Agent Economy & Interop Protocols

Authorizes agent-initiated purchases through a chain of cryptographically signed, verifiable-credential mandates instead of handing an agent raw card details. An Intent Mandate captures the user's up-front constraints (max price, allowed merchants, time-to-live) so the agent can buy while the user is not present; a Cart Mandate is merchant-signed and user-co-signed for the exact items and price, giving what-you-see-is-what-you-pay; and a Payment Mandate is shared with the payment network. The signed chain forms a non-repudiable audit trail that resolves authorization, authenticity, and accountability for autonomous spend, and it is rail-agnostic with an A2A-x402 profile for crypto rails. Distinct from authenticated-delegation: that pattern grants an agent scoped authority to act, whereas AP2 binds each specific purchase to a signed mandate chain a payment network can independently verify.

Open standard co-developed by Stripe and OpenAI (Apache-2.0, September 2025) for completing a purchase against a merchant that stays the merchant of record. The merchant exposes agent-facing REST or MCP endpoints (create, update, complete, and cancel checkout) over a product feed; the agent pays with a Stripe-issued Shared Payment Token scoped to a single merchant and cart total, so the agent never sees the buyer's card credentials. It launched as the standard behind ChatGPT Instant Checkout with Etsy sellers and Shopify merchants. Distinct from `model-context-protocol`: MCP is a general tool-calling transport, whereas ACP is a specific checkout contract that can ride over MCP or plain REST.

An open payment standard created by Coinbase in 2025 and now stewarded by the x402 Foundation under the Linux Foundation that revives the dormant HTTP 402 Payment Required status as a pay-per-request rail. A server replies 402 with machine-readable payment requirements; the client (human or agent) returns a signed stablecoin payment in an HTTP header; a facilitator verifies the payload and settles the transfer on-chain (EVM chains, Solana, and more), all inside a single request with no accounts, sessions, or API keys. It is a native rail for keyless, sub-cent agent-to-service micropayments and metered tool or data access, and is the crypto profile referenced by the AP2 A2A-x402 extension. Distinct from `agentic-commerce-protocol`: ACP is card-based retail checkout through a merchant of record, whereas x402 is a per-call machine payment settled on-chain.

The discovery layer that lets agents and tool servers find each other at runtime instead of through hard-coded configuration. Three converging mechanisms make this work: A2A Agent Cards, a self-describing JSON manifest served at /.well-known/agent-card.json (RFC 8615) advertising an agent's skills, endpoints, auth schemes, and streaming capabilities; the official MCP Registry (preview September 2025), a federated public catalog and API for publishing and finding MCP servers that is extensible with private enterprise sub-registries; and decentralized naming proposals such as MIT Project NANDA, whose NANDA Index resolves cryptographically verifiable AgentFacts records to endpoints, positioned as DNS for agents. The common pattern is publish a signed capability record, then resolve it by well-known URI or registry query, validate the advertised auth schemes, and bind the agent dynamically. Distinct from `a2a-protocol`: that covers the message transport once a peer is known, while this covers finding and vetting the peer in the first place.

Supply-side contracts that expose a site's content to agents directly instead of forcing them to scrape rendered HTML. llms.txt (Jeremy Howard, 2024) is a curated Markdown index at /llms.txt plus .md shadow pages that give an LLM high-density, navigation-free content at inference time. Microsoft NLWeb (2025, led by Schema.org co-creator R.V. Guha) goes further with an /ask natural-language endpoint that returns structured JSON grounded in the site's own Schema.org data, with every NLWeb instance doubling as an MCP server. Together they define the agent-readable site, the read-path counterpart to robots.txt for the agentic web.

An emerging IETF-draft standard (Cloudflare and Google) that lets an agent cryptographically prove its identity to a website using RFC 9421 HTTP Message Signatures. The agent signs each outbound request with an Ed25519 key, publishes its public keys as a JWKS key directory at /.well-known/http-message-signatures-directory, and points to it with a Signature-Agent header; the origin fetches the directory, verifies the signature, and decides whether to allow, deny, rate-limit, or price the traffic. It replaces brittle IP-range and User-Agent allowlists, and Cloudflare's Signed Agents productizes it at the edge. Distinct from authenticated-delegation: that proves user-to-agent authority, whereas Web Bot Auth is the inverse, an agent proving its origin to a website.

Emerging, mostly draft-stage standards for how an agent prices counterparty risk against an unfamiliar agent without a central gatekeeper. The draft ERC-8004 "Trustless Agents" EIP defines three on-chain registries: Identity (an ERC-721 handle resolving to off-chain agent metadata), Reputation (signed feedback signals), and Validation (validator-contract attestations such as stake-secured re-execution or TEE oracles), deliberately keeping payments and app logic off-chain. A companion trust-model taxonomy classifies mechanisms as brief, claim, proof, stake, reputation, and constraint, arguing no single mechanism suffices and tiered combinations are needed. This is early and unsettled: ERC-8004 is a draft EIP and much of the tooling is nascent. Distinct from authenticated-delegation: that is delegated authority and identity, whereas this is reputational trust priced between economic peers.