The protocols say what an agent may spend, not who it works for

Agent payments were most of a conference track this week. In one talk from September 1, an Edge and Node demo has a coding agent buy a Father’s Day gift under ten dollars through a Shopify checkout, then runs a second wallet into a compliance screen that rejects it as sanctioned. Their framing is that the old rails assumed a human in the loop, agents transact at machine speed and around the clock, and the controls have to move.

A few lines down the same week’s radar is a post claiming Google’s AI Mode surfaces the same products 21.6 percent more expensive than traditional search. I have the headline and 394 points on Hacker News and nothing else, so take the method from the source rather than from me. Claude for Commerce Agents sits nearby on the same list.

Concede the strong version of the payments case. Compliance really is the blocker, a chief legal officer signs off or nothing ships, and screening a counterparty is a real answer to a real question. Nobody is approving a thousand tiny payments by hand.

The vault’s protocol notes map what is actually getting standardized. JSON Schema for the shape of data, structured outputs for the reply, function calling for the request, MCP for the tools and resources a host can reach, A2A for discovery, messages, tasks, artifacts, and auth between independent agents. On top of that, minimum exposed capability plus receipts, with approvals for spending and external writes.

Read the list again and notice what is missing. Every layer answers what an agent may do and how it proves who it is. None of them answers whose interest it serves when two products both satisfy the instruction and one of them pays better.

A rail that cannot be talked into overspending is still just a rail. Where the money goes is a question about incentives, and incentives do not have a spec.