. Specification, primary source. Published 2026-05-13. Accessed 2026-10-10.
Scheme: batch-settlement on EVM (external link)x402 Foundation. Specification, primary source. Published 2026-05-05. Accessed 2026-10-10.
x402 HTTP transport (V2) (external link)x402 Foundation. Specification, primary source. Published 2025-12-11. Accessed 2026-10-10.
Extension: offer-receipt (external link)x402 Foundation. Specification, primary source. Published 2026-03-12. Accessed 2026-10-10.
x402 docs: SDK features and parity (external link)x402 Foundation. Documentation, primary source. Accessed 2026-10-10.
Scheme: exact (network independent) (external link)x402 Foundation. Specification, primary source. Accessed 2026-10-10.
x402 docs: third-party SDKs and extensions (external link)x402 Foundation. Documentation, primary source. Accessed 2026-10-10.
ERC-8004 best practices: Reputation (external link)erc-8004. Documentation, primary source. Accessed 2026-10-10.
CDP Bazaar discovery (external link)Coinbase Developer Platform. Documentation, primary source. Accessed 2026-10-10.
x402scan repository (external link)Merit Systems. Repository, primary source. Accessed 2026-10-10.
x402 docs: Facilitator (external link)x402 Foundation. Documentation, primary source. Accessed 2026-10-10.
Trusted Agent Protocol merchant specifications (external link)Visa. Specification, primary source. Accessed 2026-10-11.
Visa Intelligent Commerce overview (Visa Developer Center) (external link)Visa. Documentation, primary source. Accessed 2026-10-11.
Visa Announces New AI, Stablecoin and Token Innovations to Power Intelligent, Programmable Commerce at Visa Payments Forum (external link)Visa. Announcement, primary source. Published 2026-06-10. Accessed 2026-10-11.
Visa and Banks Across Europe Reach the Next Phase of Agentic Commerce, Unlocking Secure Access to Merchants (external link)Visa. Announcement, primary source. Published 2026-07-02. Accessed 2026-10-11.
visa/ai VIC API client (vic-client.ts) (external link)Visa. Repository, primary source. Accessed 2026-10-11.
Agentic commerce liability is still being written (external link)Worldpay. Analysis. Published 2026-07-30. Accessed 2026-10-11.
Agentic Commerce: The Threat Landscape (external link)Visa. Analysis, primary source. Published 2025-11-20. Accessed 2026-10-11.
cf.bot_management.signed_agent field reference (external link)Cloudflare. Documentation, primary source. Accessed 2026-10-11.
RFC: Agentic Checkout, Merchant REST API (external link)Agentic Commerce Protocol project. Specification, primary source. Accessed 2026-10-11.
ACP OpenAPI, Delegate Payment, 2026-04-17 (external link)Agentic Commerce Protocol project. Specification, primary source. Accessed 2026-10-11.
Agentic Commerce (OpenAI developer documentation; full Markdown export at /commerce/llms-full.txt) (external link)OpenAI. Documentation, primary source. Accessed 2026-10-11.
Agentic Commerce Protocol website (external link)OpenAI and Stripe. Documentation, primary source. Accessed 2026-10-11.
Buy it in ChatGPT: Instant Checkout and the Agentic Commerce Protocol (external link)OpenAI. Announcement, primary source. Published 2025-09-29. Accessed 2026-10-11. Archived copy (external link).
ACP JSON Schema, Agentic Checkout, 2026-04-17 (external link)Agentic Commerce Protocol project. Specification, primary source. Accessed 2026-10-11.
ACP JSON Schema, Delegate Payment, 2026-04-17 (external link)Agentic Commerce Protocol project. Specification, primary source. Accessed 2026-10-11.
Shared payment tokens (Stripe Docs; seller and agent variants) (external link)Stripe. Documentation, primary source. Accessed 2026-10-11.
ACP rfcs directory (status lines of all 15 RFCs) (external link)Agentic Commerce Protocol project. Specification, primary source. Accessed 2026-10-11.
RFC: Delegate Authentication (external link)Agentic Commerce Protocol project. Specification, primary source. Accessed 2026-10-11.
ACP OpenAPI, Agentic Checkout Webhooks, 2026-04-17 (external link)Agentic Commerce Protocol project. Specification, primary source. Accessed 2026-10-11.
RFC: Intent Traces (external link)Agentic Commerce Protocol project. Specification, primary source. Accessed 2026-10-11.
UCP Official Specification overview (v2026-08-25) (external link)UCP Authors. Specification, primary source. Published 2026-08-25. Accessed 2026-10-11.
UCP Message Signatures (v2026-08-25) (external link)UCP Authors. Specification, primary source. Published 2026-08-25. Accessed 2026-10-11.
Checkout Capability (v2026-08-25) (external link)UCP Authors. Specification, primary source. Published 2026-08-25. Accessed 2026-10-11.
AP2 Mandates Extension (v2026-08-25) (external link)UCP Authors. Specification, primary source. Published 2026-08-25. Accessed 2026-10-11.
Release v2026-08-25 (external link)UCP Authors. Announcement, primary source. Published 2026-08-25. Accessed 2026-10-11.
checkout.json schema (v2026-08-25) (external link)UCP Authors. Specification, primary source. Published 2026-08-25. Accessed 2026-10-11.
Agentic Payments integration with UCP (external link)Adyen. Documentation, primary source. Published 2026-10-09. Accessed 2026-10-11.
payment_ap2_mandate.json (v2026-08-25) (external link)UCP Authors. Specification, primary source. Published 2026-08-25. Accessed 2026-10-11.
Identity Linking Capability (v2026-08-25) (external link)UCP Authors. Specification, primary source. Published 2026-08-25. Accessed 2026-10-11.
Payment Authentication extension (v2026-08-25) (external link)UCP Authors. Specification, primary source. Published 2026-08-25. Accessed 2026-10-11.
order.json, fulfillment_event.json, adjustment.json schemas (v2026-08-25) (external link)UCP Authors. Specification, primary source. Published 2026-08-25. Accessed 2026-10-11.
Order Capability (v2026-08-25) (external link)UCP Authors. Specification, primary source. Published 2026-08-25. Accessed 2026-10-11.
Frequently Asked Questions, Google UCP Guide (external link)Google. Documentation, primary source. Accessed 2026-10-11.
The "Payment" HTTP Authentication Scheme (draft-httpauth-payment-01, repository source) (external link)Tempo Labs and Stripe (B. Ryan, J. Moxey, T. Meagher, J. Weinstein, S. Kaliski). Specification, primary source. Published 2026-09-09. Accessed 2026-10-11.
Expanding identity support in mppx (MPP blog) (external link)Tempo Labs (mpp.dev). Announcement, primary source. Published 2026-08-12. Accessed 2026-10-11.
Card Network Charge Intent for HTTP Payment Authentication (draft-card-charge-00) (external link)Visa (J. Brans). Specification, primary source. Accessed 2026-10-11.
Stripe Charge Intent for HTTP Payment Authentication (draft-stripe-charge-00) (external link)Stripe and Tempo Labs. Specification, primary source. Accessed 2026-10-11.
Tempo Session Intent for HTTP Payment Authentication (draft-tempo-session-00) (external link)Tempo Labs. Specification, primary source. Accessed 2026-10-11.
Tempo Subscription Intent for HTTP Payment Authentication (draft-tempo-subscription-00) (external link)Tempo Labs. Specification, primary source. Accessed 2026-10-11.
Subscription Intent for HTTP Payment Authentication (draft-payment-intent-subscription-00) (external link)Tempo Labs. Specification, primary source. Accessed 2026-10-11.
Charge Intent for HTTP Payment Authentication (draft-payment-intent-charge-00) (external link)Tempo Labs. Specification, primary source. Accessed 2026-10-11.
Stripe docs: Stablecoin payments (external link)Stripe. Documentation, primary source. Accessed 2026-10-11.
Service Discovery for HTTP Payment Authentication (draft-payment-discovery-01) (external link)Tempo Labs and Merit Systems. Specification, primary source. Accessed 2026-10-11.
MPPscan, the Machine Payments Protocol Explorer (site and stats API) (external link)Merit Systems. Dataset, primary source. Accessed 2026-10-11.
Introducing the Machine Payments Protocol (Stripe blog) (external link)Stripe. Announcement, primary source. Published 2026-03-18. Accessed 2026-10-11.
AP2 Agent Authorization (external link)Google (google-agentic-commerce). Specification, primary source. Published 2026-04-28. Accessed 2026-10-11.
AP2 Implementation Considerations (external link)Google (google-agentic-commerce). Specification, primary source. Published 2026-04-28. Accessed 2026-10-11.
Agentic Payment Protocol (v0.2) specification (external link)Google (google-agentic-commerce). Specification, primary source. Published 2026-04-28. Accessed 2026-10-11.
AP2 Flow Examples (external link)Google (google-agentic-commerce). Specification, primary source. Published 2026-04-28. Accessed 2026-10-11.
AP2 JSON Schema: Open Payment Mandate (external link)Google (google-agentic-commerce). Specification, primary source. Published 2026-04-28. Accessed 2026-10-11.
AP2 JSON Schema: Open Checkout Mandate (external link)Google (google-agentic-commerce). Specification, primary source. Published 2026-04-28. Accessed 2026-10-11.
AP2 JSON Schema: Payment Mandate (external link)Google (google-agentic-commerce). Specification, primary source. Published 2026-04-28. Accessed 2026-10-11.
AP2 specification at tag v0.1.0 (external link)Google (google-agentic-commerce). Specification, primary source. Published 2025-09-16. Accessed 2026-10-11.
AP2 Security and Privacy Considerations (external link)Google (google-agentic-commerce). Specification, primary source. Published 2026-04-28. Accessed 2026-10-11.
Zero-Trust Runtime Verification for Agentic Payment Protocols: Mitigating Replay and Context-Binding Failures in AP2 (external link)arXiv. Paper, primary source. Published 2026-02-06. Accessed 2026-10-11.
AP2 JSON Schemas: Payment Receipt and Checkout Receipt (external link)Google (google-agentic-commerce). Specification, primary source. Published 2026-04-28. Accessed 2026-10-11.
Level 1 Agentic Commerce: Enable Agent Support with Minimal Changes (external link)Mastercard Developers (Merchant Cloud tutorials). Documentation, primary source. Accessed 2026-10-11.
Securing agentic commerce: helping AI Agents transact with Visa and Mastercard (external link)Cloudflare Blog. Announcement, primary source. Published 2025-10-24. Accessed 2026-10-11.
The Rails for Agentic Commerce (external link)Mastercard Developers (Merchant Cloud tutorials). Documentation, primary source. Accessed 2026-10-11.
Mastercard Advances Agentic Commerce With New Trust and Intelligence Services (external link)Mastercard (Investor Relations, Business Wire release). Announcement, primary source. Published 2026-09-30. Accessed 2026-10-11.
Mastercard advances agentic payments in Latin America and the Caribbean with live transactions completed across the region (external link)Mastercard Newsroom. Announcement, primary source. Published 2026-03-24. Accessed 2026-10-11.
Verifiable Intent (VI): Specification Overview, version 0.1-draft (external link)agent-intent (Verifiable Intent Working Group). Specification, primary source. Published 2026-02-18. Accessed 2026-10-11.
Verifiable Intent: Constraint Type Definitions and Validation Rules (external link)agent-intent (Verifiable Intent Working Group). Specification, primary source. Published 2026-02-18. Accessed 2026-10-11.
Level 3 Agentic Commerce: Advanced Programmatic Checkout (external link)Mastercard Developers (Merchant Cloud tutorials). Documentation, primary source. Accessed 2026-10-11.
Verifiable Intent: Credential Format Specification, version 0.1-draft (external link)agent-intent (Verifiable Intent Working Group). Specification, primary source. Published 2026-02-18. Accessed 2026-10-11.
Verifiable Intent: Security Model and Threat Analysis, version 0.1-draft (external link)agent-intent (Verifiable Intent Working Group). Specification, primary source. Published 2026-02-18. Accessed 2026-10-11.
Mastercard Developers llms.txt service index (external link)Mastercard Developers. Dataset, primary source. Accessed 2026-10-11.
Mastercard Virtual Card Tokens (external link)Mastercard Developers (Checkout Solutions). Documentation, primary source. Accessed 2026-10-11.
Mastercard Unveils Agent Pay, Pioneering Agentic Payments Technology to Power Commerce in the Age of AI (external link)Mastercard (Investor Relations, Business Wire release). Announcement, primary source. Published 2025-04-29. Accessed 2026-10-11.
wevm/mppx repository (README, src, SECURITY.md) (external link)wevm. Repository, primary source. Accessed 2026-10-11.
RFC: Agentic Commerce, Delegate Payment (external link)Agentic Commerce Protocol project. Specification, primary source. Accessed 2026-10-11.
Monetization Gateway beta (external link)Cloudflare. Announcement, primary source. Published 2026-09-30. Accessed 2026-10-10.
Securing agentic commerce: helping AI Agents transact with Visa and Mastercard (external link)Cloudflare. Analysis, primary source. Published 2025-10-24. Accessed 2026-10-11.
CDP x402 facilitator docs (pricing, networks, KYT and OFAC) (external link)Coinbase Developer Platform. Documentation, primary source. Accessed 2026-10-10.
Tempo docs: TIP-20 specification and overview (external link)Tempo Labs. Specification, primary source. Accessed 2026-10-11.
Mastercard Virtual Card Tokens: Making Payments (external link)Mastercard Developers (Checkout Solutions). Documentation, primary source. Accessed 2026-10-11.
On-chain reads of the ERC-8004 proxies (owner, getVersion, ERC-1967 implementation slot) on Ethereum and Base (external link)Atlas research (eth_call through public RPCs). Dataset, primary source. Accessed 2026-10-11.