On October 20, 2026, four of the largest banks in the United States did nothing at all. That was the news. JPMorgan, Bank of America, Citigroup and Schwab declined to authorize AI agents to move customer money. Not a pilot. Not a gated beta. A hard block, announced into the teeth of the industry's biggest payments conference, while every vendor on the floor was selling the opposite future.
Within forty-eight hours the counter-moves landed. Wells Fargo did not build anything. It rewrote Section 15 of its deposit agreement, pre-authorizing agent transactions while retaining the right to withdraw that authorization at will, and assigning the risk of a misfiring agent to the customer. Visa shipped a Trusted Agent Protocol backed by an Agentic Directory. Mastercard published Agent Pay for Machines and a Verifiable Intent framework with buyer-side and seller-side API specs. Sierra and Meta dropped a draft Personal Agent Protocol. Evervault put a price on a permission: twenty-five cents per card session, fifteen-minute expiry.
Here is the part that should stop you cold. Almost none of this is a blockchain story. There is no token to buy, no float to model, no emission schedule to stress-test. And yet it arrived in my inbox tagged as Web3 infrastructure, which is itself the most instructive data point in the entire bundle. What follows is an attempt to read the structure honestly, including the parts the structure does not want read.
Agentic commerce needs almost nothing from intelligence and almost everything from permission. The models can already plan, negotiate and execute. What they cannot do is sign. An agent that books a flight has no legal identity, no credit history, no capacity to be sued, and no way to prove to a merchant that a human being upstream actually wanted the flight booked. Every architectural decision in this space is an answer to that single gap, and every commercial decision is an attempt to own the answer.
The credential is the load-bearing wall. Authentication asks who you are. Authorization asks what you may do, for how long, on whose behalf, and who eats the loss when it goes wrong. The second question is the expensive one, and it is the question nobody in October 2026 wanted to answer in writing.
I have watched this movie. In 2017 I read through more than five hundred Ethereum-based ICO whitepapers with a software engineer's eye, checking technical feasibility against marketing copy, and roughly eighty-five percent of them had no roadmap that survived contact with a compiler. I predicted the crash and got called a cynic for six months. The lesson I took was not about tokens. It was about issuance. The projects that mattered were never the ones with the best story; they were the ones that controlled who could mint the claim. 2017 called. It wants its lessons back.
Because the same question is back in a new suit. Who issues the credential? Who can revoke it? Who prices it? And the answer, across every player in this bundle, is the same: somebody upstream of the money, not somebody inside the transaction. The toll booth moved upstream, and almost nobody noticed the relocation.
What has actually formed is a three-layer authorization stack, and reading the announcements as separate products is the fastest way to miss it. Layer one is issuance, held by banks and card networks. Layer two is scoping, held by agent protocols. Layer three is metering, held by payment infrastructure. Each layer is being contested by a different kind of institution with a different kind of leverage, and the layers do not yet talk to each other.
Start with Wells Fargo, because it is the most honest of the four. There is no protocol. There is a contract clause. Pre-authorize the agent, retain the right to pull the switch, and treat anything the agent does as though the customer did it personally. That is a legal-layer authorization mechanism wearing an infrastructure costume, and it is the purest expression of the bank's actual position: the switch stays in the building. Structure beats speculation every time, and the structure here says the bank intends to be the veto holder, not the standard setter.
Visa's answer is registration. A Trusted Agent Protocol, an Agentic Directory, and tokenized credentials that only registered agents can present. It is a gated directory model, which is to say it is a licensing regime with better marketing. The card networks have spent fifty years learning that the profitable position is not issuing credit or holding deposits but sitting in the middle and taking a basis point from every message. An agent registry is the same instinct applied to a new message type. Mastercard is running the identical play with Agent Pay for Machines and Verifiable Intent, adding the one thing Visa did not: a disclosed developer surface, with buyer and seller API specifications, an SDK, and a sandbox. It is the only player in the bundle that has shown its integration path. It has also, notably, not gone commercial, and access to general standards is by application only.
Sierra and Meta are playing a different game entirely. Their Personal Agent Protocol converts the binary switch into a permission spectrum: blocked, search, view, act with approval, full access. That is a genuinely better design than a yes/no gate, because agent authority in the real world is graded, not boolean. But read the spec closely. Payments are deliberately excluded from the core standard. A draft that grades permissions on five axes and then carves out the one axis where money moves is not an oversight. It is a jurisdiction decision, and it leaves the expensive, regulated, liability-laden part of the problem with the banks and the card networks. The protocol is designed to reach 1.0 without ever having to answer Rick Wurster's question.
Evervault went the other direction and shipped something rigid on purpose. Browser Tokens are minted with a host allowlist baked in at creation, valid for fifteen minutes, and non-extensible afterward. You cannot widen the permission after the fact. That is a security posture, and it is also a commercial one, priced at twenty-five cents per card session. It is the only explicit price tag in the entire bundle, and it is the most important number here. Sierra's integration with Stripe takes the opposite tack, routing the digital payment so the agent sees only the status and the last four digits. Information isolation as an authorization strategy. Elegant. Undocumented at the boundaries.
Now the semantic trap, because it is where most of the analysis I have read goes wrong. The phrase "tokenized credentials" appears in Visa's materials, in Evervault's materials, and in Mastercard's. None of it has anything to do with tokenomics. There is no issuance event, no circulating supply, no staking, no burn, no incentive curve, no reflexive flywheel. The word token here means access token in the OAuth sense, and the closest Web3 relative is a verifiable credential, which is a different lineage entirely. Anyone mapping supply schedules and emission models onto a fifteen-minute browser token is doing astrology with a spreadsheet. The only defensible analogy is that an authorization credential is a property record, and property records that cannot be transferred behave nothing like assets that can.
What is genuinely new is the fee surface. In the old architecture, the toll was collected at the transaction: interchange, processing, settlement. In this architecture, the toll is collected at the permission. Evervault charges per card session. The card networks want to charge for registry presence and credential validation. The banks want to charge for the privilege of being allowed to ask. That fee is upstream of volume, recurring regardless of whether the agent buys anything, and priced per authorization rather than per dollar moved. Value capture has migrated from the transaction to the authorization, and that migration is the entire investment thesis. It is also why the four banks blocking agents and the two card networks embracing them are not actually in conflict. Both are positioning to own the same toll booth from different sides of the road.
What is missing is more alarming than what is present. Across every scheme in this bundle, not one discloses an independent security audit. Not one publishes source for review. These are credentials that will authorize machine-initiated money movement at scale, and they are being shipped with the assurance posture of a consumer photo app. Based on my audit experience, this is the exact shape of a pre-incident system: clean architecture diagrams, a pilot announcement, a completion rate, and no threat model. I have seen this silhouette before, in 2017 and again in 2020, and it has never once aged well.
The responsibility vacuum is the other structural hole, and it is bigger. Wurster asked the only question that matters: who is liable? Wells Fargo's answer, encoded in a contract clause, is that the customer is. That is not a liability framework; it is a liability transfer, executed unilaterally, in an agreement nobody reads. Consumer protection regulators have historically taken a dim view of clauses that shift all fault to the weaker party, and this one will be tested. Worse, KYC and AML responsibility for agent-initiated payments is entirely undefined in every document I reviewed. No named party. No procedure. No sanctions screening model. When an autonomous agent starts moving money across borders, that gap stops being an abstraction and becomes an enforcement action.
The data deserves the same skepticism. A seventy-one point three percent task completion rate is a headline number with no published methodology, no sample definition, no failure taxonomy. A Visa release was reportedly inaccessible. Mastercard's general access standards are not public. In an environment where the only quantitative claims come from parties with a commercial interest in those claims being large, the correct posture is to treat every number as a marketing artifact until someone independent reproduces it.
And the directories are already fragmenting. Each network stands up its own registry. Each bank reserves its own veto. An agent that wants to transact broadly will eventually have to register with multiple card networks, satisfy multiple bank-side contracts, and reconcile multiple permission models that use different vocabularies for the same five states. That is not interoperability. That is a compliance maze with a developer experience problem stapled to the front.
Which brings me to the consensus view, and why I think it is wrong. The prevailing fear is that agents get too much autonomy and do something catastrophic. That is the wrong tail. The binding constraint on agentic commerce is not excess permission; it is permission so heavily conditioned that volume never arrives. Read the actual architecture: a five-state permission spectrum, a bank veto, a fifteen-minute credential that cannot be extended, an information-isolated payment rail, and a contract that assigns fault to the user. That is not an enabling environment. That is a leash with a receipt. Agentic commerce does not fail because agents go rogue. It fails because agents never get enough authority to be worth integrating, and the infrastructure spend never amortizes.
The second consensus error is that fragmentation is a temporary inefficiency that the market will resolve. Fragmentation is not a bug here. It is the product. Standards converge when a single party's revenue depends on convergence, and in this stack every incumbent's revenue depends on being the exception. Visa and Mastercard both moved within forty-eight hours of each other, which tells you they had each other's calendars. That is not coordination toward a standard. That is a land grab timed to the same conference.
And the third error is ours. The reflexive instinct to relabel every fintech authorization story as Web3 infrastructure, because credentials sound like tokens and registries sound like chains, has produced a small industry of analysts writing about decentralization mechanisms that do not exist in the documents they are analyzing. If you are tracking decentralized identity, this bundle is useful as a control group, not as a thesis. It shows you precisely what a fully centralized authorization layer looks like when competent institutions build it: fast, well-capitalized, contractually enforced, and structurally closed.
The signals worth watching over the next two quarters are narrow and specific. Whether Visa and Mastercard recognize each other's registries, which would be the first genuine sign of convergence. Whether a US regulator challenges the risk-shifting clause in a deposit agreement, which would reset the liability framework overnight. Whether the four blocking banks move from refusal to participation, which would tell you the veto was a negotiating position rather than a principle. Whether the Personal Agent Protocol reaches 1.0 with payments still carved out, which would confirm that the AI platforms have no intention of owning the hard part. And whether any single scheme publishes an audit.
One question should sit under all of it. If the switch on the agent economy lives in a bank's contract, a card network's directory, and a fifteen-minute credential priced at twenty-five cents, then who exactly is decentralizing what, and to whom are they selling it?
Structure beats speculation. The structure says the toll booth is upstream, the switch is centralized, and the receipt is already in the mail.