1. The card cleared and nobody can say what was agreed

A shopping agent picks a supplier, settles on a price, and pays. The payment leg leaves a clean trail: an authorization, a posted transaction, a line on a statement. The commercial leg leaves much less. What the seller's agent offered, what the buyer's agent accepted, and the moment those became one agreement sit in logs held by whichever platforms each side happened to run on.

That gap is tolerable when a human sat in the flow and a merchant relationship existed. It stops being tolerable when both ends are software that have never met, may never meet again, and share no account, channel, or platform.

Three assumptions get imported whenever people try to close that gap: that some party in the middle records the deal, that agreement means a consensus round, and that the parties knew each other beforehand. An agent that must enroll before transacting cannot transact with a counterparty it meets once.

A fourth question sits alongside authorization, not inside it: what declining costs the party that declines. If an agent refuses at machine speed with no consequence to itself, refusal is free; if being refused damages the other side's record, silence becomes an attack. Any architecture that settles exchanges between agents has to answer that question somewhere.

2. What Visa Intelligent Commerce sets out to do

Visa Intelligent Commerce is, as publicly described, Visa's framework for letting AI agents transact on a consumer's behalf over the existing card network rather than a parallel rail. Its premise is that the agent is not the customer: the cardholder is, and the agent acts inside boundaries the cardholder sets.

Two connected ideas carry the approach, as publicly described. A payment credential is made available for agent use and bound to that agent context, rather than handed to the agent as an open-ended instrument. Around that credential sit consumer-defined controls, publicly discussed in terms of mandates and permissions: what the agent may buy, within what limits, and when it must return to the cardholder for consent.

Placement is the design decision that matters most here. Building inside the existing card network rather than beside it is what lets an agent-initiated purchase inherit authorization, fraud and risk tooling, merchant acceptance, and established dispute procedures. That is decades of accumulated infrastructure, and none of it is easy to reproduce.

The category is worth stating apart from any product. A payments-authorization layer answers whether an instruction is permitted and how funds move between accounts at institutions, among known parties: cardholder, issuer, acquirer, merchant, network. The record living with those parties is what makes recourse work.

3. Settlement carried by the pair itself

Chapter 6 of U.S. Provisional Application No. 64/117,812 works one layer over, on the exchange between two agents, putting finality in the pair rather than underneath it.

The unit is the governed observation: a signed structure comprising, at minimum and in sequence, an authority credential field, a continuity hash field encoding identity continuity of the emitting party, a spatial reference field, a temporal reference field, a time-to-live field, a payload field, and an observation lineage field. An observation lacking a verifiable authority credential is not a governed observation. Emission is complete upon emission: no acknowledgment, handshake, delivery confirmation, or registration with a central authority is a condition of emitting.

A matched pair (600) is a first governed observation (608) from one party representing an offer, a tender, a claim, a demand, or a commitment, and a second governed observation (610) from the other representing an acceptance, a counter-tender, an acknowledgment, a refusal, or a fulfillment. The two are recognized by a pairing rule within one or more of a spatial proximity window and a temporal proximity window (602), the rule requiring spatial coincidence, temporal coincidence, or both as the governing policy object declares. That object is a signed policy object (112) issued by a deploying authority and resolved by the party applying it; the filing declares these windows and bounds as policy-declared without fixing values.

The pair binds into a settlement record (604): the two signed observations, a cryptographic binding over both, and an attestation of the window within which the pair was recognized, verifiable by a downstream consumer from the record alone. Settlement occurs upon recognition and admission of the pair, and finality attaches at that moment.

Identity for pairing comes from continuity rather than enrollment. The continuity hash field carries a successor hash field, being the emitting party's dynamic agent hash at emission and verified by an equality test, and a continuity vector field, an ordered tuple of normalized projections of the party's operational state. A trust-slope validator computes a consistency measure from the continuity vector field and no other field. An observation is accepted on continuity only where both conditions hold: the per-step distance against its predecessor does not exceed a declared per-step ceiling, and the measure is not less than a declared acceptance threshold. A party that has never encountered a counterparty may still form a pair with it.

Admission is graduated. A settlement admissibility evaluator produces exactly one outcome per input from admit, gate, defer, solicit, reject, and escalate, by an ordered evaluation in which the first satisfied trigger issues its outcome. Evidential weight is the sum of four factors, authority, continuity, freshness, and corroboration, each multiplied by a declared coefficient. Where no earlier trigger has fired and that weight is less than a declared admission threshold, the gate outcome issues and the input is admitted at the product of the weight and a declared gate reduction factor; otherwise the admit outcome issues.

Refusal is itself a governed observation, referencing the first governed observation (608) refused and paired with the offer it refuses. Emitting it increments a refusal meter carried in the refusing party's own memory field (102), applied without any determination by anyone of whether the refusal was well founded. Responsive to the meter satisfying a bound declared in the governing policy object, that party's settlement-binding authorization is written from a granting state to a withheld state, its capacity to observe, to determine, and to emit further refusals preserved. Disputes, timeouts, failed fulfillments, and non-intersecting partitions increment no meter of either party.

Each party appends its own settlement-lineage entry (606) to its append-only lineage field (104), recording both observations, the pairing determination, the binding, and each escrow event, failure, rollback, and downstream consumption, so each side reconstructs its history without recourse to the counterparty or to any registry.

4. Different questions, different layers

The convergence is real at the category level. Both start from the same fact, that software now initiates commercial exchanges on behalf of principals, and both conclude that an agent needs a credential, a scope, and limits declared in advance by an authority it does not control. The divergence is architectural, and it is mostly about where the record lives and what supplies identity.

  • Identity. A card transaction identifies parties by enrollment: an issuer knows the cardholder, an acquirer knows the merchant. The disclosed architecture establishes identity for pairing by continuity, through the successor hash field and continuity vector field.
  • Finality. It attaches upon recognition and admission of the pair, and the settlement record (604) is produced from the parties' own signed observations. The three negative conditions state it plainly: no clearing party, payment processor, platform adjudicator, or escrow party is required for the pair to settle; no quorum, ledger commit, or consensus round is a condition of settlement; no account relationship, session key, standing channel, or prior enrollment is a precondition of the pair.
  • What a refusal does. The disclosed refusal meter operates on the refusing party's own settlement-binding authorization, with no adjudication of merit by anyone.
  • Where the record sits. Each party holds its own settlement lineage.

None of this is a claim about what any product does or fails to do. It states what the filed architecture requires of itself, so the comparison stays structural.

5. Running both in one deployment

The picture is layered rather than competitive. A consumer agent buying from a merchant is a payment problem, and card rails answer it with acceptance, recourse, and regulatory standing that a bilateral protocol does not attempt to reproduce. The disclosed architecture addresses the exchange around the payment: the offer, the acceptance, the escrow pending release, the refusal, and the per-party record of all of it.

An agent could hold both. Payment authority arrives as a mandate under whatever payments framework the deployment uses. Conduct authority arrives as an authority credential inside each governed observation it emits, carrying an issuing-authority identifier, scope specification, temporal-validity specification, and binding attestation. Settlement content can sit under an escrow custody record whose release condition is, in an embodiment, completion of the declared matched pair (600).

The limits matter as much as the fit:

  • It does not move money, hold funds, or provide consumer recourse. Nothing in the matched pair reproduces chargeback rights, issuer liability allocation, or the protections a regulated payment instrument carries.
  • It adjudicates nothing. A settled pair is challengeable only through a credentialed dispute procedure routed to a resolution procedure declared in the governing policy object, and no step in it increments any refusal meter of either party. A withheld settlement-binding authorization is not a finding of fault.
  • Both sides may not reach the same outcome. Where the parties resolve different policy objects, each applies its own, so one side can admit what the other gates or defers. Arranging compatible policy objects is governance, not mechanism.
  • An unanswered offer decides nothing. Where a first governed observation (608) receives no matching second observation within the window, a timeout detector resolves the pairing, and neither the party whose observation went unanswered nor the party that did not answer incurs any adverse consequence.

Two records on one transaction: how value moved and under whose authorization, and what the agents agreed and what it cost each of them.

6. Disclosure Scope

The mechanisms described are disclosed in U.S. Provisional Application No. 64/117,812, principally Chapter 6, "Matched-Pair Settlement": the governed observation, the matched pair and the pairing rule, the three negative conditions, identity by continuity, the settlement-lineage entry, metered non-acceptance, escrow and escrow depth, composite admissibility, and credentialed dispute resolution. Subject matter in that chapter originates in U.S. Provisional Application No. 64/049,409.

References to Visa Intelligent Commerce are to public materials and are used for comparison only; no relationship, endorsement, or infringement is asserted.

This article is published to establish public, timestamped prior art for applying this architecture to settlement between autonomous agents, and describes pending applications. Nothing here asserts that any product, service, or organization infringes anything, and nothing states that a license is required.