Payment and permission checks for agent-initiated work
IETF Datatracker · Individual Internet-Draft · Revision 01 ·
Sets out a server-side model for work that AI agents commission and receive later. Defines the task lifecycle, places checks on delegated authority and payment or entitlement before fulfilment, and links repeated requests to one task.
Revisions of this draft
- Revision 01 (current) Posted 8 October 2026 · 58 pages
- Revision 00 Posted 23 July 2026 · 37 pages
Revision 01 replaces revision 00 as the current text. Each revision keeps its own address on the IETF Datatracker. The PDF here is revision 01 as the IETF’s xml2rfc tool renders the filed XML, unmodified; it runs to 47 pages against the plain text’s 58.
The document
- Title
- A Server-Side Model for Gating Agent-Initiated Human-Sourced Asynchronous HTTP Tasks on Payment or Entitlement
- Identifier
- draft-king-yew-choo-agentic-payments-01
- Intended status
- Informational
- Posted
- Expires
- Length
- 58 pages as plain text, 47 as PDF
- Adoption
- An individual submission. Not adopted by any IETF working group.
What the model does
It describes paid, human-sourced asynchronous HTTP tasks initiated by software agents acting for a principal. Clients may retry after uncertain outcomes and act under authority delegated in advance, while fulfilment incurs cost and may not be freely reversible.
The model places a payment or entitlement gate before fulfilment, maps that gate to adjacent protocols, and defines a task state machine.
What it yields
- Gate-before-fulfilment safety. No fulfilment ahead of the check.
- At most one task per retained idempotency key. A retry under the same key does not create a second task.
- At most one gate acceptance per payment requirement. A single requirement cannot be satisfied twice.
- An operator-checkable record. Linking a delivered artefact to operator-controlled records.
All four hold under stated well-formedness constraints and operating assumptions. The draft defines no protocol, no wire format and no conformance requirements.
What changed in revision 01
- Authority before payment. The mandate is tested against the frozen quote, and any human re-approval it requires is recorded, before the server asks for payment. A quote the mandate does not cover is refused (HTTP 403) with no request to pay. A concurrent purchase under the same mandate, an expiry or a revocation can still fail the test after the client has paid; those cases end in a compensating record.
- Refusals at the gate. Refusals are read by cause in one stated order, with authority tested before the payment credential is verified, and a 402 goes out only where a payment challenge can be constructed. Revision 00 ended the task on every failed check; revision 01 can hold it at the gate under a fresh challenge.
- Payment evidence. On a machine-payment path, only a recorded transfer or capture admits the quote. The state revision 00 named credited_or_refunded is renamed compensation_recorded, and a compensating record holds every compensation obligation without establishing that the remedy completes.
- Example and references. A worked example follows one request through the model with values. The draft credits draft-schrock-action-evidence-boundary for the gating pattern and compares its model with the related working paper, version 2.9, in an appendix.
The full list is the draft’s own Section 10, “Changes from -00”.
Sources
- The Internet-Draft on the IETF Datatracker draft-king-yew-choo-agentic-payments-01
- Revision 01 as a PDF PDF · 47 pages
- IETF Datatracker author record King Yew Choo
- The related working paper SSRN · version 2.9 · 68 pages