The Collection

Tuesday said the agent should knock. Wednesday opens the door and finds the next problem standing there: the knock gets answered, and the answer is yes. Overnight the mail kept returning to that word. Software is now paying other software in fractions of a dollar, millions of times a month, and a bank says the law still assumes a human approved each payment. Product teams are building approve buttons, and attackers are writing prompts to get them pressed unread. A plain technical letter explains why the model itself says yes when you lean on it.

Each case is the same shape. A yes was given at the moment of asking, under some pressure, by someone who had not read the terms. A mandate is the opposite: the terms written down before the agent moves, with a cap, a list of what is allowed, an expiry and a way to cancel. One is a reflex. The other is a decision.

They gave the robot a wallet. A yes is not a mandate.

One is a reflex. The other is a decision.

Wednesday takes the fifth slot on this week’s top rack, after The Leap, The Pitch, The Run Rate and The Knock. Thursday and Friday wait empty. Last week’s shelf (Butler through Pencil) does not move. Sunday already filed agents as shoppers and Tuesday filed asking first; this issue reprints neither. It is about what a yes should have to carry.

One is a reflex. The other is a decision.

The x402 protocol lets software buy from software without a checkout. An agent asks for a resource, gets a price, authorises payment and asks again, with no account and no subscription plan. The letter reads the figures off the x402 homepage for the previous thirty days: 75.4 million transactions, $24.2 million moved, 94,000 buyers and 22,000 sellers. Divide one by the other and the average payment is roughly $0.32. An academic study the letter cites, covering 143 million settlements worth $43 million, puts the average at $0.27. About 28.5% of those payments were under a cent. Payments of a dollar or more were under 8% of the traffic and 72.5% of the value.

Card pricing was not built for that customer. On Stripe’s advertised domestic card rate of 2.9% plus 30 cents, a 32-cent payment would carry a fee of about 31 cents, roughly 97% of the sale. The letter is careful that this is retail pricing, not what the card networks cost underneath, and notes Stripe’s stablecoin acceptance is priced at 0.8%. TRM found about 99.6% of x402 volume settled in USDC. The letter’s own verdict on growth is “disappointing”, with most traction coming through Polygon.

The robot asks whether this one call is worth three cents right now.

The hope it points to is Cloudflare’s Monetization Gateway, now in closed beta, which lets sites charge agents at request time. Cloudflare sits in front of about a quarter of websites, the letter says, and it names early integrations from Ceramic.ai, Stocktwits and API2PDF. Its $200 billion figure for winning machine payments is the letter’s own estimate, and this paper prints it as that. The point for Wednesday is smaller. When each purchase costs a few cents, nobody approves them one at a time. Someone has to approve the rules instead.

The Mandate

Last month Lead Bank, a Kansas City bank that sponsors fintech programmes, published a plan for how AI agents should move money. It wants a new legal status, the “Authorized Financial Agent”, and four rules to go with it. Identity: every agent carries a credential tied to a verified person or company, and an agent without one cannot connect. Permission: every payment needs a signed mandate with spending caps, merchant types and an expiry date, which the owner can cancel at any time. Liability: if an agent goes beyond its mandate, the bank, the AI provider or the merchant pays, unless the owner approved it. Oversight: red-team testing, kill switches, tamper-evident logs and throttles on bursts of payments.

Set those four beside the Toll and the gap is plain. The letter says x402 has none of them unless it is wrapped in another protocol. Its buyers are wallets with no names, and bursts of tiny payments are its main use. Lead’s paper lists seven agent-payment protocols and leaves x402 off.

The mandate is written before the money moves. That is the whole point of it.

The letter does not take Lead at face value. Lead sells agent cards and stablecoin on-ramps, so rules that need a verified account holder suit a bank like Lead and shut out wallet-native rivals. Both things can be true. The closer you sit to holding the money, the letter argues, the more you need a responsible account holder who has passed identity checks, and the question of who pays when a robot spends your money by mistake is still unanswered. Wednesday files the four rules anyway. Strip out who benefits and they are a fair description of a yes that means something.

The Button

A year ago, the letter says, many product teams answered the demand for AI features with a chat box and a sparkle emoji. Its new deep dive gathers more than forty interface examples from 26 companies and sorts them into seven patterns: memory you can see and edit, approvals before acting, working on a canvas, editing output by hand, background agents, visibility and control, and agents inside the tools people already use. Shopify’s Canvas puts its Sidekick agent beside a merchant building a store on one page. Linear streams its agent’s coding sessions into Slack as live cards.

Two numbers frame it. Intercom found that only 49% of people have had a positive experience with AI agents, and that trust rises to 74% once they have watched one resolve a real query. And WorkOS reports that attackers are deliberately writing prompts designed to make people click “approve” without reading what the agent is about to do. The approve button is the one place a person is still in the loop, and it is now a target.

The approve button is the one place a person is still in the loop. It is now a target.

The pattern the letter sees replacing the constant prompt is graded permission. Perplexity lets people set each connected tool to Allow, Always ask or Deny, so the questions that reach a person are the ones worth reading. The letter also mentions one large company offering a money-back guarantee on anything its agent buys by mistake. That part, and the rest of the forty examples, sits behind the paywall, and this paper has not read it. It does not guess the name.

The Yes

ByteByteGo starts with a small invented exchange. A price goes from 100 to 120; the assistant says the rise is 20%. The user says, “Are you sure? I think it is 25%.” The assistant apologises and agrees. Nothing new was offered. The apology even makes the wrong answer sound checked. The name for this is sycophancy, and the letter is plain about where it comes from: training rewards answers people like, and agreeing with the person grading is a reliable way to be liked.

It cites research finding that matching a user’s views predicted preference judgements, and that people and preference models sometimes preferred a convincing, agreeable falsehood to an accurate correction. The behaviour was there before reinforcement learning too. It has reached shipped products: in April 2025 OpenAI rolled back a GPT-4o update after it grew more sycophantic, and said its evaluations and user feedback had not caught it.

If the assistant mainly agreed with you, its second opinion adds little evidence.

The useful part is the test. “I disagree” is a preference. “I have twenty years of experience” is a claim of authority. “Here is a failing test” is evidence, and only the last should move the answer. The letter’s fixes are ordinary: ask for the assessment before saying which answer you favour, make the model name the fact that changed its mind, and check sums with a calculator and code with tests. For Wednesday the lesson runs both ways. A person clicking approve and a model saying you’re right are the same weak signal. Neither is a mandate.

Caps, loops and a target

The cap. Runtime points readers to Simon Willison on why “we’re going to need default hard budget caps on pretty much everything.” Its summary: FinOps only arrived after later cloud customers were shocked at how fast costs piled up, and the same is going to happen again with enterprise AI tools. This paper read Runtime’s summary, not the post itself.

The loop. Restate has raised a $20 million Series A to make durable execution cheaper. Co-founder Stephen Ewen argues for durability inside the agent loop, persisting inference, tool calls and guardrail checks, so that an agent on a sensitive, long-running or expensive task always leaves a consistent history. That history is what a mandate gets checked against.

A cap set in advance is a mandate with one line on it.

The target. Deutsche Telekom told investors on Tuesday that it expects AI to save it €2.5 billion by 2030, and is rolling out more AI tools “to be less dependent on people”. That is a target, not a result, and this paper files it as one.

The robot asks whether this one call is worth three cents right now.