Before our payments agent could move a single dollar, we put three limits on it. A hard cap on what it is allowed to spend. An expiry it cannot extend. And a switch, outside the agent, that takes its authority away mid-action, whether it cooperates or not.
Colleagues thought the cap and the switch were overkill. Every action the agent takes is signed and logged, they said. What else do you want?
That question is the whole problem. A signature proves what the agent did. It does not prove the agent was asked to do the right thing, and it does nothing to stop it while it is doing the wrong one. Making an agent sign is nearly free. Bounding what it may do before it acts, and taking that authority back while it is acting, is the part almost nobody ships.
Crypto has been paying for that gap in nine-figure sums for years. Which makes the assurance question narrower than “did the agent do the right thing”. Can you prove its authority was bounded before it acted? And can you take that authority back when you are wrong?
A perfect signature on the wrong intent
Take Bybit. On 21 February 2025 it lost roughly $1.5 billion, the largest crypto theft on record at the time, and not because of a flaw in the code holding the money. The wallet required several people to approve any transfer, and all of them approved it. Every signature was valid.
What they approved was not what they saw. Malicious code sitting in the signing screen woke up only when the signers went to move funds. It showed them a routine transfer, correct address and all, while the transaction they actually signed handed over control of the wallet. The keys held, the hardware held and the approvals held, and all of it was defeated anyway, because the thing displayed and the thing signed were two different things. Checking the signature would never have caught it. The signature was never the weak point.
An agent fails the same way. It reads its context, which might be a prompt or a document it retrieved or a tool result, and then decides what to do. Change the context and you change the decision, and the agent signs off in good faith.
That is Bybit’s fake screen, moved from a human signer to a machine one, and it is already documented. Google’s Agent Payments Protocol has an agent sign a mandate, which is a record of what the user agreed to buy. A systematic analysis of the protocol found those mandates protect the transaction only after it is signed, while the messages and tool calls that decide what goes into the mandate sit outside that protection entirely. Red-team work on the same protocol shows prompt injection doing exactly that.
A non-repudiable record of a manipulated decision is just a well-signed mistake. If your evidence of assurance is “every action was signed”, a well-signed mistake is exactly what you will certify.
The same gap is opening in the newest payment rail built for agents. x402 revives an old HTTP status code so an agent can pay for a service on its own, and it is past the demo stage, with 130 million transactions behind it and support built into Google Cloud, Cloudflare and Stripe. Researchers attacking live deployments arrive at the same two defences, which are to filter the request and enforce a spending limit before it leaves rather than review what happened afterwards. Those are the two controls I was mocked for building in.
The only thing genuinely new is the timing. For once the holes are on record before the nine- figure loss, not after.
Authority that outlives its purpose
Revocation is the other half, and crypto has a receipt for that too.
The Ronin hack of March 2022 cost about $624 million. Months earlier, to cope with a surge of traffic, one company had been given permission to sign transactions on a partner’s behalf. The arrangement ended that December. In the team’s own words, it was discontinued, “but the allowlist access was not revoked”. That leftover permission supplied the last signature the attacker needed, and the theft went unnoticed for six days.
A permission that should have been temporary became permanent, and permanent permissions are what get drained. Most agent frameworks recreate that condition exactly, handing out long-lived tokens and letting short expiry windows stand in for real revocation.
Taking an agent’s authority away the moment it misbehaves is often not something the platform can do at all. The standards for doing it cleanly are not there yet either:
- The W3C’s revocation mechanism does not mention agents anywhere. It works by publishing a list of cancelled credentials that verifiers download and are told to cache. Good for privacy. No use for stopping something that is happening right now.
- The IETF’s agent-authentication draft is blunter about itself. It is one person’s submission, adopted by no working group, and it states that it has no formal standing in the IETF standards process.
Three questions I ask
When I assess an agentic system, the questions I want answered are not about the model’s accuracy.
- Can its authority be revoked mid-action, from outside the agent, with a test that proves it actually stops something in progress?
- Is every action capped before it fires by a spend limit, a permission boundary or a reversibility gate, enforced by the platform rather than requested in a prompt?
- Was the intent path attacked on purpose, with injection through every context source the agent reads, before deployment rather than after an incident?
The answers should be evidence, not assurances.
Where the frameworks stop
None of that falls out of the governance frameworks as they are usually applied. NIST’s AI Risk Management Framework is voluntary and certifies nothing. ISO/IEC 42001 attests that you run an AI management system, not that one money-moving agent survives an attacker.
Both are useful scaffolding. Neither is the thing crypto was forced to build, which is an enforced expectation that you attack the system yourself before real value is exposed. The paperwork crossed over to AI faster than the muscle did.
Where the analogy breaks
A smart contract is deterministic. You can prove it does what its specification says. A model is not, and you cannot, so do not promise anyone you will verify an agent’s behaviour the way an auditor verifies code. You bound it and you test it. You do not prove it.
And Bybit was not an AI system at all. It was people signing what they were shown. That is exactly why it is clarifying. Strip out the model and the autonomy, and what is left is the failure that beats perfect cryptography every time. Approve the wrapper, not the intent. Agents inherit that whole.
Assurance you add after the first big loss is not assurance. It is a post-mortem. Crypto had to write its controls in blood, because the money was already on-chain when the lessons landed. AI still has the sequence the right way round, for a little while longer, because the failure modes are documented before the losses.
Treat revocable, bounded authority as a precondition, not a feature, and you will not be the one writing the post-mortem.
