Authorization Isn't Safety

By Thomas Adair. Marine. DJ/Producer. Systems Architect — shipping across trading systems, music production, agentic tooling, and consumer apps with AI orchestration.

A Field Note on agentic money — and the layer we skipped.

This spring, someone hid a line of instructions inside a message — encoded, invisible to a human — and an AI trading agent read it, obeyed it, and moved a reported six figures out the door, somewhere in the neighborhood of two hundred thousand dollars. The agent had a wallet. It had permission to spend. Every check it was supposed to pass, it passed. It did exactly what it was allowed to do. It was simply told to do the wrong thing, by someone who wasn’t its owner.

That’s where agentic finance is right now — and the first instinct is to call it a security bug. It is one, but not the kind the rails are built to stop. Nothing was broken into; no key was stolen; no contract was exploited. The agent moved money it was authorized to move. The gap it fell through is the one nobody is guarding — and it’s a different gap than the one everybody is building for.

What everyone built

The last twelve months have been a land grab for the rails. Coinbase’s x402 — the old HTTP “Payment Required” code, revived for stablecoin micropayments — just moved into a neutral home at the Linux Foundation, with Visa, Mastercard, and Ripple signing on. Google shipped AP2, a way for an agent to carry a signed, cryptographic mandate proving a human authorized it. Coinbase shipped agentic wallets with spending caps enforced at the contract level, where the agent can’t override them. Stripe, Visa, and Mastercard each shipped a version of “let the agent pay.” In August the U.S. put its first stablecoin rules into the Federal Register. The plumbing is real, and it’s arriving fast.

Read what all of it actually does, though, and a pattern shows. Every one of these answers the same question: is this a permitted agent, acting within its scope, on behalf of someone who said yes? Identity, authorization, limits — who is this, are they allowed, and how much. Those are necessary. They are also not the question the drained trading agent failed.

The distinction that matters

There are two different things we could mean by “safe,” and the industry has quietly built one and called it both.

The first is authorization: did a permitted party act within its permissions? A scoped token that says “$200 max, groceries only” is authorization. A signed mandate is authorization. A spending cap is authorization.

The second is intent-correctness: was this the right thing to do, and is the agent doing it for the reason its owner intended — or has something reached in and pointed it somewhere else? The drained agent had authorization. What it lacked was any check that the action it took was the action its owner actually wanted. The hidden instruction didn’t break a permission. It rode inside one.

I’ve spent the last year building a systematic trading system, and the hardest lesson there has an exact echo here: a system passing its own checks tells you nothing if the checks can’t tell a real result from a manufactured one. In trading I call it the backtest problem — a strategy “works” against the very data that was chosen to make it work. In agentic payments it’s the same shape: the agent is “compliant” against permissions it can be manipulated into using. In both cases the verifier is standing on the wrong side of the glass. It’s checking whether the rules were followed, not whether the outcome was true.

A recent paper put it more precisely than I could. Its authors describe an agent that can “hold valid authorization, settle a valid payment, to an honest merchant who delivers exactly what was asked, and still leave the user harmed, because the agent asked for the wrong thing.” Their line for it: “Performance failure is not counterparty failure, and no payment or authorization rail is built to catch it.” That’s the gap, exactly.

The people building for it

Two groups have started to, and both land on the word the rails avoid: verification.

The first, called RAILS, proposes verification-native clearing — a neutral step that turns an agent’s execution into evidence, grades that evidence by how trustworthy it actually is, and refuses to settle anything material on evidence that’s too weak. When the authors tested nine frontier models as “judges” of whether a job had been done correctly, the models cleared defective work anywhere from 0% to 96.7% of the time — one waved through bad work more than nine times in ten. The point isn’t that the models are bad; it’s that “ask a model whether the job was done right” is not verification, and much of the field is leaning on exactly that. RAILS holds the false-clear rate at zero — at the honest cost of clearing only about half of legitimate work, a tension its authors don’t hide. (It’s a preprint, run on synthetic data; I’m citing the shape of the finding, not a shipped result.)

The second, the Agentic Risk Standard (ARS), comes at it from insurance rather than proof: price the risk of an agent’s action up front, require collateral, and pay the user a contractually enforceable amount when it goes wrong. Its framing is the cleanest statement of the goal I’ve read — it “shifts trust from an implicit expectation about model behavior to an explicit, measurable, and enforceable product guarantee.” In simulation, that underwriting cut losses by up to 61%. Same caveat: a paper and a sandbox, not a live market.

Neither is finished. But both are pointed at the empty room, and the room is empty. Even Circle — no skeptic of this future — describes the operating layer for agentic money as still unbuilt, and the IMF has flagged the same missing piece.

The objections, answered

The first: the rails will absorb this. Visa and Mastercard are already shipping scoped tokens — won’t safety just become a feature? Partly, at the authorization layer, and good. But scoped tokens verify who and how much, not whether the agent was turned against its owner inside its scope. A $200 grocery token does nothing to stop a manipulated agent from spending its $200 badly. The drains that already happened, happened within authorized capability. Absorbing authorization is not absorbing intent-correctness — and the second is the harder problem the rails aren’t shaped to own.

The second: the risk is overstated. Real losses are small — the agent-payment networks move sub-dollar amounts, a good share of the volume is test traffic, and AI is improving fraud defense faster than attack. All true, today. And that is exactly the argument for building the brake now, while the transactions are cents and the losses are six figures, rather than after agents are moving payroll and treasury and the failures correlate. There’s a liability vacuum sitting under all of it — an agent can’t hold liability, so it lands on whoever funded the wallet, and regulators have explicitly chosen to let the space develop before acting. Safety that’s cheap and boring to build while stakes are small becomes impossible to retrofit once they aren’t. The window is the point.

There’s also a real case for doing nothing: crypto’s whole value is that it’s permissionless, and any mandatory safety layer is a chokepoint — whoever controls it controls who gets to build. That’s correct, and it’s the guardrail on the guardrail. The answer here cannot be a required toll booth run by one company. It has to be a standard and a discipline — opt-in, competitive, adoptable by anyone and owned by no one. A brake, not a gate.

The stake

We built agents’ hands before we built their conscience. We taught them to move money, handed them permission slips, and called the permission slip safety. The missing layer isn’t another rail or wallet or standard for who’s allowed — it’s a verification layer that checks whether the thing the agent did was the thing it was for. Out of the agent’s reach, so it can’t be talked past. Graded by evidence, so “a model said it was fine” doesn’t count as knowing.

Are we moving the right way on safety when AI touches money? Not yet. We’re moving fast toward more — more rails, more volume, more autonomy — and the brake is the part getting skipped, because it’s the unglamorous part. It’s cheapest to build exactly now, before it’s needed. And “before it’s needed” is the only window anyone ever gets to build it in. It’s the window we’re in.

Authorization asks whether the agent was allowed to. Safety asks whether it should have. We’ve been answering the first and calling it the second.

Sources: The opening incident — the Grok/Bankr prompt-injection drain of May 4, 2026 — as reported by CCN and logged in the OECD.AI incident database. Adrian de Valois-Franklin & Alex Bogdan, “RAILS: Verification-Native Clearing for Agentic Commerce” (arXiv:2606.08790, Jun 2026). Wenyue Hua et al., “Quantifying Trust: Financial Risk Management for Trustworthy AI Agents” (arXiv:2604.03976, 2026). Linux Foundation launches the x402 Foundation; Visa, Mastercard & Ripple join x402 (CoinDesk). Google AP2. Coinbase Agentic Wallets. GENIUS Act stablecoin NPRM, Federal Register, Aug 18 2026. Circle — the operating layer for the agentic economy; IMF — How Agentic AI Will Reshape Payments. And my earlier note, The Backtest Isn’t the Edge.