Where agent payment stacks come apart

An agent task is assembled from protocols that were each designed and secured on their own: discovery, negotiation, execution, verification, settlement. Rui Sun and seven co-authors point out the consequence in one sentence. Every step can look correct and the outcome can still be wrong, because an escrow that releases payment on an authorised approval proves only that someone approved, not that the delivered work satisfied the task.

Their systematisation covers the full lifecycle, organising security and economic requirements into 17 property families across six stages, with the soundness and the completeness of receipts assessed separately. Against that frame they examine 12 systems and standards, five reusable mechanism families and four classical baselines.

Guarantee closure

The paper's own contribution is a criterion it calls guarantee closure: whether a guarantee established at one stage is still available later, and still constrains the decisions that depend on it. It is task-relative by construction, which is what lets it catch the case where each component holds its promise locally and nothing carries that promise through to settlement.

Applying it to controlled and native workflows, over 840 matched executions and an exhaustive check of 11,648 cases across a finite domain of objective tasks, exposes failures clustered between verification and settlement in both directions: conforming work that stays unaccepted, and valid evidence that is ignored. Public records and model judgments, the authors add, distinguish a recorded approval from evidence that the task was actually conformant, and an economic analysis surfaces the assumptions about reporting, penalties and shared errors on which the remaining guarantees rest.

For anyone building agent payments, the useful output is the diagnosis rather than the taxonomy. The weak point is not the payment rail, which is the part that has had the most attention, but the join between proving work was done and releasing money for it. The paper is published under a CC BY 4.0 licence.