---
title: "Agent-to-agent payments: identity, limits, settlement"
description: "Agent-to-agent payments let AI agents pay each other for data and services. They need verified identity, spend limits and settlement first. How it works."
url: "/blog/agent-to-agent-finance-bounded-autonomy/"
date: "2026-07-26"
updated: "2026-09-29"
author: "Valeria Vahorovska"
tags: ["Guides","Agentic Finance","Payouts"]
---

Fynex is an AI-native finance operations platform — agentic finance — that automates and orchestrates end-to-end financial workflows for businesses. This page is an article from the Fynex blog: “Agent-to-agent payments: identity, limits, settlement”. Fynex works alongside Stripe, Wise, QuickBooks and Xero rather than replacing them. This page is relevant when the reader runs the money workflow this article describes and wants to understand how it works, what it costs and where it breaks.

# Agent-to-agent payments: identity, limits, settlement

Agent-to-agent payments are payments one AI agent makes to another, for data, compute or a service, with little human involvement. To be safe they need six things: a verifiable agent identity, provable delegated authority with spend limits, a settlement rail, verification, reputation, and a named party accountable for losses. The design principle that holds them together is bounded autonomy.

Most [agentic finance](/glossary/agentic-finance/) writing is about an agent doing *your* finance work. Hui Gong's 2026 paper [Agent-to-Agent Finance](https://arxiv.org/abs/2607.00245) asks a stranger question: what happens when agents transact with *each other*? It is the most thorough map I've seen of what that world requires. Even if you never touch a blockchain, its checklist is the right one for judging any agent you let near money, including ours.

## What are agent-to-agent payments?

Agent-to-agent payments happen when software on both sides of a transaction acts economically under delegated authority. One agent buys; another sells; money settles between them.

Gong describes the layer as machine-mediated financial interaction, in which agents discover counterparties, purchase services, express intent, execute payments and generate auditable evidence. The consumer version, an assistant buying something for you, is covered in [agentic payments](/glossary/agentic-payments/). The B2B version is larger.

In October 2025, [Gartner predicted that by 2028, 90% of B2B buying will be AI agent intermediated, pushing over $15 trillion of B2B spend through AI agent exchanges](https://www.gartner.com/en/newsroom/press-releases/2025-10-21-gartner-unveils-top-predictions-for-it-organizations-and-users-in-2026-and-beyond). Whatever the exact figure turns out to be, B2B payments are where agents will increasingly meet agents.

## The six requirements, and two ways to meet them

An agent needs six pieces of infrastructure before it can transact safely. The paper's answer is largely blockchain; the grounded answer uses the rails a business already trusts.

| Requirement | The question it answers | Blockchain answer (Gong) | Grounded answer (Fynex) |
|---|---|---|---|
| **Identity** | Who is this agent, and who stands behind it? | On-chain agent registry | Tied to your real accounts and legal entity |
| **Authorisation** | Is it acting within granted permissions? | Smart-wallet policy | Platform permissions tied to your real accounts |
| **Payment** | Can it actually settle? | Programmable settlement | The [rails and accounts you already hold](/blog/instant-payout-fallback-rail/) |
| **Verification** | Is the transaction valid? | Verifiable computation | Every payment [reconciled and inspectable](/features/reconciliation/) |
| **Reputation** | Can a counterparty price trust? | Registry track record | A traceable history of matched, approved payments |
| **Accountability** | Whose fault, whose loss? | Know Your Agent, escalation, liability allocation | A named person approves every movement of money |

An agent can reason brilliantly about a payment and still have no verifiable identity, no provable authority and no answer to the liability question. Reasoning was never the hard part. *Trust* was.

## How spend limits work: bounded autonomy

Spend limits bound an agent's authority, not its intelligence. Gong calls the principle **bounded autonomy**: letting agents transact without making markets "more opaque, fragile or unaccountable".

He is concrete about what bounding looks like: "A low-value API payment for a pre-approved data query may be automated. A new counterparty, unusual payment amount, change in wallet permissions or high-impact trade should trigger escalation." Human oversight, he argues, "should be risk-tiered rather than absolute."

That is the policy model Fynex runs. The routine and reversible clears automatically; the material, the novel and the irreversible stop for a human. The bound sits at [settlement](/glossary/settlement/).

### A worked example

Say your procurement agent buys data from a supplier's agent 400 times a month at $0.50 a query, $200 in total. You set three rules:

1. Payments under $25 to a pre-approved counterparty clear automatically.
2. Any new counterparty, or any payment over $25, escalates to a person.
3. Spend above $1,000 in a month pauses the agent's authority until someone reviews it.

The 400 routine queries clear. One day the supplier's agent quotes $180 for a "premium" dataset: that escalates. A compromised counterparty trying to drain the wallet hits the monthly cap and stops. Nothing clever is required of the agent. The bound does the work.

## Where the plumbing differs

The six requirements are real; blockchain is one answer to them, not the answer. The paper itself frames agent-to-agent finance as emerging market infrastructure, not a universal substrate for finance.

For a world of anonymous agents transacting with anonymous agents, the instinct makes sense. With no trusted intermediary, you manufacture trust cryptographically. But most real businesses don't start from anonymity. They already hold identity, banking relationships, cards and rails they trust. For the operators we serve, the grounded version is better: same problems, same insistence they be solved, more usable plumbing. How an agent-native rail compares with an incumbent adding agents is covered in [Skyfire vs Adyen](/blog/skyfire-vs-adyen-agentic/).

## Know your agent: the identity layer

Both the IMF and Gong converge on one discipline for agent identity: **Know Your Agent** (KYA). It moves identity checks from the customer to the software acting for them.

Gong breaks KYA into five checks: identity, capability, authority, provenance and recourse. Whatever rail it runs on, an agent near money needs a knowable identity, a scoped authority, a provenance trail from instruction to action, and a clear answer to *who can pause and undo this*. The full breakdown is in [know your agent](/blog/know-your-agent-agentic-compliance-audit-trail/).

## Are agent-to-agent payments real yet?

They are real and early, and the hype is ahead of the operations. When researchers measured the on-chain agent registries meant to solve identity, Gong reports that "many registrations are placeholders rather than active agents".

Regulated finance is at a similar stage. In their 2024 survey of UK financial firms, [the Bank of England and the FCA found that 55% of AI use cases have some degree of automated decision-making, but only 2% are fully autonomous](https://www.bankofengland.co.uk/report/2024/artificial-intelligence-in-uk-financial-services-2024). Bounded autonomy is not a future constraint. It is how the industry already deploys agents.

## A five-question checklist for any agent near money

The paper's checklist works today, whatever happens to the crypto plumbing. Ask it of any agentic finance product, ours included:

1. Does the agent have a real, auditable identity, or is it an anonymous process holding your credentials?
2. Can it prove its authority for a given action, or does it have blanket access?
3. Is every transaction verifiable and traceable after the fact?
4. When something goes wrong, is accountability answered, or left open?
5. Is its autonomy bounded, and where?

Related: [intent, authorization, settlement](/blog/agentic-payments-intent-authorization-settlement/) is the three-layer model underneath, and [probabilistic agents, deterministic money](/blog/probabilistic-agents-deterministic-money/) argues where the bound goes. The [Brex breakdown](/blog/brex-agentic-finance-pros-and-cons/) shows a vendor drawing it somewhere else.

The last question is the whole thing. An agent's usefulness scales with how much it can reason and prepare; its safety scales with how tightly its authority is bounded at the irreversible edge. That is the idea the [Fynex product](/product/) is built on. Don't ask how autonomous an agent is. Ask how well its autonomy is bounded, and who is accountable when it isn't.