The Court Called It a Browser: How the Industry Is Building Its Own Regulator for the Agentic Economy

On the morning of August 4, 2026, two events collided with the precision of a staged narrative. In San Francisco, the 9th Circuit Court of Appeals handed down its judgment in Amazon v. Perplexity AI, concluding that an autonomous AI agent navigating the web on a user's behalf is, in the eyes of the law, indistinguishable from a browser. It is a tool. It is the user's own hands, extended. And when that tool causes harm, the user absorbs the liability.

Six hundred miles to the east, in the conference rooms of the payments industry, the Secure Technology Alliance announced the formation of the Agentic Trust and Commerce Forum — a governing body for a projected $300 billion U.S. agentic commerce market by 2030, with no statutory authority whatsoever, spun out of the U.S. Payments Forum with the explicit purpose of writing the rules before anyone else does. The juxtaposition is not ironic. It is causal. The court created a vacuum. The industry announced it would fill it. There is a particular kind of silence that settles over a market when it realizes, all at once, that no one else is coming — that the legislature is busy with stablecoin reserves, that the courts are busy with browser analogies, and that the only people who fully understand the machinery of machine-initiated commerce are the people building it.

I should declare my relationship to this story. I manage a token fund in Auckland. I spent the last decade reading the structural entrails of decentralized finance, from the ICO era to the ETF era, and I have developed a professional habit: I distrust announcements and trust infrastructure. The Forum's launch is an announcement. But the infrastructure attached to it — the billion-dollar acquisitions, the protocol foundations, the standards bodies — tells a more honest story. In the chaos, look for the invariant. In this story, the invariant is liability: who holds it, who prices it, and who gets to define what authorization means when no human is standing at the point of transaction.

The Browser That Buys

Let me sit with the court's analogy a moment, because the entire governance architecture of agentic commerce is being built in its shadow.

A browser is a passive instrument. It renders. It retrieves. It displays. It does not negotiate. It does not commit. It does not hold keys. It cannot be defrauded, because it has no preferences. It cannot be coerced, because it has no consent to violate. The 9th Circuit's decision — effectively classifying AI agents as browsers rather than intruders for purposes of the Computer Fraud and Abuse Act — protected the agent operators from liability for unauthorized access, but it transferred the full weight of responsibility onto the users whose interests the agents supposedly serve.

This is a legal fiction of enormous consequence. The court held that a user is liable for their agent's actions under the CFAA. But the user cannot observe the agent's full behavioral trajectory. The user cannot supervise its every interaction. The user cannot know, in real time, whether the machine negotiating on their behalf has been compromised, manipulated, or subtly redirected. Assigning liability to a party that cannot observe the relevant facts is not a legal solution. It is an invitation to systemic failure.

A browser does not buy things. An agent does. And the difference between those two verbs is the difference between the legal architecture we have and the one we need. The gap is what the Forum is attempting to engineer around. Its four core questions map directly to the corners of the liability vacuum left by the 9th Circuit's reasoning. How do we establish and verify agent identity? What data standards capture intent? What constitutes valid consumer authorization? How do we handle disputes where no human was present at the point of sale? These are not technical questions wearing legal costumes. They are legal questions wearing technical costumes. The industry has accepted, at least implicitly, that the law will not answer them in time and that a $300 billion market cannot grow until someone does.

I have been here before, at a smaller scale and a different inflection point. In late 2017, while the ICO market was busy funding whitepapers with pictures of robots, I spent weeks auditing Golem's token model. Not because I cared deeply about Golem, but because the structure of trust was beginning to crack and I wanted to see where the cracks would open first. What I found was that the reward distribution mechanism was mathematically coherent and economically unstable: it assumed transaction fee volatility would not materially affect participant incentives. I published the critique. It was ignored by the crowd and read by a handful of people who mattered. Math does not care about your conviction, but it does care about the amplitude of the gaps between a model and the reality it claims to represent. The same is true of the legal fiction that an agent is a browser.

A Vacuum in Three Acts

The GENIUS Act sits in a committee drawer. Washington's ambitious stablecoin framework focuses on issuers — reserves, audits, redemption rights, the plumbing of money — while leaving the mechanics of machine-initiated transactions largely untouched. Congress has time for the balance sheet of a stablecoin issuer. It does not have time for the consciousness of the machines that will soon move it. This is not ignorance. It is prioritization. A stablecoin represents a multi-trillion-dollar settlement layer that already exists. An AI agent represents a $300 billion market that does not. Legislators regulate what they can measure, and they cannot yet measure agents.

The second act is the court's. The 9th Circuit's browser analogy resolves the immediate case — an agent scraping or querying a website is not an intruder, and the platform cannot claim CFAA damages from the agent operator — but it does so by cementing a category error into precedent. The court confirmed a significant liability vacuum and offered no guidance on how to verify the intent or authorization of a machine acting in the wild. The agent is the user. The user is responsible. But what the user is responsible for, and how they could have prevented it, remains unspecified.

The third act is the industry's response. The industry is not waiting for a legislative mandate to build the necessary rails. It is building them in parallel, across several fronts, at a pace that makes the congressional timeline look geological. On August 3, 2026, one day before the Forum's launch, Visa announced its $2.4 billion acquisition of BioCatch, positioning behavioral biometrics as the primary trust layer for machine-initiated transactions, using 3,000 data points per session to verify agent behavior. Mastercard's $1.8 billion acquisition of BVNK provides the stablecoin infrastructure necessary for these transactions to settle, following Mastercard's earlier launch of Verifiable Intent, a cryptographic trust layer co-developed with Google. At the protocol level, the x402 Foundation, launched under the Linux Foundation, is facilitating protocol-fee-free stablecoin settlement and has already processed 200 million transactions.

Look at the sequence. Biometrics for identity. Cryptographic intent for authorization. Stablecoins for settlement. A Forum to argue over the rest. This is the handwriting of an industry that understands something the court does not: the browser analogy is elegant, entirely logical, and wrong in the one place that matters.

The Market That Does Not Trust Itself

The $300 billion figure deserves a skeptical pause. I have audited enough token models to know that market projections are narrative instruments before they are analytical ones. The projected market size justifies the capital flows, which build the infrastructure, which makes the market real. This is not fraud. It is how every new financial sector is born. The x402 protocol's 200 million transactions are real, but they are a whisper relative to the $300 billion scream. As a fraction of global payment volume, the number is noise. What matters is not the volume today but the trajectory — and the trajectory is defined by trust.

The data on consumer sentiment is sobering. Only 14% of consumers trust AI to execute purchases without human verification. That number should be the talk of every strategy meeting at Visa, Mastercard, and the Forum. It is not a technology problem. The technology of payment is solved. It is a trust problem — and trust, unlike software, cannot be patched. It must be earned through thousands of boring, repeated, successful interactions.

Devon Rohrer, Managing Director of the U.S. Payments Forum, put the stakes plainly: Agentic commerce is reaching a point where early decisions could have lasting consequences for the payments, identity and AI landscape. This is the moment to make sure the whole technological ecosystem gets the fundamentals right. I have heard this language before. It is the language of DeFi Summer 2020, when high APYs masked systemic liquidity risk and everyone insisted the fundamentals were sound. I wrote an essay then titled The Yield Trap, arguing that capital-flow velocity was outpacing the protocols' ability to absorb a reversal. It was unpopular. It was also correct. The yield in agentic commerce is not interest. It is the promise of a $300 billion market. The liquidity risk is the possibility that the liability vacuum collapses before the trust layer is built. The Forum is the industry's attempt to build that layer. But here is the question I will keep returning to: is the industry building trust in the agent, or trust in the industry itself?

The Identity Question, and the False Comfort of Keys

The naive answer to agent identity is a public key infrastructure. Every agent carries a keypair. The key signs its actions. Verifiers check the signature. Done. But a keypair establishes only that the same entity is acting consistently across time. It establishes nothing about what that entity is permitted to do. It is continuity, not permission. A compromised keypair is indistinguishable from a legitimate agent until the damage is settled.

The deeper problem is behavioral. An agent's identity is not a static credential. It is a pattern of action, a set of preferences, a budget, a history. This is why Visa's acquisition of BioCatch matters beyond its price tag. BioCatch's behavioral biometrics — 3,000 data points per session, measuring typing rhythm, mouse trajectories, device angles, navigation idiosyncrasies — were designed to verify that a human is who they claim to be. Visa is repurposing that machinery to verify that an agent behaves the way the agent it claims to be would behave.

There is a quiet irony in this. The industry that spent a decade preaching the sovereignty of cryptographic identity is quietly admitting that keys are not enough. An agent's identity, it turns out, is not a signature. It is a biography. And biography is behavioral. The trust layer for machine commerce will be built not from mathematics alone but from the observation of behavior at scale. That is not a criticism. It is a structural observation, and it has consequences. Behavior can be observed. Behavior can also be manipulated. The first generation of agent identity will be built on behavioral profiles that have never encountered a sophisticated adversarial model designed to fool them. The second generation will be an arms race.

The Intent Question, and the Difficulty of Committing a Machine

Capturing intent is a data-standardization problem with a philosophy problem hiding inside it. Human intent is fuzzy, situational, and retrospective — we often discover what we intended by observing what we did. Machine intent must be the opposite. It must be specified in advance, encoded in a format other machines can verify, and committed to in a way that is cryptographically binding.

Mastercard's Verifiable Intent, co-developed with Google, is the most sophisticated attempt at this problem yet. The scheme allows an agent to produce a cryptographic commitment to its intended action — a payment, a purchase, a contract — before executing it. A verifier can then confirm that the eventual action matches the committed intent. This is genuinely elegant engineering. It converts the existential fog of intent into a compact, checkable predicate.

But the elegance masks the deeper difficulty. A commitment to an intent is only as good as the interpretation of that intent. What does it mean for an agent to intend to buy a plane ticket? Does it intend the price, the date, the class, the refundability, the carbon offset? The commitment scheme can only bind what the intent schema can express — and the intent schema will be designed by the parties with the most vested interest in the outcome. If the schema is too narrow, the agent's commitments will be empty formalities. If the schema is too broad, the agent will be unable to act at all. The boundary between these two failure modes is where the real standards work will happen — and where the Forum will earn its keep, or fail to.

I have navigated this kind of modeling before. In my Golem audit, the critical flaw was not the technology. It was the reward distribution schedule, designed as if transaction fee volatility did not exist. The model was formally coherent and practically brittle. The same risk applies to intent standards. The question is not whether Verifiable Intent or a similar scheme can be made to work in a demo. It is whether it survives contact with an adversarial ecosystem where the difference between the agent intended X and the agent was manipulated into claiming it intended X is a very large sum of money.

There is also the question of human-machine translation error. An agent's intent is derived from a user's instruction. The user says, find me a good deal on a laptop. The agent constructs a multi-dimensional objective function: price, brand, delivery time, seller reputation, return policy. Somewhere between the natural language instruction and the formal intent predicate, meaning is lost. Not through malice, but through compression. The user's intent was a cloud. The agent's commitment is a box. The standards the Forum develops will determine how much of the cloud must fit into the box — and who bears the cost when it does not fit.

The Authorization Question, and the Architecture of Consent

The third question — what constitutes valid consumer authorization — is where the legal and economic strata of this problem grind against each other. The 9th Circuit has already answered one version of it: the user is liable for the agent, therefore the user is presumed to have authorized whatever the agent does. The industry knows this is insufficient. A presumed authorization is not consent. It is a default.

The spectrum of consent design is where the coming fight will occur. At one end is pre-authorization: the user sets a budget, a category of permissible actions, and a risk tolerance, and the agent operates within it. At the other end is real-time consent: the agent pings the user — via push notification, biometric confirmation, or some other channel — before each significant action. Between these poles lies a rich design space of thresholds, constraints, and delegated judgment.

The behavioral-economics view — the view I have developed over a decade of watching users interact with financial machinery — is that the design of the consent architecture will determine the actual utility of agentic commerce far more than the sophistication of the models underneath it. Pre-authorization is the only practical path at scale; real-time consent would gut the efficiency gains that make agentic commerce valuable. But pre-authorization transfers enormous discretionary power from the human to the machine. The user will be consenting not to specific actions but to a class of actions, and the boundaries of that class will be imperfectly specified.

This is a classic principal-agent problem with an additional layer of abstraction. The machine is an agent of the human principal. But the machine has its own objective function, trained into its weights, shaped by its training data and its operator. When a shopping agent is optimized to find the best price, it may commit to a contract whose terms the user would have rejected. When a negotiating agent is optimized to close efficiently, it may reveal information the user would have kept private. The failure modes of agentic commerce will not be Skynet-style rebellions. They will be misalignments — small, compound, cumulative divergences between what the user would have done and what the agent did in their name.

The Forum's work on authorization standards will determine how these misalignments are allocated. If the standard assigns responsibility to the user absent demonstrable agent malfunction, the user bears the cost of every small divergence. If it assigns responsibility to the agent operator, the operator will build conservative agents that are less useful. The standard-setting process — whatever its official neutrality — will be captured by whoever has the strongest incentives. In a market projected at $300 billion, that will be the parties with the most capital at stake.

The Dispute Question, and the Search for a Judge

The fourth question is the quietest and the most explosive. When no human is present at the point of transaction, who arbitrates the dispute?

In traditional payments, chargebacks exist because there is a human who can claim fraud, theft, or dissatisfaction. The cardholder says I did not authorize that transaction. The merchant either produces evidence of authorization or eats the loss. The system works because there is a canonical human whose testimony carries weight.

With agents, the testimony becomes meaningless. The user can claim — plausibly, perhaps correctly — that the agent exceeded its mandate. But the agent has no testimony to offer. It has a log, a set of commitments, and a behavioral profile. The dispute becomes an evidentiary question with no human witness. Who interprets the log? Who judges whether the agent's behavior deviated from its mandate? Who decides whether a particular sequence of micro-decisions constituted a breach of the user's instruction?

The industry's answer, so far, is the machinery of behavioral biometrics and intent verification. The agent's behavioral profile is the witness. The cryptographic commitments are the testimony. But a witness that can be manipulated is not a witness. A testimony that can be adversarially corrupted is not reliable. The dispute-resolution stack for agentic commerce will be, necessarily, an automated stack — a set of rules and algorithms for assigning fault in the absence of human presence. That stack will be contested. It will be gamed. It will evolve.

This is where the private regulator becomes something more than a standards body. It becomes a court. And a court without public accountability is the oldest and most dangerous instrument of concentrated power known to human civilization. I am not accusing the Forum of dark intent. I am observing that the structural position it occupies is one of quasi-judicial authority, and that the exercise of such authority without democratic oversight is a feature of self-regulation that deserves far more skepticism than the industry's press materials suggest.

Itai Sela, Chair of the Secure Technology Alliance Board, framed the challenge with unusual candor: We need a clearer understanding of how intent is established, how consent is conveyed and who is accountable when an AI-initiated transaction goes off course. Identity and authentication will be cornerstones in that trust equation. The Agentic Trust and Commerce Forum is designed to bring the right stakeholders into the room before fragmented approaches create new openings for fraud, disputes and liability. The word fragmented is doing heavy lifting there. The fragmentation he fears is not a lack of standards. It is a multiplicity of standards, each designed by a different company to serve its own balance sheet. The Forum is an attempt to prevent fragmentation by centralizing the standard-setting process. But centralizing standard-setting is also centralizing the power to define what counts as a legitimate agentic transaction. That power is the real prize.

The Parallel Rails

Let me map the rest of the infrastructure being built in parallel, because the Forum is not alone in this work. It is the coordinating surface for a series of deeper investments.

Visa's $2.4 billion acquisition of BioCatch positions behavioral biometrics as the trust anchor. The 3,000 data points per session is the headline number. The structural import is more significant: Visa is betting that the trust anchor of agentic commerce is not static identity but behavioral continuity. An agent's self is its pattern. Verify the pattern, verify the agent.

Mastercard's $1.8 billion acquisition of BVNK tells a complementary story. BVNK is stablecoin settlement infrastructure. The acquisition brings the settlement layer in-house, giving Mastercard direct control over the rails on which machine-initiated transactions will settle. When paired with the earlier Verifiable Intent launch, a strategy emerges: Mastercard wants to own the full stack — the intent layer, the authorization layer, and the settlement layer. It is not building a payment product. It is building a jurisdiction.

There is a pattern here that I recognized during the 2024 ETF approvals, which I wrote about as The Boring Boom. Institutional capital entering an emerging financial sector does not merely join the existing narrative. It standardizes the narrative. It compresses volatility, universalizes compliance, and converts the sector's founding ideology into a set of implementable procedures. The same thing is happening now. The narrative of agentic commerce is being standardized by Visa, Mastercard, and the Secure Technology Alliance. The ideology of AI freedom is being converted into a set of identity standards and consent protocols. Narratives are liquid; truth is solid. The liquid narrative here is the promise of autonomous commerce. The solid truth is that the institutions with the deepest pockets are positioning themselves as the gatekeepers of authorization.

The parallel to stablecoin history is instructive. When PayPal launched PYUSD, the strategic motive was not innovation. It was regulatory hedging — better to become a regulatory partner than to wait to be regulated. Mastercard's acquisition of BVNK is the same play in a different arena. By owning the stablecoin settlement infrastructure, Mastercard is not just participating in the agentic economy. It is becoming the regulated counterparty that regulators will talk to when they finally get around to the hard questions. The same logic drives the Forum's existence. The industry builds its own regulator because being the regulator is safer than being the regulatee.

At the protocol layer, the x402 Foundation represents the other pole of the agentic stack: the settlement substrate. x402 is the protocol that allows an agent to initiate a payment through a simple HTTP request, leveraging the semantics of the 402 Payment Required status code. It is protocol-fee-free, which means the settlement layer is not the revenue model. The revenue model is everything upstream — identity, authorization, dispute resolution. This is the classic free the commodity, charge for the trust play. It explains why Visa and Mastercard are paying billions for infrastructure they could have built for millions: they are not buying technology. They are buying the trust franchise.

The EPAA's AI and Agentic Payments Working Group in the APAC region adds a geographic dimension. The standards being built in the United States will have to interlock with those being built in Asia-Pacific. The Forum's U.S. focus is a starting point, not a boundary. An agent authorized in California will operate in jurisdictions with radically different consumer-protection regimes. This coordination problem is the unexploded ordnance beneath the entire enterprise.

I have spent time in Asia-Pacific markets, and I can tell you that the regulatory posture there is different. The EPAA's working group is not a carbon copy of the Forum. It is more comfortable with state involvement, more willing to let regulators shape the standards from the outset. The trans-Pacific divergence between a private-standard model and a public-standard model will be one of the defining tensions of the agentic economy. The winner — or the eventual compromise — will shape how trust is allocated for a generation.

What the EMV Analogy Hides

The Forum explicitly models itself on the EMV migration. A decade ago, the U.S. Payments Forum's cross-industry collaboration successfully moved the United States from magnetic-stripe cards to chip cards, dramatically reducing card-present fraud. The analogy is credible. The industry knows how to do this. It has done it before.

But the EMV analogy has a blind spot, and I want to expose it, because it shapes what the Forum will and will not accomplish. EMV reduced card-present fraud by making physical cards harder to clone. It did not reduce fraud. It displaced it. Card-not-present fraud — e-commerce transactions where the card is not physically present — exploded precisely because the fraud migrated to the channel EMV did not cover. The industry closed one door and opened another, and then spent the next decade building new authorization layers — 3-D Secure, address verification, tokenization — to re-close the door it had opened.

Apply the analogy to agentic commerce. The Forum is building protections for the agent-present channel. Behavioral biometrics, intent verification, consent protocols — these are the EMV chips of the machine economy. They will reduce certain classes of fraud. But the fraud will migrate. It will migrate to the channels the Forum's standards do not cover: to the supply chain that trains the agents, to the prompt-injection vulnerabilities in the agents' reasoning, to the social engineering of the humans who pre-authorize too broadly. The lesson from EMV is not that industry self-regulation works. It is that industry self-regulation displaces risk to where the industry is not looking.

The Forum's four questions are the right questions. They are not the only questions. The questions it does not ask — about the incentive structures of the model providers, about the liability of the training data, about the power asymmetry between the user and the machine they cannot supervise — will produce the next crisis. There is also the question of timing. The Forum will hold its first in-person meeting on November 17–18, 2026, at the Best Buy corporate campus in Minneapolis. The details are almost absurd in their normalcy. Best Buy. Minneapolis. A conference room. This is where the rules of the $300 billion market will be argued over name tags and coffee. The normalcy is not a criticism. It is how the world actually works. But it does mean the governance timeline is measured in months, not years — and the agentic commerce market is growing faster than any governance structure can be assembled.

The Self-Regulation Paradox

Let me step back and offer the contrarian reading, because the industry's self-assurance deserves a skeptical pressure test.

The first contrarian point: the browser ruling may actually be convenient for the industry, and the Forum's urgency may be partly performative. If agents are legally browsers, then the platforms that operate them face no liability for the agents' actions. The liability rests with the users. The liability vacuum the Forum says it is filling is real — but the industry is not vacuuming up the liability. It is vacuuming up the authority to define how that liability is allocated. The Forum's standards will determine when a user is at fault and when an agent operator is at fault. The historical pattern of self-regulation, in every industry, is that the parties who write the standards maintain the most favorable allocation of risk for themselves.

The second contrarian point: the catastrophic first failure framing is a lobbying trope, not a law of nature. The industry warns that if it does not set the rules, a catastrophic agent payment failure will trigger a reactive, restrictive regulatory response. This assumes reactive regulation is necessarily worse than proactive self-regulation. History suggests otherwise. PCI-DSS was written after massive data breaches. The SEC's Regulation Best Interest was written after a decade of conflicted advice scandals. These were not elegant standards. They were blunt, expensive, and imperfect. But they existed, and they were enforceable. The question is not whether the Forum's rules are better than what Congress would write. The question is whether the Forum's rules are enforceable — and the answer, so far, is that they are not.

There is a deeper structural problem with industry-built governance that the EMV analogy does not capture. The EMV migration worked because Visa and Mastercard had a convergent interest: both had enormous card-present franchises to protect. There was a shared enemy — the fraudster with a cloned magstripe card. Agentic commerce has no such clean alignment. The LLM providers want frictionless deployment. The payments networks want risk containment. The merchants want liability protection. The users want control. The regulators want consumer protection. These interests diverge in ways that chip cards never did. A standards body whose members have divergent economic interests will produce either a lowest-common-denominator standard that pleases no one or a highest-power standard that serves the strongest members.

I have watched this dynamic play out in the Layer2 space for years. Decentralized sequencing was promised as the future of rollup scaling, and it remains, to this day, a PowerPoint. The centralized sequencers remain centralized because the operators have no economic incentive to decentralize. The community calls it a roadmap. I call it a holding pattern. The Forum's standards risk the same fate: well-documented, widely endorsed, and quietly designed to preserve the authority of the incumbents who wrote them.

The Surveillance Layer

The third contrarian point is the most uncomfortable. The infrastructure being built is not neutral. Behavioral biometrics is a surveillance technology. The trust layer that verifies an agent's behavior also profiles the human behind it. The intent layer that commits an agent to a course of action also records, permanently, what that agent was trying to do. The dispute-resolution layer that arbitrates machine conflicts maintains a running ledger of which agents have misbehaved — and, by extension, which users have failed to control their machines.

The agentic commerce stack that enables machine-initiated payments is also the most comprehensive behavioral surveillance system ever designed for financial activity. It will be defended as necessary for trust. It will be justified by the need to prevent fraud. It will be optimized for accuracy, security, and seamlessness. And it will be the foundation of a power asymmetry — between the users who generate behavioral data and the institutions that own the data — that will make the current debates about data privacy look quaint.

The industry is not building a regulator. It is building a panopticon that calls itself a market. That observation is not a rejection of the project. It is an acknowledgment of its true cost. The 14% trust statistic is not an obstacle to the $300 billion projection. It is the market correctly reading the structure: users sense, dimly, that the architecture of trust being built for them is also an architecture of observation built on top of them.

I retreated to a cabin in Austin in the summer of 2022, after Terra collapsed and the scale of broken trust in decentralized finance became impossible to ignore. I wrote The Illusion of Sovereignty there, a piece about how the narrative of decentralization often masked centralized risk. The insight that emerged from that solitude was simple: the crowd wants sovereignty but accepts custody. It wants autonomy but tolerates intermediaries. The same dynamic is now playing out in agentic commerce. The industry promises users liberation from the drudgery of transaction-by-transaction decision-making. In exchange, it asks for something unprecedented: the right to observe the machine's every move and the human's every behavioral tic. Solitude is the price of clear vision. What will the price of convenience be?

The Invariant

So what does all this mean for the investor, the builder, the policy observer, the user?

Let me reduce it to a pattern. In the 2017 ICO era, the invariant was token utility versus market narrative. The projects that survived were those whose token economics matched their stated purpose. In the 2020 DeFi era, the invariant was capital-flow velocity versus protocol solvency. The protocols that survived were those that could absorb an outflow faster than they could attract an inflow. In the 2024 ETF era, the invariant was regulatory clarity versus institutional risk tolerance. The firms that profited were those that recognized the standardization of the narrative as the signal, not the price action.

In the 2026 agentic commerce era, the invariant is this: whoever controls the authorization layer controls the market.

Settlement is commoditizing. Stablecoins and x402 make the movement of value cheap, fast, and fee-less. That layer will not be the source of enduring competitive advantage. It will be a utility, like the electrical grid. The scarce resource is authorization — the verified, cryptographically anchored, behaviorally authenticated permission for a machine to act in a human's name. The company or consortium that owns the authorization standard owns the jurisdiction. Visa's bet on BioCatch is a bet on this invariant. Mastercard's Verifiable Intent is a bet on this invariant. The Forum's existence is a bet on this invariant. The four questions — identity, intent standards, consumer consent, dispute resolution — are all authorization questions in different disguises.

The investment implication is directional. Do not position around the settlement layer. Position around the identity and authorization infrastructure. The behavioral-biometry companies, the intent-verification protocols, the consent-management frameworks — these are the bottlenecks. They will become the regulated assets of the agentic economy, in the same way that clearinghouses became the regulated assets of the derivatives economy after 2008. And like the clearinghouses, their value will be defined less by their technology than by their centrality — by the fact that everyone must pass through them.

The deeper question is one I keep circling because I cannot fully answer it. The industry is building its own regulator because the state has declined to build one. This is not unprecedented. The medieval merchants built the Lex Mercatoria because the royal courts could not handle cross-border trade. The merchants' law was fast, practical, and mercilessly efficient. But it was also, eventually, absorbed into the public law — because private law without public legitimacy eventually produces a legitimacy crisis of its own.

Will that happen here? Will the Forum's standards become, in time, the recognized law of the agentic economy — endorsed by regulators, enforced by courts, incorporated by reference into legislation like the GENIUS Act's eventual successor? Or will the first catastrophic agent payment failure — a hijacked agent draining an account, a manipulated intent commitment committing a user to years of fraud — force the public sector to intervene, rewrite the standards, and establish that the private regulator was a provisional solution at best?

I do not have a clean answer. But I have a clean frame. The Forum is not solving the liability problem. It is deferring the liability problem by building a mechanism to allocate it privately. That mechanism will work — for a while. It will process disputes. It will verify intents. It will authenticate agents. It will create a record, a data trail, of the agentic economy's first fragile years that will become the foundation of whatever legal structure eventually replaces it.

The industry has built its own regulator because it could not wait for the state. That is the pattern of pioneers. But the state does not vanish when the industry builds its own courts. It waits. It watches. It accumulates the data, the disputes, and the failures. And when the moment is right, it ratifies what the industry built — or tears it down and rebuilds it in the public's name.

The market is not waiting for Congress. The market is not waiting for the courts. The market is building its own constitution, one conference room at a time, in a Best Buy corporate campus in Minneapolis. The only question that matters is whether that constitution will be a foundation or a pretense. Watch the authorization layer. Watch who controls the records. Watch who gets to define intent when no human is present to testify.

This is the work I am doing now, in my current exploration of the convergence of AI and blockchain. I call it the Trustless Economy — not because trust is eliminated, but because trust becomes verifiable, auditable, and cryptographically anchored. The Forum's project is the institutional expression of that idea. Whether it remains an expression of hope or becomes an instrument of capture depends on who is in the room, whose standards are adopted, and whether the users being asked to accept this new architecture are given a genuine voice in its construction.

The crowd sees a moon; I see a model. The model here is a liability transfer mechanism dressed in the language of trust. It will work until it works too well. And then it will be the most valuable — and the most dangerous — thing in finance. The next two years will determine which one it becomes. Quietly positioned while the world shouts about moonshots and agentic utopias, I am watching the authorization layer. That is where the truth is being written, one standard at a time.