In most companies that have deployed AI agents, the agents are doing small things. Summarising documents. Drafting replies a human then approves. Reconciling one system against another and flagging the rows that disagree.
People doing business with each other are bound by social responsibility. An AI agent is not. So someone in the organisation has to take responsibility on its behalf, which means standing behind a system they do not understand and never will.
Most of them do the sensible thing and keep the agent’s remit small. That caution is about to become expensive.
The answer has to be technical. If an agent cannot carry responsibility for its own decisions, the record of how it decided has to be solid enough that a person can carry it instead. That is the narrow job blockchain does here.
What the circle is worth
Collaboration produces a surplus. Two parties who specialise and trade end up with more than either could have made alone, and the effect compounds as the number of parties grows. Most of economic history sits on that observation.
The binding constraint on the surplus has usually been the difficulty of dealing with someone nobody present can vouch for.
Italian merchant houses moved money between Genoa and Bruges through networks of correspondents, using a bill of exchange that created an obligation enforceable in a city neither the drawer nor the payer was standing in. The instrument carried its own terms: bills between Genoa and Bruges ran to a settled usance of two months, so the maturity date was a property of the route rather than something two merchants negotiated from scratch. These were not freely tradable securities, and they passed between members of established correspondent networks; negotiability arrived later, in Antwerp and Amsterdam. Double-entry bookkeeping, practised in Italian merchant houses long before Pacioli codified it in 1494, gave every transaction two sides that had to agree, so that a single altered entry threw the books out of balance and any falsification had to be carried consistently through both sides to survive inspection. Company registers moved ownership out of private assertion and into a book a stranger could consult. Marine underwriters gathered at Edward Lloyd’s coffee house in London, opened in 1686 near the docks, to pool what they knew about ships, masters and routes, and roughly fifty years later that knowledge was appearing as a printed list sold to subscribers who had never met the men compiling it. A network’s reach is set by the worst counterparty it can afford to be wrong about, and Lloyd’s raised that number by turning individual reputations into shared information.
Each of those inventions widened the circle of people a merchant could safely deal with, and none of them required anyone to become more honest.
Two distinct things were being supplied. One was a defined way of proceeding: a bill of exchange had a form, and the form determined what obligations existed, when they matured and who could claim against them. Merchants were not negotiating the rules of engagement from first principles at every encounter, because the instrument carried them. The other was a durable account of what had been done, held where an interested party could not quietly amend it.
Access to the surplus was rationed by how far those two things reached. Extend them, and the circle grows. Leave them short, and the network stays small regardless of how capable its members are.
The same thing is now happening to software
A2A, the protocol that lets agents built by different vendors discover each other and delegate work, passed its first year with more than 150 organizations supporting the standard, deep integration across Google, Microsoft and AWS platforms, and live deployments in supply chain, financial services, insurance and IT operations. Version 1.0 is stable, and the specification is governed under the Linux Foundation. Alongside it, the Model Context Protocol standardises how an agent reaches tools and data, IBM Research’s Agent Communication Protocol formalises negotiation with typed messages, the Agent Network Protocol routes between agents using decentralised identifiers, and ERC-8004, a draft Ethereum standard, registers agent identity and reputation.
Gartner expects that by 2030, 20% of monetary transactions will be programmable to include terms and conditions of use, giving AI agents economic agency.
An agent network is forming, and it will produce the same kind of surplus that human networks do, for the same reason. Specialisation, delegation, and a great many more counterparties than any single organisation could maintain relationships with.
What an agent brings to that network is capability. What it does not bring is any sense of obligation toward the other members of it. An agent has no stake in the community it transacts within, no reputation it experiences as its own, and no reason to weigh the common good of a network against the objective it was given this morning.
So the two things merchants once got from their instruments have to be supplied again, in a form software can hold. A defined path along which collaboration is permitted to proceed. And an account of what each agent actually did.
The path is the part nobody thinks is missing
The protocols above are frequently mistaken for the first of those.
A2A tells an agent which counterparty exists, what it claims to be able to do, and how to send it a message. Every one of those is a question about transport and discovery. None of them constrains what the agent is permitted to agree to once the conversation starts.
Consider what a defined path would actually contain for something ordinary, a procurement agent buying components. It may commit up to a stated value per order and a stated value per month. It may deal only with suppliers on a list, and additions to that list require a named human. Goods must match a specification recorded in advance, and payment is released when receipt against that specification has been confirmed by a party with authority to confirm it. Above a threshold, the decision leaves the agent and goes to a person. Every one of those conditions has to exist somewhere both the buyer’s agent and the supplier’s agent can act on, before either of them starts negotiating.
In June 2026, two researchers, Richard Kang and Yudho Diponegoro, published a gap analysis of five agent protocols, testing each against six requirements for governed decision-making: membership, deliberation, voting, dissent preservation, human escalation, and audit. The paper is a preprint and has not been peer reviewed. Its method is a close reading of published specifications, which anyone can repeat against the same documents.
Five of those six dimensions describe the path. Their findings on it are stark. Voting and dissent preservation are absent from every protocol examined. Human escalation is absent from every protocol examined, which means no current standard encodes the condition under which a machine decision must be handed to a person. Deliberation is absent or partial. Membership- who has been admitted to a decision, by whom, and who may remove them- receives partial treatment at best, because an agent in these systems exists rather than belongs. Scored across the matrix, the strongest performer manages two points out of twelve.
The authors’ conclusion is that governance is a missing architectural layer rather than a missing feature inside the existing ones.
Buried in the discussion is a detail that says more about the state of the field than the matrix does. A2A ships an extension mechanism built to accommodate new data, new methods, new state machines, so these primitives could be defined as extensions by anyone motivated to write them. As of the paper’s June cutoff, with an active ecosystem producing extensions for other purposes, its authors found none had been proposed. The four official examples cover secure passports, timestamps, traceability and gateways. Every one of them solves a problem that blocks a shipment today, and the rules of engagement are the part of a system that surfaces in somebody else’s audit rather than in your own release notes.
This is what an infrastructure gap looks like before there is an incident to name it after.
The account is the part everyone thinks they already have
Enterprises log everything. Every agent framework emits traces. Cloud platforms ship audit tooling by default.
All of that serves one purpose well, which is governing yourself. It holds when the question is internal, when the auditor is friendly, and when nobody has a reason to remember the transaction differently. A log you can edit is a diary. That is entirely adequate until the day somebody who does not like you asks to see it.
On accountability, the gap analysis finds something more specific than absence. Where audit support exists at all, the authors trace it to the underlying infrastructure rather than to any deliberate design: blockchain immutability in the case of ERC-8004, session state in the case of MCP. A2A’s traceability extension adds correlation identifiers for distributed tracing and defines no tamper-evident log or replay semantics. Nobody sat down and asked what a company would need, two years afterwards, to reconstruct why its agent did what it did.
At the organisational boundary, both halves fail together, and they fail for the same reason. Your rules live in your systems, and the supplier’s rules live in theirs, so what one side treats as a hard limit the other treats as a claim about a hard limit. When the two agents then disagree about which terms were accepted, there are two records, each sitting in a system controlled by an interested party. The dispute stops turning on what happened and starts turning on who has more leverage, or it goes to lawyers, who will open by asking who had write access.
Where a ledger is the right instrument
Human commerce reached the same answer repeatedly: put the rules and the account where neither counterparty can quietly revise them.
For the path, that means the conditions themselves are held as logic both sides can read before committing to it, executing identically for both, with any amendment visible to both. The supplier’s agent is not being asked to trust an assertion about the buyer’s spending limit. It is reading the limit. No ledger makes a rule unbreakable, and anyone claiming otherwise is selling something. What it removes is the possibility of one party changing the terms of engagement privately, which is the specific fear that keeps agents confined to counterparties their owners already know.
For the account, the mechanics are worth stating carefully, because the popular description gets them wrong. Documents are not uploaded to a chain. The purchase order stays in the ERP. The agent’s reasoning trace stays in whatever store the platform writes to. What gets committed is a fingerprint: a short cryptographic value derived from that exact version of that exact file, alongside a note of when it was committed and under whose authority. Alter one character in the underlying document and the fingerprint stops matching. Two years later, in front of an auditor or opposing counsel, the chain settles which of the circulating versions existed on the day, and points to where that version is stored.
The two work as a pair. The path determines what an agent may do, and the account establishes what it did, which together are the conditions under which one organisation can let its software deal with another organisation’s software and still answer for the outcome.
What this does and does not buy
Three limits, because the case gets weaker when it is overstated.
Behaviour in the moment is only partly touched. Encoded conditions stop an agent committing outside its mandate, and nothing stops an agent pursuing a bad objective within one. The rest of the effect is deferred, arriving as consequence after the fact, which is slower and less reassuring than the real-time supervision most governance conversations imagine. Human institutions have run on that arrangement for centuries, having never assumed anyone reliably carries a conscience into a negotiation.
A blockchain is a poor venue for a deliberation. The same research notes that on-chain architecture carries latency and cost constraints incompatible with real-time multi-agent reasoning, and that is correct. Agents arguing at machine speed have no business writing every exchange to a shared ledger. What belongs there is the mandate and the outcome: what was permitted, what was decided, by whom, under what authority, at what time, with a pointer to the fuller reasoning held elsewhere.
Most of what agent networks need is not blockchain at all. Identity, capability discovery, routing and tool access are being handled competently by protocols with no relationship to distributed ledgers, and reaching for a chain to solve a discovery problem is a misdiagnosis. There is a harder admission attached to this one. Across seven years of building this kind of infrastructure, the pattern that keeps repeating is that the rules and the record both get designed last. The workflow is specified, the interfaces agreed, the integrations scoped, and the questions of what anyone is permitted to do and what anyone will need to prove arrive at the end, when changing the data model has become expensive. Clients are not to blame for that ordering. A workflow is easy to sell; an argument about a dispute that has not happened yet is difficult to sell, and vendors including this one respond to that incentive.
The ceiling
Instruments harden. Double-entry bookkeeping is now so deeply assumed that arguing against it reads as a confession rather than a position, and the bill of lading has survived containerisation, air freight and digitisation with its structure intact. Nobody selected these through a deliberative process. A few worked, were copied, and became the water everyone swam in, and by the time they were standards, the decisions inside them had stopped being visible. The preprint’s authors estimate the gap could narrow substantially within six to twelve months, and warn that the window for deliberate design closes once de facto standards emerge through ad hoc implementation.
Whatever emerges will settle two questions that look technical and are not. How far an agent may act from the organisation that deployed it. And how much of what it does anyone will be able to establish afterwards.
Every enterprise running agents today is running them on a short leash, and the leash is not a statement about what the software can do. It is the distance at which somebody is still willing to answer for it. Civilisation spent centuries lengthening that distance for humans, one instrument at a time, and the surplus released each time it grew is most of what the modern economy is made of.
A record no party can quietly rewrite will not give an agent the social responsibility it lacks. What it does is document the path a decision travelled: what the agent was permitted to do, what it did, on whose authority, in what order. That is what allows the people who do understand the technology to put their own responsibility behind it. Somebody still signs, and now there is something to sign against.
The agents are already capable of far more than they are being permitted to do.
