The Agent Economy Has Payment Rails and No Truth Layer

An AI agent can now prove who it is, operate under a cryptographically scoped mandate from its principal, and settle a payment inside a single HTTP request. Three rails that barely existed two years ago are carrying real volume today. Each of them governs something the agent does. None of them governs what the agent reads.

Settlement arrived first and moved fastest. Agentic payments on Base crossed 100 million transactions in roughly three quarters, and the composition of that volume has been climbing: transactions above one dollar went from 49 percent of volume in early 2025 to 95 percent a year later. Identity followed in January, when ERC-8004 deployed to Ethereum mainnet with registries covering agent identity, reputation, and validation. Authorization landed alongside it, with AP2 binding agent-initiated actions to verifiable mandates that specify scope, limits, actor identity, and permitted conditions.

Read together, the stack answers three questions with real rigor. Who is this agent? What is it allowed to do? Did the money move? But still untouched is the question that determines whether the transaction should have happened at all, which is whether the data the agent acted on was accurate at the moment it acted.

The gap is tolerable until it isn't

For some of what agents do today, none of this matters much. An agent drafting a memo, triaging a support queue, or generating code operates inside a loop where a person catches the error before it costs anything, and the price of a bad input is a wasted hour, but the calculus inverts the moment it touches a balance sheet. An agent rebalancing a treasury position, marking collateral, pricing a redemption, or releasing a disbursement is converting a data reading directly into an irreversible transfer, usually faster than anyone can inspect the reasoning behind it.

The dangerous case at that end of the spectrum is the agent that does everything right. Picture one that authenticated correctly against its registry entry, stayed inside every limit written into its mandate, settled cleanly, and did all of it on a price that was forty seconds stale, a balance pulled from a source that had quietly changed underneath it, or a reserve figure that had been manipulated upstream. Every rail in the architecture reports success. The audit trail is complete and shows nothing wrong, but the loss is real, and no layer in the stack was designed to catch it.

Four partial answers, each of which relocates the problem

The ecosystem has already produced several responses to this, and they share a common shape: each one simply moves the question somewhere else.

Reputation registries score agents on their history, which helps enormously when choosing a counterparty and not at all here. An agent with a spotless record acting on a corrupted feed will produce a bad outcome with perfect form. Reputation is a lagging statistical signal about behavior over time, and the exposure in question comes from one decision on one input.

Validation registries go further, letting validator contracts publish assessments of an agent's work. This pushes the question one layer outward. The validator is reading data too, and nothing in the design establishes that its reading was any better than the agent's.

Signed responses from data providers are the most common institutional answer, and they prove exactly one thing: that a particular provider asserted a particular value at a particular time. That is provenance of an assertion, and it carries no claim about whether the value was correct. The signature also fails to survive computation. When an agent pulls from twelve sources, filters, joins, and aggregates them into the single number it acts on, nothing attaches to the result.

Human review resolves all of it and dissolves the reason the agent existed. An institution routing every agent decision through a person has traded throughput for latency and headcount, which is a reasonable way to run a pilot and no way to run infrastructure.

What the missing layer actually has to do

The requirement sits underneath all four of those responses. An agent needs to be able to ask a question of a data set and receive back an answer carrying its own evidence: proof that the query ran correctly, over data that had not been altered, producing precisely the result returned. That evidence has to hold up for the counterparty, the auditor, and the smart contract on the other side of the transaction, none of whom have any reason to trust the agent's operator, its logs, or its intentions.

This is the layer Space and Time is built for. As the data blockchain securing onchain finance, SXT lets an agent query onchain and offchain data and return results with cryptographic proof that the computation executed correctly against tamperproof data. The agent's reasoning stops being a claim its operator makes and becomes something a counterparty can independently check before capital moves.

The agent economy spent two years teaching machines to move money without a human in the loop, and it succeeded faster than almost anyone expected. The next two will go to the harder problem, which is establishing what those machines are entitled to believe.