AI agents now start spending almost as soon as they get a wallet. Chainalysis found that the median gap between funding an x402 wallet and its first payment shrank from 73 days in late 2025 to 18 minutes by the third quarter of 2026. Across more than 138 million transactions, software has been buying data, compute and model access with stablecoins, with no person approving each payment.
Getting agents to pay has turned out to be the easy part. The open question for agentic commerce is what happens when someone needs them to stop.
Most work on agent identity has gone into issuing credentials that show an agent was authorized. Mark Zalan, CEO at GoMining, argues that this answers the wrong question. A credential shows that permission existed at some point in the past. It says nothing about whether that permission still stands.
"The true test of any framework is revocation," Zalan says. When a person cancels an agent's mandate, every counterparty has to know immediately, or "a dead credential" keeps spending until someone notices. "Most designs I have seen handle issuance well and revocation poorly."
Abdul Rafay Gadit, co-founder and CCO at ZIGFinance, frames adoption around the same need. In his view, people need "a budget they can enforce, permission they can revoke and a clear route to resolve mistakes" before they let agents spend for them in daily life.
One answer is to stop treating authority as a record in a registry and build it into the payment itself. Zalan describes a spending cap enforced cryptographically, so that an agent cannot exceed it whatever its credential says or whether a revocation message has arrived. That is "a different kind of guarantee than a database that says it should not."
Gadit compares the model to "a corporate card with an enforceable spending policy," with transaction caps, daily budgets, approved recipients and an expiry date enforced by the wallet or payment provider. Card-industry players are reaching for similar tools. FIS, for example, has floated virtual cards issued specifically for agents and restricted by amount, merchant and time window.
Hard limits contain the damage. They do not stop a bad decision made inside the limit. A recent BeInCrypto Intelligence report documented two incidents in which a combined $281,200 went to attacker-controlled wallets before funds were recovered.
"Even an authorized agent can be manipulated by malicious instructions," says Logan Xie, leader of KuCoin AI Lab. He argues that a business system separate from the AI's own reasoning should check each payment before it executes, and that high-risk actions, or those outside predefined conditions, "should still require human confirmation."
This is why agent payments remain tiny. Most x402 payments are worth ten cents or less, and the BeInCrypto report gave institutional financial workflows a readiness score of just 12 out of 100, compared with roughly 61 for micropayments.
Zalan says the limiting factor is not technical capability. Losing a fraction of a cent to a bad counterparty barely matters. A five-figure payment to an unknown party across jurisdictions "needs settlement you can rely on and recourse you can actually use," and that is still unsolved. He adds that the underlying obstacle is "a legal and liability problem much more than an engineering one."
That distinction is also the reason for optimism. Zalan expects the question of how people delegate spending authority to software to be settled in years rather than decades. Once a workable legal framework exists, he believes "the technical solution will be available on the market in less than six months." He also expects a common standard for agent authorization to emerge within a year or two, shaped in practice by whoever processes the most agent payments.
The experts expect larger payments to start where rules and accountability are already clear. Xie points to approved business invoices. Gadit sees treasury and rebalancing within set limits, where an agent carries out a policy but "accountability stays with the people setting it."
Transaction counts have dominated the debate, but they are a weak signal. Micropayments are cheap to generate, and earlier research raised questions about artificial activity on the network. Gadit suggests a different measure: "Repeat customers and useful services will tell us more about adoption than raw transaction counts."
A second test matters as much. The next stage of agentic commerce depends on whether a person can withdraw an agent's authority as quickly and reliably as it was granted.
The next measure of agentic commerce will not be how many payments software can make. It will be whether people can trust it with larger sums, stop it when necessary, and recover their money when something goes wrong.