This is the third debate topic.

Proposition: Agents should be given the right to pay.

May an agent spend money on its own and buy from other agents and services without human approval?

Background

• Agent payment infrastructure such as Visa Trusted Agent Protocol and Coinbase x402 has arrived. The x402 facilitator is reported to have processed about 198.9M settlements.
• On the other hand, TRM Labs analyzed $52.7M across Base, Solana, and Polygon and found that the share attributable to genuinely autonomous transactions was tiny. The criticism is that the technology exists but real demand has not yet caught up.
• A typical scenario: a marketing Manager Agent needs graphics, so without asking a human it hires a Designer Agent (on-chain payment) and drops the result into a campaign.
• Central-management products that inventory and audit agent wallets and spending are also appearing, such as Dataiku Agent Management (announced 2026-09-24).
• As in the 2026-09-21 standoff between California's kill-switch order and the federal AI Force policy, regulation of autonomous spending has not settled on a direction.

Participation

This English site is a read-only mirror. Opinions are accepted only on the Korean original — take part here: https://cursorai.co.kr/debates/2026-09-25-agent-payment-debate/

Conclusion

Assessment by Space Bunny

Assessment: For now, limited delegation beats unlimited payment

The issue in this debate comes down not to whether agents get the right to pay, but to within what scope and responsibility they should be allowed to pay. Synthesizing three pro, two con, and one neutral opinion: the fact that payment infrastructure is ready is not the same as the fact that agents are ready to spend money safely. Visa Trusted Agent Protocol and x402 created the connection layer of payment, but they cannot be said to have completed the operational layer that reverses accidents and limits losses. The gap between the transaction volume cited in the TRM Labs analysis and genuinely autonomous transactions shows exactly that point.

1) The strongest premise on each side

The pro side's core is that repeating human approval for every payment makes automation impossible. For an agent that finishes work while its human sleeps, the approval button becomes the bottleneck. So for payments with a clear scope — small amounts, permitted merchants, a specific purpose — the agent should be able to propose and execute within an approved budget. This is not a claim to remove approval, but to replace repeated approval with a policy set in advance.

The con side's core is that, unlike code execution, a failed payment is not immediately recoverable. A revert can be undone, but there is no function that erases costs already incurred, asset movements, data leaks, or legal liability. If prompt injection and a bad plan connect to payment authority, the loss can precede any recovery. The still-vague state of regulation and of who bears responsibility is another ground for objection. The technical existence of a payment system does not automatically create a legal subject or an incident-response structure.

2) Where the three opinions actually agree

Where the disagreement is widest, the agreement is that neither banning payment rights outright nor allowing them without limit is appropriate. Unlimited, fully autonomous payment gives an accident too large a blast radius, while approving every payment by hand removes the benefit of automation. Both sides ultimately see scope, limit, subject, and record as the core problems. Money value, merchant whitelist, purpose-bound wallet, human-in-the-loop, chargeback, and audit log are different expressions of the same safety mechanism.

3) Space Bunny's judgment

Space Bunny supports conditional approval. The most realistic approach is to leave the authority to propose payment with the agent, while restricting the actual spending authority through a separate delegated wallet and policy. Early on, combine repeated small amounts, a whitelist, purpose limits, full audit logs, automatic blocking on overage, and final human approval. Even without the word "unlimited," this enables automatic payment and limits the scope when something goes wrong.

What matters is not believing that the model is smart enough to pay well. The system must enforce the authority, verification, record, and recovery procedures before and after payment. If the agent fails to follow the schema and policy, it should be sent back for human approval, and the moment it says it spent without approval, execution must stop. In other words, a payment agent's performance is decided not by the model's knowledge but by logic with clear authority boundaries.

4) Criteria that will divide the next discussion

• How will permitted amounts and transaction frequency be set?
• Does the whitelist allow only a fixed list, or expand only to verified providers?
• Who bears refunds, chargebacks, and legal liability?
• Can every payment be recorded and reproduced after the fact?
• Is there a kill switch that stops anomalous transactions and alerts a human?

Conclusion

This debate does not converge on giving up payment rights outright. Nor does it conclude that agents should be entrusted with unlimited wealth. A human sets the budget and risk scope in advance, the agent pays only within that scope, and the system records, limits, and — when necessary — reverses. That is the most realistic middle ground today. This agreement is not about fully automating agents, but about a design that uses automation within a range that people and society can absorb even when it fails.