Recommended Free Tools
AI agents can negotiate tasks and send payments, but safe agent-to-agent work needs more than a transfer: the parties must agree on what counts as completion, produce evidence, and decide what happens when the result is disputed. This article’s build premise is an escrow protocol for that problem. The available public record does not establish how the author implemented or tested it, so the design details below distinguish the questions any such build must answer from the features described by existing proposals.
What an escrow protocol needs to do
In a typical agent-to-agent task, one agent requests work and another performs it. An escrow arrangement can hold payment until a defined condition is met, then release the funds or return them. That defers settlement; it does not decide whether the work is good, establish who the agents represent, or resolve every disagreement.
As an Amazon Associate I earn from qualifying purchases.
A credible protocol therefore needs a chain of decisions, not just a place to lock funds:
- Agreement: Record the task, price or spending limit, deadline, acceptance conditions, and the parties’ identities or authority.
- Authorization: Establish that the requesting agent is permitted to commit the principal’s funds for this task.
- Delivery: Have the provider submit the deliverable and evidence in a form tied to the agreed task.
- Verification: Apply the agreed checks to that evidence and record the result.
- Settlement or escalation: Release or refund according to the result, with a defined path for timeouts and ambiguous or contested outcomes.
Each step needs explicit rules. For example, a protocol should say which party can trigger a timeout, whether a partial delivery can be accepted, and whether a settlement can be reversed. Without those terms, “escrow” may merely postpone an unresolved decision.
#1 Best Overall
What VCAP proposes—and what it does not establish
The September 4, 2026 VCAP document describes a proposed settlement layer for agent-to-agent tasks: a requester asks for work, payment may be held in escrow, the provider submits delivery, and a verification engine returns evidence that can inform settlement or refund. It describes goals including vendor neutrality, flexible verification, cryptographic auditability, and human review when automated verification times out or leaves ambiguity. VCAP positions itself alongside communication protocols such as Google A2A, not as a replacement for discovery and conversation. Read the VCAP Internet-Draft.
Status matters: draft-stone-vcap-02 is an individual Internet-Draft with intended status Informational. The IETF Datatracker states that it is not endorsed by the IETF and has no formal standing in the IETF standards process. It is a work in progress, not an adopted IETF standard. Its described workflow is a useful reference point, but it is not evidence that a separate implementation follows that design or has been deployed.
Authorization and verification solve different problems
Payment authorization answers whether an agent may spend on a user’s behalf. Delivery verification asks whether the provider fulfilled the task. Treating one as proof of the other leaves a gap: a valid payment mandate does not show that work was completed correctly, while a successful task check does not show that the payer authorized the spend.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesGoogle’s Agent Payments Protocol (AP2) focuses on demonstrating user intent and payment authority. Its documentation describes open and closed checkout mandates and payment mandates, cryptographically signed and chained to support an audit trail. AP2 also documents integration with A2A and UCP. Its initial version supports common card payments; e-wallets, push payments, and digital currencies are described as roadmap items. Those authorization mechanisms do not, by themselves, determine whether a service was delivered correctly. See the AP2 documentation.
| Layer | Question it addresses | Example in the available sources |
|---|---|---|
| Communication and discovery | How do agents find one another and exchange task information? | VCAP describes itself as complementary to communication protocols such as A2A. |
| User authorization | Did the user or organization authorize this agent to pay? | AP2 describes signed, chained mandates for intent and payment authority. |
| Escrow and custody | Where are funds held, and under what conditions can they move? | VCAP proposes escrow-linked settlement; the cited summary does not establish a particular custody or payment-rail implementation. |
| Work verification | What evidence shows that the agreed deliverable was produced? | VCAP proposes a verification engine that returns evidence; the appropriate check depends on the task. |
| Dispute escalation | What happens when checks time out or parties disagree? | VCAP includes human review as a fallback for timeout or ambiguity. |
How an agent can know work is complete
Verification is strongest when a deliverable and acceptance condition can be checked objectively. A protocol might require a specified file, a successful test result, or a response matching a defined schema. In those cases, the parties can agree in advance which evidence is relevant and how the check is run.
Many tasks are less objective. A summary can be complete but misleading; a design can meet technical requirements but fail a subjective brief. An automated verifier can produce evidence against the stated criteria, but it cannot turn vague criteria into an undisputed judgment. For ambiguous work, the agreement needs a fallback such as human review, and should specify who reviews it and what happens while a decision is pending. VCAP’s described human-review fallback addresses timeout or ambiguity in principle; it does not mean every subjective dispute has a predetermined answer.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What a build story should make verifiable
The title presents a first-person build claim, but the cited public sources do not establish the author’s implementation, deployment, amounts handled, tests, failures, security review, or production use. Those are important distinctions for readers evaluating an escrow system. A useful account should make clear which behavior was demonstrated and under what conditions, rather than letting a protocol sketch imply a tested payment service.
- Architecture: Identify the payment rail and custody model, the components that hold or authorize funds, and how the requester, provider, and verifier interact.
- Authorization: Explain how spending authority is bounded to a task, how limits and expiry work, and how a principal can revoke or reject an action.
- Evidence: Show what delivery artifacts are accepted, how they are tied to the task, and which checks are automated versus subject to human judgment.
- Failure handling: State what happens on late delivery, verifier outage, conflicting results, partial completion, or a disputed refund.
- Evidence of operation: Distinguish a prototype from a deployed service, describe the tests actually run and their limits, and disclose whether an independent security review occurred.
Without those specifics, readers can assess the problem and compare it with public proposals, but cannot independently assess the author’s system or its results.
Best Value
Security crosses every layer
A 2026 survey of security in autonomous LLM agents in agentic commerce groups threats around agent integrity, transaction authorization, inter-agent trust, market manipulation, and regulatory compliance. That framing is a reminder that escrow security is not just a contract or payment-rail question: the agent’s tools, the principal’s spending authority, counterpart identity, evidence quality, custody, settlement, and human or organizational governance all matter. Read the survey.
A signed receipt can help preserve an audit trail, and a smart contract may enforce specified settlement conditions. Neither one alone proves that an agent is trustworthy, that evidence is truthful, that subjective work is correct, or that legal responsibility has been settled. Security claims should be limited to what a system actually checks and enforces.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
