Can two agents pay each other? Identity, trust and bounded autonomy

Most agentic-finance writing is about an agent doing your finance work. A new paper asks a stranger question: what happens when agents start transacting with each other? Hui Gong’s 2026 paper Agent-to-Agent Finance is the most thorough map I’ve seen of what that world would actually require — and even if you never touch a blockchain, its checklist is the right one for judging any agent you let near money, including ours.

Here’s my read: what the paper gets right about the missing infrastructure, where I part ways on the plumbing, and why its core idea — bounded autonomy — is the phrase I’d put at the centre of this whole category.

The six things an agent needs before it can transact

The paper’s framing is simple and, I think, correct: if software agents can act economically, they need infrastructure for six distinct things. Paraphrasing Gong’s list:

1. Identity — a persistent, verifiable “who” that travels with the agent across platforms.
2. Authorization — a way to prove the agent is genuinely acting on someone’s behalf, within granted permissions.
3. Payment — the ability to actually settle, not just agree to settle.
4. Verification — trustworthy proof that the agent is what it claims and the transaction is valid.
5. Reputation — a track record that follows the agent, so counterparties can price trust.
6. Accountability — a clear answer to “whose fault, whose loss” when an agent acts without a human in between.

What I like about this list is that it exposes how much of “AI agents will run finance” is still missing its foundations. An agent can reason brilliantly about a payment and still have no verifiable identity, no provable authority, and no answer to the liability question. Reasoning was never the hard part. Trust was.

Bounded autonomy: the phrase worth keeping

The paper’s design thesis is what it calls bounded autonomy — the problem of how to “let agents transact without making markets more opaque, fragile or unaccountable.” Not maximal autonomy. Bounded.

That is, almost word for word, the principle Fynex is built on. We give agents a lot of room to reason, read, reconcile and prepare — and we bound their authority, not their intelligence. The bound sits at the movement of money. An agent can do everything up to the point of settlement; releasing funds is where the boundary is, and a human crosses it. Gong is describing, from an academic angle, the same conclusion the IMF’s payments note reaches from a policy angle: agency is valuable, unbounded agency over irreversible money is not.

It’s a good sign when the theorists arguing for a maximal agent economy and the central-bank economists worrying about systemic risk both land on bound the autonomy. That’s not a fringe caution. It’s becoming the consensus design constraint.

And Gong is concrete about what bounding looks like in practice — his phrasing could be lifted straight from our product spec: “A low-value API payment for a pre-approved data query may be automated. A new counterparty, unusual payment amount, change in wallet permissions or high-impact trade should trigger escalation.” Human oversight, he argues, should be risk-tiered rather than absolute — “more realistic than insisting on manual approval for every action and safer than allowing unconstrained autonomy.” That is exactly the policy model Fynex runs: the routine and reversible clears automatically; the material, the novel and the irreversible stop for a human.

Where I part ways: the plumbing

Here’s my honest disagreement. Gong’s answer to identity, verification and settlement is largely blockchain — smart wallets, on-chain agent registries (the paper points at emerging ERC-8004-style registries), verifiable computation, programmable settlement. For a world of anonymous agents transacting with anonymous agents, I understand the instinct: if there’s no trusted intermediary, you try to manufacture trust cryptographically.

But most real businesses aren’t starting from anonymity. They already have identity, banking relationships, cards, and rails they trust. The six requirements are real; the blockchain is one answer to them, not the answer. And the paper itself is careful here — it positions agentic finance as emerging financial market infrastructure, not a universal financial substrate. I’d go further: for the operators we serve, the grounded version is better.

So Fynex solves the same six problems on infrastructure businesses already use:

• Identity and authorization live inside the platform, tied to your real accounts and your permissions — not a wallet address.
• Payment runs on the rails and accounts you already hold, not a new settlement layer you’d have to fund and trust.
• Verification and reputation come from the agent’s work being fully reconciled and inspectable — every match, every flag, every proposed payment traceable to its reasoning.
• Accountability is answered by the approval line: because a human authorises the money movement, there’s always a named person and a legible record behind every payment that left.

Same problems. Same insistence that they must be solved. Different — and, for a working business, more usable — plumbing.

Both papers, tellingly, converge on the same new discipline for this: Know Your Agent (KYA). Gong breaks it into five checks — identity, capability, authority, provenance, recourse — and the IMF frames it as regulators shifting from Know Your Customer to Know Your Agent, “where mandated verifiable identities for financial bots are linked to legal entities.” Whatever rail it runs on, an agent near money should have a knowable identity, a scoped authority, a provenance trail from instruction to action, and a clear answer to who can pause and undo this. That’s a checklist we hold ourselves to — not a blockchain feature.

Why this matters even if A2A stays theoretical for a while

You might reasonably think a fully agent-to-agent economy is years off. The paper’s own evidence says be patient: when researchers actually measured the on-chain agent registries meant to solve identity and reputation, most entries turned out to be placeholders rather than active agents — “trustless registries do not automatically produce trustworthy agents,” and early adoption is “registration-heavy but operationally shallow.” I read that as healthy realism, not a debunk. The infrastructure is real and early; the hype is ahead of the operational reality. Which is precisely why you shouldn’t wait for it to grade the tools you can use now.

Because the paper’s checklist is useful today, whatever happens to the crypto plumbing. It’s the right set of questions to ask any agentic-finance product right now:

• Does the agent have a real, auditable identity, or is it an anonymous process with your credentials?
• Can it prove its authority for a given action, or does it just have blanket access?
• Is every transaction verifiable and traceable after the fact?
• When something goes wrong, is the accountability question answered — or left open?
• And crucially: is its autonomy bounded, and where?

That last one is the whole thing. An agent’s usefulness scales with how much it can reason and prepare. Its safety scales with how tightly its authority is bounded at the irreversible edge. The paper calls holding both at once bounded autonomy; we call the boundary the approval line; the Brex comparison is a live example of a vendor drawing that boundary in a different place. Whatever you call it, the question to ask of any agent you’d let near your money is the same one Gong ends on — not “how autonomous is it,” but “how well is that autonomy bounded, and who’s accountable when it isn’t.”