Two of the sharpest voices in this space are saying opposite things, and both are right.
Meta's Ginger Baker reportedly said during the Stripe event that "payments will pivot from being a moment to being a policy" — people will set rules for their agents and then step out of direct oversight entirely. Pantera, meanwhile, warns that without verifiable autonomy, "on-chain AI may scale faster than trust."
The first describes the product everyone is shipping. The second describes the load-bearing thing that hasn't shipped. Hold both, and you can see the whole agentic-payment stack clearly.
Payments becoming policy describes the product everyone is shipping; verifiable autonomy describes the load-bearing thing that hasn't shipped yet.
Start with what the machines can now be told to do.
Open MetaMask's Agent Wallet documentation and the prompt menu reads like a trading desk handed to a chatbot: "Open a 5x long on BTC with $100 on Hyperliquid." "Bet 10 USDT on YES for BTC 5-min price up." "Supply 100 USDC to a yield vault on Base." "Book and Pay for my flight ticket at api.example.com."
In the default Guard Mode, anything outside a pre-approved allowlist, or above a spending cap, pauses for 2FA sign-off. The human stays in the loop.
Then there's Beast Mode.
Beast Mode drops the allowlist. The agent trades freely, no approval prompts, with real-time threat scanning as the only tripwire — though spending caps and a malicious-transaction 2FA backstop still apply.
That is the moment the human leaves the loop. And it forces the question the rest of the stack is quietly answering: when nobody approves the payment, what moves the money, and who eats the loss?
The instinct is to read this as a standards war — four payment protocols circling, one eventual winner. That instinct is wrong.
What's actually forming is a layered stack. At the top sits the capability layer: Anthropic's MCP gives an agent tools and context, Google's A2A lets agents discover and talk to each other. Both are, per Sandmark, open specifications handed to the Linux Foundation, which is precisely what makes rivals willing to build on them — once given away, they can't be closed, charged for, or steered by one company.
Below that is where money moves, and here four families claim the job: Google's AP2, the Stripe/OpenAI ACP, Coinbase's x402, and the network agentic tokens from Visa and Mastercard.
They compose more than they compete. AP2 is a chain of signed mandates — Intent, Cart, Payment — that proves exactly what a human authorized, on any rail. ACP is a checkout-centric standard riding existing card rails; it's the machinery behind ChatGPT Instant Checkout. Network tokens keep the trust anchor inside the card networks.
The mistake is treating these as interchangeable, because they split cleanly on the one axis that decides where crypto demand lands: settlement finality and dispute rights.
ACP and network tokens ride card rails, which means card economics and card chargeback rights come along for free — valuable exactly where a consumer expects recourse. AP2 inherits disputes from whatever rail its mandate points at.
x402 is the outlier. It revives HTTP's dormant 402 Payment Required status so a server can demand payment inline, and it settles onchain in stablecoins. Transfers are final. There are no chargebacks. And protocol fees are effectively zero.
That last property is not a footnote — it's the whole thesis. As the framing goes, per Pratik Dhanave, x402 works for "payments too small for card interchange to make sense."
Now look at what agents actually generate. An agent booking a trip might check a flight price, a weather feed, and a currency rate before it commits — three purchases where a human would have made none, each worth a fraction of a cent.
Card networks were never built to carry a payment that small. Interchange is a floor, and machine-speed, sub-cent, high-frequency micropayments live entirely beneath it.
That is the structural point. The rail built for the payments agents produce is the one that settles in stablecoins with finality and no chargeback. Agentic commerce, in the machine-to-machine layer where the volume actually accrues, is a stablecoin demand engine — not by ideology, but by fee arithmetic.
And it's not theoretical. MetaMask's Agent Wallet already exposes x402 payments as a first-class capability — "Pay for HTTP 402 paywalled APIs and endpoints" — alongside Hyperliquid perps, Polymarket bets, and Aave lending, all denominated in stablecoins. The demand surface is USDC and USDT, not fiat.
So the money layer shipped. That's the Baker half of the picture — payments becoming policy, agents acting under rules.
The problem is the layer underneath it. Sandmark's map of the agentic-finance stack has four floors: connection, identity, custody, and rail. Connection settled first with MCP. The rails are running — x402 reportedly passed to a Linux Foundation body that went operational on 14 July with 40 members.
Identity did not settle.
ERC-8004, the open onchain registry meant to let a wallet check what an agent is and what it's allowed to do before it pays anyone, remains a draft. And the wallets that would read those records before signing haven't finished adding support.
Meanwhile the agents keep multiplying. 8004scan, the public tracker AltLayer built for that registry, reportedly listed more than 364,000 agents on 28 July — roughly double its early-May count.
That is the gap in one line. The registry doubled its population while the standard that governs it is still a proposal, and no wallet reads it yet. This is precisely what Pantera means by on-chain AI scaling faster than trust.
The card networks did not wait. Visa's Trusted Agent Protocol reportedly went live on 14 October with 12 partners; Mastercard's Agent Pay reached full US rollout the month after. Both let a merchant check an agent against the network's own records rather than a public one.
That is the quiet strategic move: on the card side, identity and settlement are bundled and the network eats the dispute. On the onchain side, settlement shipped first and identity is a draft — which leaves the risk unallocated.
Which brings the whole thing back to Beast Mode.
When a Beast Mode agent misfires — a bad prompt, a poisoned tool response, a market it never should have touched — there is no chargeback, because the stablecoin rail is final by design. That's the feature. It's also the exposure.
The entire consumer backstop is MetaMask's Transaction Protection: up to $10,000 a month in loss coverage on eligible transactions, sitting behind simulation, Blockaid threat scanning, and MEV protection.
Compare that to the card side, where a misfire routes into a decades-old chargeback and consumer-protection regime. On the onchain rail, a monthly coverage cap is the recourse. That is a fundamentally different risk allocation, and it is the one that scales with agentic volume.
Custody narrows the blast radius but doesn't close the gap. Coinbase's agentic wallets never assemble the whole private key — it's split via multi-party computation inside a sealed AWS enclave, with spending rules checked before any signature. Stripe hands the agent a single-use token so there's no key to misuse at all. Good scoping means a leak costs one payment, not a wallet.
But scoping the key doesn't answer whether the agent was allowed to act. That's an identity-and-authorization question, and it lives on the floor that's still a draft.
So the stablecoin thesis is real, and it is stronger than a price narrative because it rests on fee arithmetic rather than sentiment: the payments agents generate are too small for card rails, and x402's final, near-zero-fee stablecoin settlement is the only rail built to carry them.
But the risk allocation underneath that demand is unresolved. The money moves with finality before the layer that proves who moved it — and under what authority — has shipped.
Baker's world and Pantera's warning are the same world. Payments are becoming policy faster than the primitives that would make policy verifiable. The demand engine is real. The trust layer is a draft. And on a final rail, that ordering is the entire risk.