An agent with a wallet

A claim has been making the rounds, and it is a clarifying one. The argument — advanced recently by Cardano’s founder, among others — is that cryptocurrency and AI agents are near-perfect complements: agents are flexible and improvisational, blockchains are rigid and rule-bound, and together they form a kind of neutral system in which autonomous software can transact without a human in the loop. The prediction attached to it is bold — that within a decade, AI agents will hold and move more crypto than people do — and it is not obviously wrong. The infrastructure is already being laid: payment protocols built so that software agents, not humans, initiate settlement, with stablecoins as the medium. Agentic commerce — an agent that doesn’t just recommend a purchase but completes it — is arriving.

Concede the trajectory; something like it is plausible, and the engineering is real. But notice exactly what the enthusiasm is celebrating. It is not only that an agent can act. It is that an agent can pay — and pay on rails engineered, as their central virtue, to be final. That specific combination deserves more scrutiny than the excitement is giving it, because it quietly removes the one safeguard that delegated authority most depends on.

A payment is a different kind of action

Most of what an agent does is, in some fashion, recoverable. A bad draft is discarded. A wrong email can be retracted, corrected, apologized for. Even a misfired calendar invite is a nuisance, not a loss. A payment is none of these. It is a transfer of value that, once settled, is simply gone, and getting it back becomes someone else’s discretion or no one’s at all. When the action you have delegated is money leaving the account, the cost of a wrong decision stops being a wasted minute and becomes a number on a statement you may never recover. Autonomy’s stakes are always highest where the action can’t be undone — and a payment is the canonical action that can’t be undone.

The elegance is the removal of the brake

Here is the uncomfortable part of the “perfect complement” framing. The very property that makes the pairing elegant — that a blockchain is rigid, rule-bound, and final — is, from the standpoint of delegating authority, the removal of a safeguard. The payment systems most people actually use have reversibility built into them, and not by accident: chargebacks, disputes, clawbacks, a bank you can call when a charge was wrong, fraudulent, or never authorized. Those frictions are brakes. They are the recourse that exists precisely because payments sometimes shouldn’t have happened. Crypto’s design goal — its selling point — is to eliminate them: settlement that is final, immutable, irreversible by construction. Pair an autonomous agent with a rail built to be irreversible and you have combined the most independent actor with the least recoverable action. That is not the best of both worlds. It is taking the brakes off the fastest car and admiring how light it feels.

“Neutral” is doing a lot of work

The appealing version of the idea describes a creative agent governed by a rigid rule-engine and calls the result neutral. But a rule executed flawlessly is only ever as good as the rule, and “neutral” skips the question that actually matters: authority. Who decided what this agent may spend, on whose behalf, up to what amount, for which purposes? When it pays the wrong party — or is manipulated into paying, because an agent with a wallet is the most attractive target prompt injection has ever had — what is the recourse on a rail chosen specifically to offer none? A system that will faithfully and irreversibly execute a manipulated instruction isn’t neutral. It’s unaccountable — a different and worse thing wearing neutrality’s clothes.

The delegation problem with the safety off

We’ve argued before that an agent is not a productivity feature but a delegation of authority, and that delegating responsibly means three things: bounding what the agent may decide, instrumenting the decision so you can tell whether it was good, and keeping a live path to revoke. Agentic payments are that problem in its hardest possible form. The authority handed over is financial. The action is irreversible. And the rail is being selected, deliberately, to foreclose the revocation path. Every safeguard that made delegated autonomy survivable in lower-stakes settings — the ability to notice the mistake, reverse it, claw the money back — is the precise thing being engineered away here, and marketed as the feature. It is the delegation problem with the safety switched off and the cover removed.

What the discipline asks first

None of this is an argument that agents should never transact. For bounded, low-value, well-fenced cases — a metered API call, a small recurring purchase inside a hard cap — letting an agent pay is reasonable, and irreversible rails may even be fine there, because the downside is small by construction. The discipline is in refusing to let that reasonable case quietly scale into unbounded financial authority on irreversible rails because a demo was impressive.

So the first questions are not “can the agent pay” — it can — but the ones the enthusiasm skips. What is this agent authorized to spend, bounded by amount, counterparty, and purpose? Which of its payments are reversible and which are final, and is that finality a choice you made on purpose or one you inherited from the rail without deciding? What is the human recourse when — not if — an agent pays wrongly, and does that recourse still exist on the infrastructure you chose? And who is accountable, given that accountability still does not delegate, and “the agent did it, and the chain is immutable” is about the least acceptable sentence a serious organization could offer a defrauded customer or a regulator?

Grant it like it matters

The prediction may well come true; agents may transact more than people within the decade. The open question was never whether agents will hold wallets. It is whether the people deploying them will have decided, deliberately, what those agents can spend and what can be undone — or whether they will have accepted irreversibility because it arrived bundled with the rail, and called the bundle progress. An agent with a wallet is the delegation of the one kind of authority you cannot take back. That is not a reason to withhold it forever. It is a reason to grant it the way you would grant anything irreversible: narrowly, instrumented, and on purpose — not because a near-perfect complement made it sound inevitable.