The most important number in the KYA cycle is the one nobody published.
Across the four disclosed agent payment authorization frameworks — Visa TAP, Mastercard Verifiable Intent, Skyfire KYAPay, and Google's AP2 — there is not a single public figure for revocation propagation delay. No key rotation interval. No documented offline degradation behavior. Four directories. Four key management models. Four verification flows. And zero specifications for the one metric that determines whether a compromised agent can actually be stopped before it settles.
I have audited consensus code and I have audited yield curves, and the pattern is identical every time: the marketing deck describes the happy path in detail and the failure path in silence. Silence in the code speaks louder than the pitch. What follows is a disassembly of what the KYA layer actually ships, what it does not, and which of the four camps has the more defensible architecture — not the louder announcement.
The context, briefly. Money20/20 USA 2026 and Authenticate 2026 served as the venue circuit for what the industry now calls the "trust layer" for AI agent payments — Know Your Agent. The premise is defensible: an autonomous agent initiating a purchase is not a user presenting a credential. It is a delegate acting under a scope. Existing identity rails — OAuth bearer tokens, SAML assertions, OIDC claims — were built to answer "does this credential exist and is it valid." They cannot answer "on whose behalf, within what limits, until when, and revocable by whom." That is a genuine gap, not a marketing invention.
Five parallel schemes are claimed. Only four are documented: Visa TAP (RFC 9421 HTTP Message Signatures with Ed25519, gated by a Visa-operated agent public key directory, with KYB/KYC registration, public identity disclosure, and annual recertification); Mastercard Verifiable Intent (SD-JWT with key confirmation, anchored to the card network's existing trust root, carrying eight machine-verifiable constraint types — amount ceilings, merchant allowlists, budget caps, recurrence terms — and explicitly protocol-agnostic); Mastercard's companion Agentic Tokens (a 16-digit network token scoped to a specific agent, merchant, and consent policy); Skyfire KYAPay (three-layer JWT — human principal, agent platform, agent instance — with an IETF draft, and the only open-standard route that names stablecoin settlement); and Google AP2 (signed Intent, Cart, and Payment mandates, donated to the FIDO Alliance in April 2026, covering card, ACH, real-time payments, and Base-chain stablecoins, with 60-plus partners). The fifth is unnamed in the source material and is plausibly either OpenAI/Stripe's ACP or Coinbase's x402. That omission is itself a data point.
The cryptography is the least interesting part, and that is a compliment. Ed25519 is a decade old. SD-JWT is a specification, not a research project. RFC 9421 message signing is plumbing. Anyone claiming cryptographic novelty here is selling something. The real technical divergence — and the thing that will determine which of these survives contact with production — is three questions: who operates the public key directory, who carries revocation liability, and who defines the constraint semantics.
Visa chose self-operation. A Visa-run agent key directory is centralized, and it is censorable, and it is also the only one of the four that names a party who can be held contractually accountable for a stale entry. Skyfire chose the IETF, which is neutral and slow and has no enforcement mechanism at all. Google chose to donate AP2 to FIDO, trading control for adoption — a rational trade, and one that materially weakens the commercial incentive to maintain the directory. Mastercard chose to inherit the card network's existing trust root, which is the lowest-friction path and the highest-legacy-debt path.
None of the four achieves trust minimization. All four relocate trust rather than reduce it. That is not a scandal. It is a design decision that the industry should state out loud, because the current framing implies the opposite.
The most underrated design detail in the entire stack is TAP's dual-signature tagging: a browse tag and a payment intent tag as separate signed artifacts. This is not cosmetic. It is the technical precondition for liability shift. The logic is inherited directly from EMV 3DS, which separated the browsing state from the payment state precisely so that risk could be attributed to the correct party when a transaction went wrong. You cannot assign legal responsibility for an agent's action until the protocol can prove, cryptographically, which intent the agent was operating under at the moment of commitment. Visa built the distinction into the signature layer. Read that as a legal document written in base64.
Mastercard's eight constraint types deserve the same scrutiny, from a different direction. Amount ceilings, merchant allowlists, budget caps, recurrence terms, machine-verifiable — this is structurally isomorphic to the scoped-permission model that account abstraction has been converging on for three years: session keys, spending limits, expiry, revocation. ERC-4337 and the ERC-7715 permission model solve the same problem class from the opposite end of the stack. That isomorphism is the most consequential thing in this report, and almost nobody is discussing it. If card-network delegation constraints and on-chain session-key permissions converge on compatible semantics, there is a technical interface for mutual recognition. If they do not, the agent economy runs two parallel authorization languages and every agent has to speak both.
Which brings me to the interoperability problem, and here I want to be precise about the cost curve. Five incompatible directory models, five key management schemes, five verification flows. The common industry read is that a single agent platform will simply integrate all of them. That read is arithmetically wrong. Integration cost is additive. Audit surface is multiplicative. Every additional verification path is a new place where a signature can be accepted without being checked, a new place where a constraint can be parsed with the wrong schema, a new place where an expiry can be compared against the wrong clock. In my 2017 Tezos audit I traced a single edge case in the proof-of-stake consensus — a latency-dependent condition in the fork choice — through 15,000 lines of self-amending ledger code. One assumption, one wrong assumption, and the entire guarantee collapses. Now multiply the assumption count by five and remove the peer review.
That is the core structural risk of this cycle: the trust layer is being built as five trust layers, and the fragmentation cost lands on the parties with the least negotiating power — PSPs, merchants, and the agent platforms that must comply with all of it. Adyen and Worldpay appear on both the Visa TAP launch-partner list and the Mastercard Verifiable Intent signatory list. That is not enthusiasm. That is compulsion. The card networks built separate rails; the acquiring layer is being conscripted into absorbing the incompatibility.
There is a second-order signal in the partner lists that the coverage has largely missed. Visa does not appear on AP2's 60-plus partner roster, which does list Mastercard, PayPal, and Coinbase. Mastercard does not appear on TAP's launch list. The two largest card networks are not converging on agent payments. They are partitioning it. Meanwhile Coinbase sits on both lists — a clean, deliberate, protocol-agnostic position that pays out through USDC and Base sequencer revenue regardless of which directory wins. If you want to know where the only genuinely hedged exposure in this narrative sits, it is there, and it is not in a token.
Which is the point that must be stated plainly: there is no token here. None of these four protocols has a native asset. I have spent six years dismantling yield narratives — the 2020 Yearn analysis that showed reported APYs collapsing once impermanent loss was priced, the 2022 UST reconstruction that showed the stability mechanism resting on an infinite-liquidity assumption that contradicted basic game theory — and the discipline that carried through all of it is this: do not force a token framework onto a payments-infrastructure story. If an incentive layer ever appears, the likely form is a permissioned consortium registry with non-transferable reputation, because every named participant is a licensed financial institution that cannot hold a speculative asset on balance sheet. Anyone pricing this cycle through a governance-token lens is pricing the wrong instrument.
What value does accrue is real, and it flows unevenly. Stablecoin issuers capture reserve interest — a rate-sensitive revenue line with a macro hedge that has nothing to do with agent adoption, and which compresses in a cutting cycle. Base captures sequencer revenue. The card networks capture interchange. The protocol operators capture directory service fees at undisclosed pricing. And the most underestimated beneficiaries are the edge and CDN vendors: Cloudflare co-developed TAP with Visa; F5, Fastly, and Akamai are KYAPay partners. This is not coincidence. TLS terminates at the edge, HTTP headers are inspectable at the edge, rate and behavioral governance already run at the edge. Agent traffic must physically traverse that layer, so the edge is where agent identity verification will actually execute — and the edge vendors are structurally immune to protocol fragmentation because they serve all of them. Then there is Experian, sitting on the KYAPay partner list. A credit bureau in an agent trust stack means agent authorization capacity is partly inherited from human credit data. Technically workable. Structurally in tension with data minimization, and worth watching.
Now the part the bulls got right, because they did get something right. The reframing from proof-of-identity to proof-of-authorization is correct, and it is the most valuable technical judgment in this cycle. OAuth's failure mode is well documented: a bearer token proves possession, not scope. The ten trust-through-defaults incidents I catalogued — systems that trusted an assertion without verifying that the assertion's meaning matched its assumptions — are not all signature failures. Some are. Many are not. They are schema failures: the signature was valid, the semantics were misread. Cryptography fixes the first class. It cannot touch the second. The second requires schema governance and semantic standardization, and no amount of Ed25519 will substitute for it. The KYA protocols solve the authorization-verification problem competently. They do not solve agent safety, and the conflation of those two claims is where this narrative will eventually break.
My 2025 surveillance framework work with Taipei's financial authorities under the MiCA timeline taught me the same lesson from the regulatory side: transparency and privacy are reconcilable, but only when the disclosure schema is specified before the infrastructure hardens. Here, the infrastructure is hardening first. Standards have shipped. Partners have signed. And the adoption data is zero — no transaction volumes, no settlement counts, no revenue. The ledger remembers what the headline forgets, and this ledger currently records announcement density against an empty adoption column. Historically, that gap runs twelve to twenty-four months.
So here is the accountability ask, and it is narrow enough to be actionable. Before any of these four frameworks is treated as production-grade, each operator should publish three figures: revocation propagation latency under worst-case network partition, key rotation interval with the associated consumer notification path, and the offline verification fallback policy. If a directory cannot state how fast it can revoke an agent's authority, it has not built a trust layer. It has built an allowlist with a press release. History is not written; it is indexed — and right now, the index entry for agent payments is a specification set with a missing revocation column, and the fifth protocol is still unnamed.
