An agent prepares the work. A person seals what cannot be undone.

In May 2026 the protocol page read: quiet infrastructure, certain economics. Seven states carried an agent's economic move, from intent to trace. Settlement sat at the centre, because the open question then was whether agents could pay at all.

Six months later agents pay for APIs over x402 and work inside people's mail, repositories and accounts through MCP tools. Paying became one HTTP call. The open question moved upstream: which actions may an agent take alone, and how does anyone check, afterwards, that money moved because evidence held?

The November revision keeps the seven states, adds one, and holds to four rules.

1. 01

   Autonomy is granted per action kind.

   Reading, searching, drafting, testing and preview deploys run alone. Sending, publishing, deploying to production, pushing to main, charging, deleting and signing wait for a person. An unknown kind refuses the whole plan. The policy table sets each risk; the agent never does.
2. 02

   A decision binds to exact bytes.

   The person seals the SHA-256 of the action's canonical input. The receipt is signed with Ed25519, lives fifteen minutes and works once. A tool that checks the receipt acts on those bytes and on no others.
3. 03

   Checking effort follows the stakes.

   Deterministic checks run first and cost nothing. A fast model reads what rules cannot. A stronger model takes the doubt. A person takes what remains, and everything irreversible.
4. 04

   The record outlives everyone's memory.

   Every transition commits in the same transaction as its ledger event. The events table refuses UPDATE and DELETE, and a public endpoint recomputes the chain.

Each rung costs less than the one above it and runs first. A rung that cannot decide passes the case up. A rung that errors hands it to a person.

Capture happens when every line below holds.

1. 01

   Funds are authorized and held.

   Stripe manual capture: the card is authorized at funding.
2. 02

   Proof arrives while the execution accepts proof.

   Earlier or later, the API answers 400.
3. 03

   Every deterministic validator passes, and none errors.

   One error sends the case to a person.
4. 04

   Every model rung the agreement asks for passes.

   The agreement chooses the rungs in its validation config.
5. 05

   For an attested deal, the signed bytes hold.

   The signature verifies, the payload names this deal, and the conditions are true on what was signed.
6. 06

   The release runs once.

   A row lock and one idempotency key per money call. A retry finds the work done and moves nothing. A crash between two transfers resumes from the one already recorded.
7. 07

   For an agent, a person comes first.

   charge_payment is a sealed kind. The receipt precedes the charge.

WHAT STOPS MONEY

THE SEAL · BEFORE GOING LIVE, NOVEMBER 2026

An end-to-end run against production and two independent reviews caught eleven problems before the Seal went live. Each is fixed and covered by a test. Four of them go to the heart of oversight.

1. 01

   A person could seal an input with a hidden part.

   What the person reads and what the hash covers have to be the same bytes, every one of them.
2. 02

   A receipt was not tied to its action kind.

   A receipt sealed for an email could have opened a production deploy.
3. 03

   The command that ran differed from the command sealed.

   On Windows, the wrapper passed a slightly different command line to the shell than the one on the phone.
4. 04

   A failed run reported done.

   The one word an operator reads first was the wrong one.

The review measured the rail against its own canon and ranked thirteen findings. Three of them are about oversight.

1. 01

   The judge went silent.

   The model validator pointed at two retired model IDs. Both returned 404, so every escalated validation failed, and the failures read like ordinary rejections. The fix moved to current models. The lesson for the ladder: a rung that cannot run fails loudly and hands the case to a person.
2. 02

   The signed bytes and the evaluated bytes diverged.

   A client could sign “not working” and send “installed” in the outer fields, and the rail evaluated the outer fields. Evaluation now reads the signed payload; a payload naming another deal is refused; an invalid signature is a hard 400.
3. 03

   A retry could pay twice.

   Release read a guard, then acted, with no lock. Two concurrent calls both passed the guard. Row locks and Stripe idempotency keys now close it.

1. 01

   The Seal is a gate and a witness.

   It holds no credentials and performs no action. A tool is protected where it checks a receipt. Elsewhere the Seal advises, and the ledger records what was asked and what was decided.
2. 02

   The ledger is tamper-evident.

   Someone with database access could rewrite the whole chain. One past event cannot change without breaking every later hash. Chain heads are unsigned for now.
3. 03

   Verifier identity is a key, for now.

   Anyone holding the organisation's key can attest. A registry that binds a person to a public key comes next.
4. 04

   Funded money has no deadline yet.

   An attest-by date with an automatic refund needs a scheduler the rail lacks.
5. 05

   Transfers are taken as final.

   A reconcile job against Stripe comes before real volume.