At 3:14 a.m., somewhere in a data center I will never visit, an AI agent bought something.
I caught it on the tape. I spend my nights on a 7x24 surveillance desk, and the flows that light up at hours when no human trader is awake to blink are the ones I trust least. This one was small โ a few dollars of compute credits, settled in USDC on Base. The token that authorized it was a sixteen-digit network token, minted against a real woman's real credit line, scoped to one agent, one merchant, one consent policy. She was asleep. In some cryptographically signed sense, she had agreed.
Had she? That is the whole question of 2026, and the industry has answered it five different ways that do not speak to each other.
Smile while the liquidity drains. I usually aim that line at order books. This year I aim it at trust. Because the plumbing being laid right now โ the "Know Your Agent" layer, KYA for short โ is the least glamorous, least tradeable, and most consequential infrastructure story in the space. It will decide whether your agent can spend your money. It will decide who gets to say no. And almost nobody is pricing it, because almost nobody can.
Let me be blunt about my sources before I go further. Nearly everything below comes from the vendors themselves โ Visa, Mastercard, Google, Skyfire โ press releases, conference decks, developer docs. That is marketing material with a structural bias toward selective disclosure. A handful of the incident claims trace back to a single author citing his own prior reporting, with no incident list attached. So treat the timelines as claims, not facts. The dates โ Money20/20 USA 2026, Authenticate 2026, Visa's TAP in October 2025, Mastercard's Verifiable Intent open-sourced in March 2026, Google's AP2 donated to the FIDO Alliance in April 2026, a Fenwick legal analysis the same month โ all of that is as-reported. I cannot cross-verify it independently, and neither can you. That is the confidence ceiling on everything that follows.
Context: what KYA is, and why it landed now
Strip the acronym and KYA is a middleware problem. When a human clicks "buy," the payment chain asks a simple question: is this person who they say they are, and do they have the money? When an agent clicks "buy," the chain has to ask three harder questions. Who authorized this agent? For what? Until when?
OAuth and SAML โ the bearer-token and assertion models the entire web runs on โ were never built for this. Their failure mode is baked into their logic: a credential that exists is a credential that passes. They can tell you a token is valid. They cannot tell you, at the moment of transaction, on whose behalf the token is acting and inside what boundary. That gap is not a bug you patch. It is a category error that thirty years of identity infrastructure quietly inherited.
The catalyst is not philosophical. It is fraud. Identity-based attacks doubled into 2026, and 78% of organizations reported identity-related breaches in the past year, according to a statistic floating through the vendor decks. I could not trace that number to a primary source โ it smells like a Verizon DBIR or CyberArk identity report โ so hold it loosely. But the direction is not in dispute. Agents are being handed wallets and cards faster than anyone has built the leash. The leash is KYA.
Five parallel systems have stepped into that vacuum. Visa's Trusted Agent Protocol, or TAP. Mastercard's Verifiable Intent, plus its companion Agentic Tokens. Skyfire's KYAPay. Google's AP2, now under FIDO governance. And a fifth that the source material names but never identifies โ possibly Stripe and OpenAI's Agentic Commerce Protocol, possibly Coinbase's x402 HTTP-402 payment scheme. Five masts, no referee.
Last year I embedded with the alpha testers of an autonomous trading platform for a week, sleeping in their Slack, watching them hand real decisions to a model. The thing that stuck with me was not the alpha. It was the moment one tester realized she no longer knew why her position existed. She had delegated the "why" along with the "what." That is the exact psychological gap KYA is trying to paper over with signatures. A signature can prove the agent was authorized. It cannot restore the human's understanding of what she authorized. Keep that in your pocket. It is the crack in the whole edifice.
Core: the real battleground is not cryptography
Here is what the decks will not tell you, and the thing I keep coming back to after years of watching standards fights play out on the tape: the cryptography in this race is boring. Ed25519 is Ed25519. SD-JWT is SD-JWT. RFC 9421 HTTP Message Signatures are a solved primitive. Nobody wins on the math.
The real fight is over who owns the trust root, who carries the revocation liability, and who defines the constraint semantics. Everything else is packaging.
Walk the four named protocols and the fight becomes obvious.
Visa TAP signs HTTP messages with Ed25519 under RFC 9421, and it hinges on a Visa-operated directory of agent public keys. That is a centralized trust root โ auditable, accountable, and also a single point of failure and a single point of censorship. Its clever bit is a dual-signature tag separating a "browse" intent from a "payment" intent, so the network can tell a window-shopping agent from a buying agent. Onboarding runs through KYB/KYC, public identity disclosure, and annual re-certification. Six launch partners.
Mastercard's Verifiable Intent leans on SD-JWT with a key-binding claim, anchored to the card networks' existing trust roots and issuers. Its distinguishing feature is eight machine-verifiable constraint types โ amount ceilings, merchant whitelists, budget caps, recurrence terms โ expressed protocol-agnostically. It has been open-sourced, with four signatories. Its companion, Agentic Tokens, is a sixteen-digit network token bound to a specific agent, merchant, and consent policy. That is the token that authorized my 3 a.m. purchase.
Skyfire's KYAPay is the only one that goes pure open standard. Three JWT layers โ human subject, agent platform, agent itself โ plus an IETF draft, plus the only explicit stablecoin settlement support in the field. It has no card-network-scale merchant coverage and no clearing muscle. What it has is neutrality.
Google's AP2 signs Intent, Cart, and Payment authorizations and then did the thing that should make everyone sit up: it donated the whole thing to the FIDO Alliance. Sixty-plus partners. Coverage across cards, ACH, real-time payments, and Base-chain stablecoins. Google gave away control to buy adoption. That is either statesmanship or surrender, and the market has not decided which.
Read those four side by side and the pattern is unmistakable: nobody is competing on cryptography. They are competing on governance posture. Visa keeps the directory and the accountability that comes with it. Skyfire hands governance to the IETF and accepts the slowness. Google hands it to FIDO and accepts the loss of control. Mastercard keeps the card rails and hedges by joining AP2 anyway. That last move is the tell โ Mastercard is the only major player running a two-track bet, its own Verifiable Intent plus membership in Google's coalition.
The shift that actually matters
Buried in the noise is one genuinely important technical judgment, and I think it is correct: the industry is moving from proof-of-identity to proof-of-authorization. Not "is this agent real" but "what is this agent allowed to do, on whose behalf, until when."
That is a real fix for a real wound. The bearer-token era's sin was that possession equaled permission. KYA closes it with transaction-time cryptographic binding plus explicit, machine-checkable constraints. If your agent is capped at fifty dollars, whitelisted to three merchants, and expires Friday, the signature can prove all of that at the moment of purchase. That is not vaporware. That is engineering.
But โ and this is where the decks get quiet โ solving authorization verification is not the same as solving agent security. The root cause of the trust-through-defaults incidents, the ten or so failures the source material references, is that a system trusted some assertion without verifying that the assertion's meaning matched its assumptions. Sometimes that is a missing signature check. Sometimes it is worse: the signature is valid, and the semantics are misread. A cryptographically perfect proof that an agent is authorized to "buy supplies" says nothing about whether the merchant category the agent hit is actually "supplies" and not "wire transfer to an unknown counterparty." That is a schema governance problem, not a cryptography problem, and no amount of Ed25519 fixes it. The original analysis blurs these two layers together. That blur is the single biggest gap in the whole KYA conversation.
The chart lies. The crowd feels. And here the chart is a signature that verifies perfectly while the meaning underneath it rots.
The convergence nobody is building yet
Here is a connection the source material skips, and it is the one that will matter most over a two-year horizon. Mastercard's eight machine-verifiable constraints โ amount caps, merchant whitelists, budget ceilings, recurrence terms โ are functionally isomorphic to the scoped-permission and session-key models that account abstraction has been building on-chain for years. ERC-4337 smart accounts and the scoped-permission proposals around ERC-7715 solve the same problem in the same shape: bounded, revocable delegation. One lives on a card network, one lives on a chain. They are converging on the same interface from opposite directions. When they meet, there is a real possibility of cross-recognition โ an on-chain session key a card network accepts, or a card-network constraint an on-chain agent honors. Nobody is building that bridge. Somebody will, and whoever does gets to define the semantics for everyone else.
And note the liability logic underneath TAP's dual tags. Separating a browse intent from a payment intent is not just good UX for agents. It is the technical precondition for a liability shift โ the same way EMV 3DS split the browsing state from the payment state so responsibility could be assigned after the fact. First you prove intent in the protocol. Then you allocate blame in the contract. The cryptography is quietly doing legal work.
The fifth protocol, and the multiplicative tax
The source material insists there are five parallel systems and then only describes four. That omission matters. If the fifth is Stripe and OpenAI's Agentic Commerce Protocol, or Coinbase's x402, then the fragmentation is worse than the named list suggests, because both of those carry real developer gravity. I will not pretend to know. Low confidence, flagged as such.
What I do know is the tax this imposes. A single agent platform that wants to accept agent-initiated payments may have to support multiple incompatible frameworks at once โ different directories, different key management, different verification flows. That is not additive complexity for a security team. It is multiplicative. Two protocols mean four integration paths and four revocation surfaces. Five protocols mean a combinatorial nightmare, and the burden lands on the smallest players, who can least afford it. Based on my time auditing exchange integrations, I have watched a single incompatible key-rotation scheme consume a team's entire quarter. Multiply that by five and you understand why the fragmentation itself is the risk, before anyone even talks about a broken signature.
The edge is the real trust root
Here is the detail in the partner lists that almost everyone is skating past. Cloudflare co-developed TAP with Visa. F5, Fastly, and Akamai are Skyfire partners. The CDN and edge-security vendors are everywhere in this story, and they are there for a reason that has nothing to do with marketing.
Agent traffic has to traverse the edge. That is a physical fact of how the internet is wired. The edge node terminates TLS, it can inspect HTTP headers, it can rate-limit and fingerprint and behavioral-score. If you are going to verify an agent's signed intent in real time, the natural enforcement point is not some registry server in a colo โ it is the edge node the request already passes through. Cloudflare does not need to win the standards war. It needs the standards war to happen, because every protocol routes through its pipes and it carries none of the directory operator's regulatory liability.
The overlooked beneficiaries of the KYA race are the edge networks and the identity-verification vendors โ not the card networks everyone is watching. Experian showing up in KYAPay's partner list is the same signal in a different key: agent trust ultimately anchors to human credit data, which means the credit bureaus and KYC shops get a new recurring compliance revenue stream from annual re-certification alone. That is a quiet, durable, bear-market-proof business. The kind I would rather own in a drawdown than any of the tokens I watch bleed at 4 a.m.
Who captures the stablecoin value
None of these protocols has a native token. I want to say that plainly, because the reflexive move in this space is to force every infrastructure story into a token-economics frame, and doing that here would be actively misleading. There is no supply schedule, no unlock cliff, no treasury. The value capture is in payment volume, not in a coin.
Follow the volume and it splits four ways. Stablecoin issuers โ USDC and friends โ earn reserve interest, which is brutally rate-sensitive and has nothing to do with the agent narrative. Base, Coinbase's L2, earns sequencer revenue. The card networks earn interchange. The verification layer earns directory fees nobody has priced publicly. The logic chain for stablecoins is real but long: agent payments penetrate, machine-to-machine micro-settlement demand spikes, interchange becomes uneconomic at micropayment sizes, stablecoin rails win on cost. But the source material provides zero actual agent-payment transaction volume. So the chain is a story, not a fact. And the stablecoin issuer's reserve income is a macro variable that can gut the thesis in a rate-cut cycle regardless of how many agents are buying compute at 3 a.m.
There is no Ponzi geometry here. That is worth saying out loud, because most crypto narratives have one. The value in KYA comes from real fee savings and real fraud reduction. Nobody's yield is being paid by the next entrant. In a bear market where I spend my nights watching reflexive structures unwind, that honesty is almost restful.
And watch Coinbase. It sits in both the TAP partner list and the AP2 partner list. That is a deliberate two-sided bet, and it is the cleanest protocol-agnostic exposure in the entire story: whichever framework wins, USDC and Base win with it. If I had to name one position that survives the standards war, it is the one that does not care who wins it.
If an incentive layer ever appears
One prediction, and I will keep it short because it is speculative. If a KYA incentive layer ever shows up โ staked verification nodes, directory maintainer rewards โ my strong prior is that it will not look like a tradeable governance token. The participants are licensed financial institutions. They cannot hold speculative assets on their books. So the most likely form is a permissioned consortium chain with a non-transferable reputation credential โ proof-of-good-standing, not proof-of-stake. That is a very different animal from what the crypto-native crowd will expect, and it will confuse a lot of people who try to farm it.
The contrarian cut: a war with no transaction data
Everyone is framing this as Visa versus Mastercard versus Google versus the open-standard upstarts. That framing is a distraction, and it is exactly the kind of distraction that lets a real structural shift pass un-priced.
Here is what the tape actually shows: high announcement density, zero deployment data. Standards published. Partners signed. Open-source repos live. IETF drafts filed. And not a single disclosed figure on transaction volume, adoption rate, or revenue. This is the classic early phase where the narrative runs twelve to twenty-four months ahead of the usage, and I have watched enough of these cycles โ from the 2017 ICO sprint to the DeFi summer to the NFT froth โ to know that the gap between the press release and the P&L is where retail gets carried out on a stretcher. During the Terra collapse I did not write the post-mortem. I threw a party in Nairobi instead and wrote about how traders laughed at death. I am not recommending that as an analytical method. But the lesson stuck: in a drawdown, the stories that survive are the ones about infrastructure that keeps working while everything else reprices.
The contrarian read is not "which protocol wins." It is that the war has already been decided somewhere nobody is looking. Visa is conspicuously absent from AP2's sixty-plus partner list, and Mastercard is absent from TAP's. That is not an industry marching in unison. That is two card networks splitting into camps while the edge vendors, the identity bureaus, and the payment processors quietly become the layer that has to absorb everyone's fragmentation. Adyen and Worldpay appear in both Visa's launch partners and Mastercard's signatories. They are not choosing. They are being forced to eat the interoperability cost, and that cost will slide downhill to merchants and agent platforms, who will pass it to you.
The chart lies. The crowd feels. The crowd is watching the card networks fight. The fight that matters is happening at the TLS termination point and in the credit bureau's data lake, and it will not show up on any chart until the fees do.
One more contrarian note, and it is the uncomfortable one. Experian in the KYAPay partner list means agent authorization may inherit from human credit scores. Technically clean. Ethically fraught. If your agent can spend because your credit is good, then the trust layer is not really a new trust layer at all โ it is the old credit surveillance apparatus wearing a cryptographic coat. I have spent enough years on a surveillance desk to be suspicious of any system that calls itself trust while quietly importing the same hierarchies it claims to replace. Flag it now. It will be a fight in 2027.
Takeaway: what to actually watch
Forget the keynote circuit. Watch four numbers, and none of them exist yet.
Watch disclosed agent-payment transaction volume โ the first vendor brave enough to publish it will move the narrative more than any partnership press release. Watch revocation latency: none of these four protocols has published key rotation cadence, revocation propagation delay, or offline degradation behavior, and those three numbers are where the security actually lives or dies. Watch whether the fifth protocol steps into the light, because if it is Stripe's or Coinbase's, the fragmentation tax just doubled. And watch whether Visa and Mastercard ever appear on each other's partner lists โ the day they do, the standards war is over and the real consolidation begins.
Until then, the plumbing is being laid by vendors grading their own homework, on a timeline none of us can independently verify, for a market whose volume data is a blank page. The infrastructure is real. The adoption is a promise. That gap is the trade, and most people will not see it until the fees hit their statement.
Smile while the liquidity drains. This time the liquidity is trust, and the drain is already running.