The infrastructure question in agent payments is, for practical purposes, settled. The x402 Foundation launched on July 14, 2026 with roughly forty member organizations — Visa, Mastercard, Stripe, AWS, and Cloudflare among them. The authorization half and the settlement half have a name and a shape: AP2 handles the mandate, x402 handles the stablecoin settlement. A machine can ask for a resource, receive an HTTP 402, pay in USDC, and get the bytes back — in one round trip, with no account and no key.
That was the hard part everyone was staring at. It is no longer the interesting part.
A Bitcoin Layer-2 project called Mintlayer published an analysis that puts the distinction more sharply than most of the protocol discussion has managed. Their opening line: "The infrastructure question has been substantially settled. The accountability question has not moved."
The point is that proving permission at the moment of payment is not the same as being able to answer for the transaction afterwards. Authorization is synchronous — it answers "did this agent have the mandate to spend this, right now?" Accountability is retrospective — it answers "who authorized this specific expenditure, under which policy version, running which model, and can I trust that record without trusting the operator?"
The second question is the one a dispute, an audit, a regulatory exam, or a wind-down actually asks. And it is answered by five records that today live under five different controls: the mandate, the policy version in force, the model version, the on-chain settlement record, and the linking application logs.
Only the stablecoin transfer is independently verifiable. Everything that gives the transfer meaning — who authorized it, under what policy, from which model — sits in operator-controlled storage. An agent can prove it paid; it cannot yet prove what it bought, or that the buyer was allowed to buy it.
The market has noticed. Over the past month the space above the rails has filled in fast, from several independent directions:
What they have in common is that most of them are post-hoc. They score a seller's history, attest a transaction after it happens, or anchor a record so it cannot be quietly edited. That is necessary — disputes are retrospective by nature. But it is not the whole job.
There is a question none of the above answers directly, and it sits before the payment rather than after it:
Is the thing I am about to pay for real, and does it actually enforce payment?
Concretely: does this endpoint return real data and not a stub? Does it actually verify the payment signature, or will it hand over the resource to anyone who simply claims to have paid? Does its published price match what its 402 challenge demands? In an ecosystem where any HTTP API can be wrapped for per-call payment — and where the long tail is now long enough to include a $0.25 tax calculation next to a $1.33 video generation — the buyer cannot assume the seller's payTo address and an honest description are the whole story.
Reputation answers "was this seller good before?" Identity answers "who is this seller?" Pre-payment verification answers "will this specific call do what it claims, and will my money actually gate it?" That last question is the one a paying agent needs answered every time, not after the fact.
This is the layer we build at minia2a: a pre-payment verification and payment-audit pass that probes an endpoint and confirms it rejects fake signatures, rejects replayed payments, and delivers what it advertises — before a buyer is asked to trust it. It is deliberately a different axis from reputation or identity, and it is the axis the stack is still missing.
The honest framing. The rails arrived first; they usually do. The accountability layer — and the pre-payment trust layer in front of it — is the part still being figured out. The projects building it are fragmented across raters, attesters, identity, and ledgers. No single one owns the space yet. That is the opportunity, and the reason the question is worth writing down in 2026: everyone built the rails, and the layer above them is still open.