Agent Spending Without Controls - Rodrigo Coelho & Pranav Maheshwari, Edge & Node

Agentic commerce requires a new payment and compliance infrastructure layer (Ampersend) because traditional payment rails and controls were built for humans,...

By Sean Weldon

Agent Spending Without Controls: Toward a Compliance Layer for Agentic Commerce

Abstract

Autonomous software agents are beginning to transact independently, purchasing data, tool access, and physical goods at machine speed. This synthesis examines the argument that existing payment rails and compliance controls - designed around a human decision-maker in the loop - are structurally inadequate for this emerging agentic commerce regime, and that a dedicated payment-and-compliance infrastructure layer is required. Drawing on the operational history of a decentralized data-indexing network that has served 1.8 trillion queries and pioneered query-level micropayments, the analysis traces the lineage from early micropayment research to the x402 specification and Circle's nanopayments, then evaluates three demonstrated capabilities: paid Model Context Protocol (MCP) tool access, agentic checkout via Shopify's Universal Commerce Protocol (UCP), and wallet-level sanctions screening. Findings indicate that compliance screening, not payment execution, is the binding constraint on enterprise adoption. Practical implications include the need for bilateral (buyer- and seller-side) screening and programmatic spend controls.

1. Introduction

The infrastructure of electronic payments has evolved over more than three decades, from the first electronic transaction in 1981 through the emergence of online e-commerce to the present agent economy, in which large language model (LLM)-driven agents initiate and settle transactions without direct human authorization of each event. This transition alters the fundamental assumptions of the payment stack rather than merely changing its interface.

Two terms structure the analysis. Agentic commerce denotes economic transactions initiated, negotiated, and settled by autonomous software agents. The Model Context Protocol (MCP) is the interface standard through which agents access external tools and data sources, characterized in the source material as the mechanism by which "agents become super powerful."

The central thesis is that agentic commerce requires a new payment and compliance infrastructure layer - instantiated here as Ampersend - because traditional financial rails were constructed for human actors operating on human timescales. As stated in the source material, "all these controls and policies and rules were built for humans and not for machines that don't breathe." The remainder of this synthesis establishes the technical lineage of agentic micropayments (§2), analyzes the structural failure modes of legacy rails and the resulting compliance gap (§3), extracts implementation-level findings from three demonstrations (§4), and discusses adoption trajectories and open questions (§5-§6).

2. Background and Related Work

The intellectual foundations of agent-to-agent payments predate the current wave of interest in agentic AI. Edge and Node, the team behind The Graph Protocol - a decentralized blockchain data-indexing network operating since 2018 - has historically served 1.8 trillion queries of onchain data. Because query serving is a high-frequency, low-value service, its economics required per-query settlement rather than invoicing, prompting the team to develop a micropayment system for queries in 2021. Notably, the team referenced the x402 specification in a published blog post before that specification formally existed.

Coinbase subsequently released x402 as a formal payment specification shortly thereafter. Edge and Node collaborated with the Coinbase and Google teams and joined the x402 foundation. In parallel, Circle released a comparable initiative under the name nanopayments, targeting the same design space of sub-cent transfers. Edge and Node contributed batching protocol prior art - a technique that aggregates many small transfers into fewer settlement events to amortize gas fees - an essential precondition for economically viable nanopayments at scale. This lineage establishes that the technical substrate for agent-speed micropayments predates, and directly informed, current industry standards.

3. Core Analysis

3.1 The Expanding Agentic Commerce Landscape

A market map referenced in the source material shows a proliferating ecosystem of companies building infrastructure, payment protocols, and governance tooling for agentic commerce. Transaction volume routed over x402 is reported to be growing, though adoption remains early-stage and largely experimental - exemplified by retail payment tests such as OpenClaw - rather than enterprise-grade. This distinction between experimental volume and production-grade enterprise deployment frames the remainder of the analysis: the missing ingredient is not transactional capability but institutional confidence.

3.2 Structural Failure of Human-Centric Payment Rails

Traditional financial rails presuppose a human in the decision loop: a cardholder authorizing a purchase, a compliance officer reviewing a wire transfer, a fraud analyst flagging an anomaly. These controls assume decision latency measured in seconds to days and transaction cadences bounded by human attention. Agents, by contrast, transact at machine speed, with microsecond timing and continuous, around-the-clock operation. This mismatch breaks the assumptions underlying existing policy design, since controls calibrated to human decision cadence cannot meaningfully intervene in a stream of sub-second agent-initiated transactions. Given that global finance operates at near-quadrillion-dollar scale, enterprises require a compliance layer as a precondition for adopting agentic payments at all.

3.3 The Compliance Gap as the Binding Constraint

Enterprise adoption is gated less by payment execution than by unresolved compliance questions: whether a counterparty is a sanctioned entity, whether it has been implicated in terrorist financing, and what identity underlies a given wallet address. Agentic systems typically expose only a wallet address, without any of the background information a traditional know-your-customer process would supply, creating a structural compliance gap. Ultimately, a human authority - a Chief Legal Officer or Chief Policy Officer - must sign off on agentic spending programs, and doing so requires confidence that agents will not hallucinate, overspend, or violate policy. The stakes are material: compliance failures can produce fines ranging into the tens, hundreds, or billions of dollars. The source material concludes that governance and infrastructure have not yet caught up with the pace of agentic commerce innovation, positioning compliance tooling - not payment rails per se - as the binding constraint on adoption.

4. Technical Insights

Three demonstrations illustrate the practical architecture of the proposed infrastructure layer.

Paid MCP tool access. Many of the most capable MCP servers (e.g., Exa, Firecrawl) are paid and typically require manual credit card setup unless accessed through an aggregator. Ampersend supplies a skill file that agents such as Claude Code can install to access an aggregated marketplace of paid MCP tools with integrated payment execution. In a comparative demonstration, an agent lacking the skill file could only guess at an email address format, whereas an agent equipped with the skill file retrieved specific contact and social media details by autonomously executing a small background payment to a premium MCP endpoint. This supports the claim that "your agent is as powerful as the paid MCP tools that you're connected to it and if you've given it a payment trail."

Agentic checkout via Shopify UCP. A second demonstration used Shopify's Universal Commerce Protocol (UCP) to complete an agentic purchase of a Father's Day gift under a $10 budget. The agent located a product, confirmed the order, and completed payment (approximately $9-$11) autonomously through the Ampersend wallet, retaining memory of user preferences to avoid repeated entry of name, address, or payment details. Separately, Cloudflare is reported to be opening its gateway to x402-based agentic payments, enabling bots crawling websites to pay microtransactions rather than relying solely on advertising for monetization - a structurally distinct but complementary application of the same payment rail.

Compliance simulation. A third demonstration compared a "good bot" wallet with a "bad bot" wallet simulating a sanctioned (North Korean) entity. Without compliance screening enabled, both wallets completed transactions, including a sub-cent payment for scraped website data. After enabling compliance screening via TRM Labs wallet-address scanning, the bad bot's transactions were blocked and denied for appearing on a blocklist. This demonstrates that compliance screening must be implemented on both buyer and seller sides for merchants to safely accept agentic payments, since a seller-side check alone cannot prevent a compromised buyer agent from initiating a sanctioned transaction, and vice versa.

5. Discussion

These findings suggest that the primary innovation frontier in agentic commerce has shifted from payment execution - now reasonably well solved via x402, nanopayments, and batching protocols - to compliance and identity infrastructure. The observation that "merchants will not take payments if they think this order is being placed by a North Korean wallet" captures a broader dynamic: absent verifiable identity and sanctions status behind a wallet address, rational merchants will decline agentic transactions regardless of technical payment capability.

This raises open questions not fully resolved in the source material. First, how should identity attestations be constructed and maintained for agent wallets without reintroducing the latency and friction of human-centric KYC? Second, what governance model determines acceptable spend authority - per-transaction limits, cumulative budgets, category restrictions - and how are these policies encoded and audited programmatically rather than manually? Third, as the assertion that "agents need commerce more than humans need commerce" suggests, agent-native commerce may generate qualitatively different transaction patterns (e.g., continuous micropayments for data access) that existing compliance frameworks, built around discrete human purchases, are not designed to evaluate.

These questions connect to broader industry trends: the parallel emergence of Circle's nanopayments, Cloudflare's gateway integration, and Shopify's UCP indicates that multiple large infrastructure providers are independently converging on the need for agent-native payment rails, even as compliance tooling (exemplified here by TRM Labs integration) lags behind.

6. Conclusion

This synthesis has argued that agentic commerce is constrained less by the availability of payment rails than by the absence of a compliance layer capable of operating at machine speed and machine scale. The historical lineage from The Graph Protocol's 2021 micropayment research through x402 and Circle's nanopayments demonstrates that the technical substrate for agent-speed settlement is mature. The demonstrated capabilities - paid MCP tool access, UCP-based agentic checkout, and TRM Labs-based sanctions screening - indicate that a practical, bilateral compliance architecture is achievable today.

The practical takeaway for enterprises evaluating agentic payment adoption is that compliance screening, spend policy enforcement, and identity verification should be prioritized alongside, not after, payment integration. Future work should address programmatic policy encoding and cross-platform identity standards for agent wallets as prerequisites for enterprise-grade adoption at scale.

Sources

About the Author

Sean Weldon is an AI engineer and systems architect specializing in autonomous systems, agentic workflows, and applied machine learning. He builds production AI systems that automate complex business operations.

LinkedIn | Website | GitHub